Spyware / Malware / Virus Removal

laptop seems infected [Solved]

14 min read

Looking for the outcome? Ask AI

dreux Topic Starter

Post #1March 9, 2017, 6:45 AM UTC

I have two profiles on my HP laptop. I noticed on the second one that the keys were not working right: backspace key didn't work at all, the m key minimized the page and the down arrow key would modify the page. I started using the main profile and it seemed fine but now it's doing the same thing with the same keys. The laptop is running Windows 10, upgraded from 7. I ran malware bytes and it found nothing. I tried spybot s&d but that didn't seem to work right so I shut down the laptop. I'm using my desktop right now for this discussion.

Thanks in advance…….:)

Juliet

Post #2March 9, 2017, 9:59 PM UTC

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Please download the installer for Registry Backup from here or here and save to your desktop.
Right-click on tweaking.com_registry_backup_setup.exe and select Run as Administrator >> Follow the prompts for a default installation
Ensure the option Open "Tweaking.com - Registry Backup" When Install Completes is selected >> Next > >> Finish
Once the GUI(graphical user interface) has appeared/loaded:-

Click on Backup Now >> once the process is complete the below will be displayed in the GUI:-

Close Tweaking.com - Registry Backup

Note: There will now be a folder at the root of the Hard-Drive named C:\RegBackup, do not delete this as it is the actual backup just created.

A tutorial for Registry Backup explaining the various features be viewed HERE

``````````````````````````````````````````````````````

Instruction for producing the Farbar Recovery Scan Tool (FRST) and aswMBR logs

Farbar Log

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note:
You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

(A simple way to check your system: Start –> Computer (right click) –> Properties
How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Please make sure All Users is checked

Do not check
*List BCD
*Drivers MD5
*Shortcut txt

Or your logs will be too long to post.

Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please don't run the Farbar Recovery Scan Tool (FRST.txt) from your "Downloads" folder or from "Temporary Internet Files"
Please copy and paste log into your topic.
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please attach that along with the FRST.txt into your reply.

aswMBR Log

Important! Please do NOT perform any fix options offered in aswMBR, we just need to see the report.

Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.
If a prompt stating: The computer supports "Virtualization Technology" appears select Yes
Click the Scan button to start scan.
If you are asked to update the Avast Virus database please allow it to do so.
When it finishes, press the Save Log button, save the logfile to your desktop and post its contents in your reply with the Farbar (FRST) log.

dreux

Post #3March 10, 2017, 8:41 AM UTC

Here is the FRST.txt file:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08-03-2017
Ran by [removed] (administrator) on WINTERFOURTEEN (10-03-2017 02:09:12)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 10 Home (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows10Upgrade\Windows10UpgraderApp.exe
(Tweaking.com) C:\Users\m\Desktop\TweakingRegistryBackup.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7204568 2013-11-04] (Realtek Semiconductor)
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [205512 2017-02-12] (AVAST Software)
HKLM-x32\…\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [509192 2014-12-01] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\…\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4127488 2015-06-16] (Safer-Networking Ltd.)
HKLM\…\RunOnce: [RollbackOnline] => C:\$WINDOWS.~BT\Sources\SetupPlatform.exe [171712 2016-07-15] (Microsoft Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\…\Run: [Power2GoExpress8] => C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe [1718536 2014-07-23] (CyberLink Corp.)
HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-02-12] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-02-12] (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{a03355f9-329a-4d97-b092-c23b496e888c}: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{c1731bfd-bcc7-4f46-b836-71bbfd77dbd9}: [DhcpNameServer] 75.75.76.76 75.75.75.75

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT14/1
HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT14/1
SearchScopes: HKLM -> {612BE911-EE5A-4C4B-AC17-735F57F2C25A} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us2-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM-x32 -> {612BE911-EE5A-4C4B-AC17-735F57F2C25A} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us2-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)

FireFox:
========
FF DefaultProfile: 90uktv83.default
FF ProfilePath: C:\Users\m\AppData\Roaming\Mozilla\Firefox\Profiles\90uktv83.default [2017-03-10]
FF Extension: (SHA-1 deprecation staged rollout) - C:\Users\m\AppData\Roaming\Mozilla\Firefox\Profiles\90uktv83.default\features\{80c4060e-d895-412a-8822-21d182042cb4}\[removed] [2017-03-07]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF48
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF48 [2017-02-12]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 [2017-02-12]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF48
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\Hewlett-Packard\SimplePass\FFBHOExt => not found
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_221.dll [2017-02-15] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_221.dll [2017-02-15] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll [2013-09-05] (Adobe Systems, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)

Chrome:
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\m\AppData\Local\Google\Chrome\User Data\Default [2017-03-08]
CHR Extension: (Google Slides) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-12]
CHR Extension: (Google Docs) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-12]
CHR Extension: (Google Drive) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-05]
CHR Extension: (YouTube) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-05]
CHR Extension: (Google Search) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-05]
CHR Extension: (Google Sheets) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-12]
CHR Extension: (Google Docs Offline) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-07]
CHR Extension: (Avast Online Security) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-03-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-08]
CHR Extension: (Gmail) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-07]
CHR Extension: (Chrome Media Router) - C:\Users\m\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-28]
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx

Here is the additional text file:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-03-2017
Ran by [removed] (10-03-2017 02:12:07)
Running from C:\Users\[removed]\Downloads
Windows 10 Home (X64) (2015-09-15 07:27:57)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2760267380-1240498038-3798659610-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2760267380-1240498038-3798659610-503 - Limited - Disabled)
Guest (S-1-5-21-2760267380-1240498038-3798659610-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2760267380-1240498038-3798659610-1003 - Limited - Enabled)
m (S-1-5-21-2760267380-1240498038-3798659610-1001 - Administrator - Enabled) => C:\Users\m
Ric (S-1-5-21-2760267380-1240498038-3798659610-1004 - Limited - Enabled) => C:\Users\Ric

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 24 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 24.0.0.221 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)
Avast Free Antivirus (HKLM-x32\…\Avast Antivirus) (Version: 17.1.2286 - AVAST Software)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\…\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\…\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.8.4420 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\…\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4.4824 - CyberLink Corp.)
CyberLink Power Media Player 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.5.4608 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.8.4316 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.6.3912 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\…\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.5.4628 - CyberLink Corp.)
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Energy Star (HKLM\…\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)
Generic Trader (HKLM\…\0372-4029-6571-2334) (Version: 8.0 - Certigo, Inc.)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Documentation (HKLM-x32\…\{DCB0919F-F0A6-4C63-800F-B6825D6C0434}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7493.4758 - Hewlett-Packard)
HP SimplePass (HKLM-x32\…\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.27 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}) (Version: 7.5.2.12 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{3EDAF5B5-0CA9-4967-B103-FBFF1162C336}) (Version: 1.2.10 - Hewlett-Packard Company)
HP Utility Center (HKLM\…\{82E6836B-9400-4965-9FD2-46BD64D8BE41}) (Version: 2.4.7 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)
Inst5675 (Version: 8.01.27 - Softex Inc.) Hidden
Inst5676 (Version: 8.01.27 - Softex Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4252 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\…\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.0.0.1002 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\…\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden <==== ATTENTION
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\…\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 51.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 51.0.1 (x86 en-US)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 51.0.1.6234 - Mozilla)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.55 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.32.508.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\…\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.41 - REALTEK Semiconductor Corp.)
Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.5.43 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 19.2.4.10 - Synaptics Incorporated)
Tweaking.com - Registry Backup (HKLM-x32\…\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
UpdateAssistant (x32 Version: 1.3.0.0 - Microsoft Corporation) Hidden
Windows 10 Upgrade Assistant (HKLM-x32\…\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17364 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {025971CB-37A5-4117-8BB0-423498AF7D3D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {056211D5-B8F2-4892-A799-EBCB382B635C} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {088EDD0A-AA77-4B20-BC2F-938D5863E650} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {0BF4BDE5-766B-434B-BCF4-EF77BF3568AD} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {0C778D89-0202-4628-A8BF-1C4B44A12352} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_backup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-12-03] (HP Inc.)
Task: {148B7B4C-68A5-4EA9-8FA2-5A42AB2C33A6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)
Task: {2B0825D6-B0B6-4C39-96C3-CE56679BD9C6} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {35ADA261-DECD-4B31-B8BC-1F15429609A2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)
Task: {3AD3B6C0-987B-45E5-B649-02C110FCCBAE} - System32\Tasks\Start SimplePass => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [2014-09-27] (Hewlett-Packard)
Task: {41EA1258-B3A5-434E-9A2E-3FA913E43A47} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {4437897D-6C7A-4A99-8ACF-ADB2DAB10A34} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {4C013F76-F817-4189-BE35-BEEF63F2C761} - System32\Tasks\Start OPBHOBroker => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [2014-09-27] (Hewlett-Packard)
Task: {5FD497D3-7CC3-4FEC-AFCE-E6BB223F66DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {6A00C2D2-4756-4AE8-952A-EB1B2DC307BE} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-02-07] (AVAST Software)
Task: {6A6CC008-2DAA-4D31-AFF5-41EC3A0B821C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {6F1E19F7-8B86-4D4F-8EF0-94E65E679206} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-2760267380-1240498038-3798659610-1001
Task: {7E3EB9BB-56BA-4A1C-B325-5CBC3BB76257} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {81669B1C-A8B3-4CB2-B5D0-873C6D19858B} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {845F555F-CA03-4052-B5F2-5AE04E9895EF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {8552053E-087E-42B1-8DC8-E28A6DBF77D7} - System32\Tasks\Start OPBHOBrokerDesktop => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [2014-09-27] (Hewlett-Packard)
Task: {8A158B90-957D-4B39-BF3F-58AEBD8424EA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-02-15] (Adobe Systems Incorporated)
Task: {8F0B6327-D25A-46A8-B83C-2F9A49018966} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-02-12] (AVAST Software)
Task: {9179CAD8-6F84-4FEF-B179-F5501DB86150} - System32\Tasks\WpsUpdateTask_Ric => C:\Users\Ric\AppData\Local\Kingsoft\WPS Office\10.2.0.5811\wtoolex\wpsupdate.exe [2017-01-06] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {955C6B05-A46D-47FD-9326-10DB0A9B5B6A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {968A3E1B-AE49-4F5A-8833-D4C39E1379B9} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {9AF84870-09B4-4AEE-8D32-781495091C63} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2014-10-28] (CyberLink Corp.)
Task: {A9B96A0C-DDB8-4CE7-85C0-2A5CCDF4B1D8} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {ABAADDB3-BF3A-4639-852F-5737D02559A1} - System32\Tasks\GoogleUpdateTaskMachineUA1d012cbd434c7e0 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)
Task: {AD80813B-7EA7-4EF3-8411-A74F1F075787} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {B033147A-9B82-44AF-8BB6-0CAD0FAC6517} - System32\Tasks\WpsExternal_Ric_20170106190454 => C:\Users\Ric\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe [2017-01-06] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {DC9D3F7D-0AD7-4FA6-AE43-6E6C959D79AC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-12-03] (HP Inc.)
Task: {DE9A9B4C-925A-4125-A1F6-47C00537A8C6} - System32\Tasks\WpsKtpcntrQingTask_Ric => C:\Users\Ric\AppData\Local\Kingsoft\WPS Office\10.2.0.5811\office6\ktpcntr.exe [2017-01-06] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {E2108A85-E2E1-41AC-AF32-59665AF87902} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {E53D4E00-9E39-4206-A901-6044CAD07B07} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2016-12-29] (Synaptics Incorporated)
Task: {E5E08454-CB4F-489C-8049-3F5EA0113CEC} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe [2016-09-12] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForm.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\WINDOWS\Tasks\WpsExternal_Ric_20170106190454.job => C:\Users\Ric\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe ~/wpscloudlaunch /run_plugin /plugin_name=ktaskschdtool /plugin_entry=ktaskschdtool.dll
Task: C:\WINDOWS\Tasks\WpsKtpcntrQingTask_Ric.job => C:\Users\Ric\AppData\Local\Kingsoft\WPS Office\10.2.0.5811\office6\ktpcntr.exe Ãqing 10.2.0.5811 xxx server_url=hxxp:/kdl1.cache.wps.com/ksodl/wpscfg/client/____client____html____service____bubble.html ic_server_url=hxxp:/info.kingsoftstore.com/wpsv6internet/infos.ads
Task: C:\WINDOWS\Tasks\WpsUpdateTask_Ric.job => C:\Users\Ric\AppData\Local\Kingsoft\WPS Office\10.2.0.5811\wtoolex\wpsupdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\m\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.com/gp/bit/amazonbookmark.html?tag=hp2-desktop-us-20&partner;=HP

==================== Loaded Modules (Whitelisted) ==============

2015-09-15 03:37 - 2015-09-15 03:37 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2014-09-27 13:40 - 2014-09-27 13:40 - 02150400 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2014-09-27 13:39 - 2014-09-27 13:39 - 00035840 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2014-09-27 13:39 - 2014-09-27 13:39 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2014-09-27 13:39 - 2014-09-27 13:39 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2014-09-27 13:48 - 2014-09-27 13:48 - 00420432 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2014-09-27 13:48 - 2014-09-27 13:48 - 00746064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2017-02-07 00:20 - 2016-10-25 01:15 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll
2017-02-07 00:21 - 2016-11-19 04:24 - 02495776 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2017-02-07 00:21 - 2016-11-19 04:24 - 02495776 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-10-11 21:34 - 2015-09-16 23:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-07-10 04:59 - 2015-07-10 04:59 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll
2017-02-07 00:22 - 2016-11-19 00:09 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-02-07 00:17 - 2016-11-19 00:06 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-02-07 00:22 - 2016-11-19 00:06 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-10-11 21:34 - 2015-09-16 23:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-07-10 05:00 - 2015-07-10 07:14 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll
2014-09-27 13:42 - 2014-09-27 13:42 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2015-09-15 01:38 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-09-15 01:38 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-09-15 01:38 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-09-15 01:38 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2017-02-12 12:18 - 2017-02-12 12:18 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-02-12 12:18 - 2017-02-12 12:18 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-02-12 12:16 - 2017-02-12 12:16 - 00289328 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-02-12 12:18 - 2017-02-12 12:18 - 00655056 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 07:25 - 2015-03-27 11:34 - 00000035 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 75.75.76.76 - 75.75.75.75
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [UDP Query User{6E551EC3-027F-43B4-B6E0-4FD1FC82D5F9}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{133B248C-FECF-4B16-8AE8-1EB655467337}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{891E72CF-DE2A-4907-A4AA-95D8F5277483}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [TCP Query User{A3137AC0-3EAF-40F6-9224-7E0622B587B1}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [UDP Query User{9198EB1D-C210-4A0A-BABC-69CEC2491D4C}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [TCP Query User{68BF1A40-8091-4BC4-8730-759EAD3FC7FC}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [{2EA2F5AC-C9DA-445A-B2EB-8E91D1ADDB34}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPSOCKSVC.exe
FirewallRules: [{4954C585-7242-4DD0-850F-50F8E5E12CCD}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{DDA5D020-6885-44C7-B9CC-52256F995D1F}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{26E01EA9-AD92-4CEB-93AA-8841E286C66E}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{B5B77D62-30DD-4AB7-9C47-C8BC9527D424}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{6FAF57AF-344B-4281-834A-FF30CC95B393}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{C43C7D18-6EDE-4880-B47C-9CF2B86610A5}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{7427DFBF-402C-4140-AFDD-D96181B16752}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{0E2F0215-B692-4502-B29A-8E2DDE560B50}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [UDP Query User{98705157-358C-4D99-B2BD-47CD88CB8F82}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [TCP Query User{CF7E4131-E064-4740-81A8-2B0881BD025D}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [UDP Query User{961352EF-7EC8-4461-B457-B9BA4603792E}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [TCP Query User{2B5FCEED-EA78-429D-A150-6450D27D4EBD}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [{F445F697-3829-4F3E-9317-598E26B5B449}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPSOCKSVC.exe
FirewallRules: [{FC32F061-1FC0-4EFF-B2AF-D917A9ECDD77}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{99276F9F-C013-4F23-BE0F-25F17B98C2FF}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{447FA335-4B00-4838-8324-3C2F3459A9B9}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{53CD91B8-E3DE-4FC1-8254-CB967783E7E9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{156ED21E-1E76-4F7B-8128-E7EFF6F17F28}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CDF7BD5E-16D9-4B4D-AD61-094CDD3A7A0C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{AAFB5356-DBDF-48EC-B9E6-A769DE2E5CED}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D00D8884-FB66-4992-AF74-D8B94B62BE69}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [{B608C68F-B2EB-4D72-9093-B6CEA65E6E2C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A1D7FECE-99D3-4FE2-988B-82AB09603CA7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7F0EAA70-58E2-42B0-98B5-A64B56AB17A2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service

==================== Restore Points =========================

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (03/10/2017 01:54:55 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WINTERFOURTEEN)
Description: Activation of app Microsoft.MicrosoftMahjong_8wekyb3d8bbwe!MicrosoftMahjong failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (03/08/2017 10:35:10 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WINTERFOURTEEN)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (03/08/2017 09:40:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 11797

Error: (03/08/2017 09:40:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 11797

Error: (03/08/2017 09:40:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/08/2017 09:40:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10625

Error: (03/08/2017 09:40:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10625

Error: (03/08/2017 09:40:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/08/2017 09:39:59 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9375

Error: (03/08/2017 09:39:59 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9375

System errors:
=============
Error: (03/10/2017 01:54:45 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.

Error: (03/08/2017 10:35:10 PM) (Source: DCOM) (EventID: 10010) (User: WINTERFOURTEEN)
Description: The server CortanaUI.AppXtpp90jhw9p0njjb85kvhxpppgrqfp117.mca did not register with DCOM within the required timeout.

Error: (03/08/2017 10:35:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (03/08/2017 10:35:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (03/08/2017 10:35:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Contact Data_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (03/08/2017 10:35:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sync Host_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (03/08/2017 10:23:58 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {F3B4E234-7A68-4E43-B813-E4BA55A065F6} did not register with DCOM within the required timeout.

Error: (03/08/2017 08:57:29 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Microsoft Visual C++ 2015 UWP Runtime Package.

Error: (03/08/2017 08:57:14 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073cf9: Microsoft Visual C++ 2015 Runtime Package.

Error: (03/08/2017 08:57:05 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Microsoft Visual C++ 2015 Runtime Package.

==================== Memory info ===========================

Processor: Intel(R) Celeron(R) CPU N2830 @ 2.16GHz
Percentage of memory in use: 55%
Total physical RAM: 3985.95 MB
Available physical RAM: 1788.13 MB
Total Virtual: 4689.95 MB
Available Virtual: 2378.06 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:443.78 GB) (Free:394.26 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:20.12 GB) (Free:1.99 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 159542BB)

Partition: GPT.

==================== End of Addition.txt ============================

Here is the aswMBR.txt file:

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-03-10 02:15:46
—————————–
02:15:46.251    OS Version: Windows x64 6.2.9200
02:15:46.251    Number of processors: 2 586 0x3708
02:15:46.254    ComputerName: WINTERFOURTEEN UserName: m
02:15:47.908    Initialize success
02:15:47.930    VM: initialized successfully
02:15:47.932    VM: Intel CPU BiosDisabled
02:15:56.576    AVAST engine defs: 17030901
02:17:15.547    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000022
02:17:15.563    Disk 0 Vendor: HGST_HTS545050A7E680 GG2OAH10 Size: 476940MB BusType: 11
02:17:15.656    Disk 0 MBR read successfully
02:17:15.672    Disk 0 MBR scan
02:17:15.672    Disk 0 unknown MBR code
02:17:15.672    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
02:17:15.797    Disk 0 scanning C:\WINDOWS\system32\drivers
02:17:56.393    Service scanning
02:18:42.801    Modules scanning
02:18:42.801    Disk 0 trace - called modules:
02:18:42.848    ntoskrnl.exe CLASSPNP.SYS disk.sys aswSP.sys storport.sys storahci.sys hal.dll
02:18:42.863    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe001ed1ad060]
02:18:42.879    3 aswSP.sys[fffff800b05adafe] -> nt!IofCallDriver -> \Device\00000022[0xffffe001ed19e2c0]
02:18:44.692    AVAST engine scan C:\WINDOWS
02:18:47.582    AVAST engine scan C:\WINDOWS\system32
02:22:50.296    AVAST engine scan C:\WINDOWS\system32\drivers
02:23:23.860    AVAST engine scan C:\Users\m
02:25:58.967    Disk 0 MBR has been saved successfully to "C:\Users\m\Downloads\MBR.dat"
02:25:58.982    The log file has been saved successfully to "C:\Users\m\Downloads\aswMBR.txt"

I hope I got everything right, if not let me know.

Juliet

Post #4March 10, 2017, 10:31 AM UTC last edited March 20, 2017, 12:34 PM UTC

You did good.

Running from C:\Users\m\Downloads

It's best we move Farbar's to desktop.

Please go to your C:\Users\m\Downloads folder, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
Or use this method Press the windows key [external image: Windows_Logo_key.gif]+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

[external image: Fixlist_zpsdjgcelfa.jpg]

start
CreateRestorePoint:
CloseProcesses:
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT14/1
HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT14/1
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~~~~~~~

[external image: BY4dvz9.png]AdwCleaner

Please download AdwCleaner and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
Follow the prompts.
Click [external image: A49sxPr.png]Scan.
Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click [external image: MqHawIb.png]Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

– File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

~~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt

dreux

Post #5March 11, 2017, 4:22 AM UTC

Here is the Fixlog.txt:

Fix result of Farbar Recovery Scan Tool (x64) Version: 08-03-2017

Ran by [removed] (10-03-2017 21:09:07) Run:2

Running from C:\Users\[removed]\Desktop

[removed]

Boot Mode: Normal

==============================================

fixlist content:

*****************

start

CreateRestorePoint:

CloseProcesses:

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT14/1

HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT14/1

CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx

C:\Users\Ric\AppData\Local\Temp\{CFE2FA9E-01F1-4C77-861C-51DF573221B0}-55.0.2883.87_54.0.2840.99_chrome_updater.exe

ask: {025971CB-37A5-4117-8BB0-423498AF7D3D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION

Task: {056211D5-B8F2-4892-A799-EBCB382B635C} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION

Task: {2B0825D6-B0B6-4C39-96C3-CE56679BD9C6} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION

Task: {4437897D-6C7A-4A99-8ACF-ADB2DAB10A34} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION

Task: {5FD497D3-7CC3-4FEC-AFCE-E6BB223F66DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION

Task: {81669B1C-A8B3-4CB2-B5D0-873C6D19858B} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

Task: {955C6B05-A46D-47FD-9326-10DB0A9B5B6A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION

Task: {968A3E1B-AE49-4F5A-8833-D4C39E1379B9} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION

Task: {AD80813B-7EA7-4EF3-8411-A74F1F075787} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION

Task: {E2108A85-E2E1-41AC-AF32-59665AF87902} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

ShortcutWithArgument: C:\Users\m\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.com/gp/bit/amazonbookmark.html?tag=hp2-desktop-us-20&partner=HP

EmptyTemp:

Hosts:

End

*****************

Restore point was successfully created.

Processes closed successfully.

HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully

HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gomekmidlodglbbmalcneegieacbdmki => key removed successfully

C:\Users\Ric\AppData\Local\Temp\{CFE2FA9E-01F1-4C77-861C-51DF573221B0}-55.0.2883.87_54.0.2840.99_chrome_updater.exe => moved successfully

ask: {025971CB-37A5-4117-8BB0-423498AF7D3D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION => Error: No automatic fix found for this entry.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{056211D5-B8F2-4892-A799-EBCB382B635C} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{056211D5-B8F2-4892-A799-EBCB382B635C} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2B0825D6-B0B6-4C39-96C3-CE56679BD9C6} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2B0825D6-B0B6-4C39-96C3-CE56679BD9C6} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4437897D-6C7A-4A99-8ACF-ADB2DAB10A34} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4437897D-6C7A-4A99-8ACF-ADB2DAB10A34} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5FD497D3-7CC3-4FEC-AFCE-E6BB223F66DB} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5FD497D3-7CC3-4FEC-AFCE-E6BB223F66DB} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{81669B1C-A8B3-4CB2-B5D0-873C6D19858B} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81669B1C-A8B3-4CB2-B5D0-873C6D19858B} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{955C6B05-A46D-47FD-9326-10DB0A9B5B6A} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{955C6B05-A46D-47FD-9326-10DB0A9B5B6A} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{968A3E1B-AE49-4F5A-8833-D4C39E1379B9} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{968A3E1B-AE49-4F5A-8833-D4C39E1379B9} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AD80813B-7EA7-4EF3-8411-A74F1F075787} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AD80813B-7EA7-4EF3-8411-A74F1F075787} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E2108A85-E2E1-41AC-AF32-59665AF87902} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E2108A85-E2E1-41AC-AF32-59665AF87902} => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d => key removed successfully

C:\Users\m\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk => Shortcut argument removed successfully.

C:\Windows\System32\Drivers\etc\hosts => moved successfully

Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 32768 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 9420397 B

Java, Flash, Steam htmlcache => 26468 B

Windows/system/drivers => 0 B

Edge => 1192135 B

Chrome => 438575054 B

Firefox => 382474475 B

Opera => 0 B

Temp, IE cache, history, cookies, recent:

Default => 0 B

Users => 0 B

ProgramData => 0 B

Public => 0 B

systemprofile => 128 B

systemprofile32 => 105 B

LocalService => 18410884 B

NetworkService => 44614 B

m => 158481164 B

Ric => 166238775 B

RecycleBin => 11288288 B

EmptyTemp: => 1.1 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 21:12:38 ====

AdwCleaner[C1].txt:

***** [ Registry ] *****

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{730E03E4-350E-48E5-9D3E-4329903D454D}

[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\Features\4E30E037E0535E84D9E3349209D354D4

[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\Products\4E30E037E0535E84D9E3349209D354D4

[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4E30E037E0535E84D9E3349209D354D4

[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4E30E037E0535E84D9E3349209D354D4

[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\Features\4E30E037E0535E84D9E3349209D354D4

[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\Products\4E30E037E0535E84D9E3349209D354D4

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\itibitiphone.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\itibitiphone.com

[-] Value deleted: HKU\S-1-5-21-2760267380-1240498038-3798659610-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [Itibiti.exe]

***** [ Web browsers ] *****

[-] [C:\Users\Ric\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com

[-] [C:\Users\Ric\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com

*************************

:: "Tracing" keys deleted

:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [2102 Bytes] - [10/03/2017 21:38:19]

C:\AdwCleaner\AdwCleaner[R0].txt - [4772 Bytes] - [24/03/2015 22:54:45]

C:\AdwCleaner\AdwCleaner[S0].txt - [4806 Bytes] - [24/03/2015 22:58:44]

C:\AdwCleaner\AdwCleaner[S1].txt - [2464 Bytes] - [10/03/2017 21:34:44]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2394 Bytes] ##########

Here is the JRT.txt:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.1.1 (02.11.2017)

Operating System: Windows 10 Home x64

Ran by [removed] (Administrator) on Fri 03/10/2017 at 22:03:43.65

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 0

Registry: 1

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{612BE911-EE5A-4C4B-AC17-735F57F2C25A} (Registry Key)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 03/10/2017 at 22:09:52.86

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Juliet

Post #6March 11, 2017, 11:35 AM UTC

Let's update and run a fresh scan with Malwarebytes Anti-Malware

Open Malwarebytes Anti-Malware

On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
When the scan is finished on the bottom right click on SAVE RESULTS then select Copy to Clipboard
If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
Please paste the log back into this thread for review
Exit Malwarebytes

How is the computer now?

dreux

Post #7March 11, 2017, 8:08 PM UTC

Ran MB, no threats were found. I saved the files to .txt since I couldn't find the clipboard. Here is the file:

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 3/11/2017

Scan Time: 1:30 PM

Logfile: MB scan log 3-11-17.txt

Administrator: Yes

Version: 2.1.8.1057

Malware Database: v2017.03.11.06

Rootkit Database: v2017.03.10.02

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 10

CPU: x64

File System: NTFS

User: m

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 348115

Time Elapsed: 21 min, 5 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Juliet

Post #8March 11, 2017, 10:27 PM UTC

This should be the last thing we need to do.

Download Emsisoft Emergency Kit and save it to your desktop.
Double-click icon then click Install
A Window should open highlighting Start Emergency Kit Scanner
Right click on the icon and select Run as administrator
Click 1. Update now!
Once the update is completed select Settings under Scan
Uncheck Join the Emsisoft Anti-Malware Network
Click Scan at the top
Click On scan completion
Click Quarantine detected objects, then click OK
Click Malware Scan
Once completed click View Report
Save the file to your Desktop using the default file name
Copy and paste the report in your reply

How is the computer?

Juliet

Post #9March 16, 2017, 11:13 AM UTC

Still with me?

dreux

Post #10March 17, 2017, 12:49 AM UTC

Sorry for the delay, got distracted by life. Here is the EEK file:

Emsisoft Emergency Kit - Version 2017.2

Last update: 3/16/2017 7:32:21 PM

User account: WINTERFOURTEEN\m

Computer name: WINTERFOURTEEN

OS version: Windows 10x64

Scan settings:

Scan type: Malware Scan

Objects: Rootkits, Memory, Traces, Files

Detect PUPs: On

Scan archives: Off

ADS Scan: On

File extension filter: Off

Direct disk access: Off

Scan start: 3/16/2017 7:36:04 PM

C:\Users\m\Downloads\Avast Free Antivirus 2015 Setup.exe detected: Gen:Variant.Mikey.54756 (

[krnl.xmd]

Scanned 136344

Found 1

Scan end: 3/16/2017 7:41:47 PM

Scan time: 0:05:43

C:\Users\m\Downloads\Avast Free Antivirus 2015 Setup.exe Gen:Variant.Mikey.54756 (

Quarantined 1

Firefox was not working right after all the operations. Anything put in the search field would show an Amazon screen. I deleted and re-installed Firefox but still got the same result, so there is still a problem somewhere.

Juliet

Post #11March 17, 2017, 11:33 AM UTC last edited March 17, 2017, 1:41 PM UTC

It sounds like Amazon Smart Search
I found it listed for Internet explorer in the logs we can remove that to see if it helps but nothing was found for FIrefox.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
Or use this method Press the windows key [external image: Windows_Logo_key.gif]+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

[external image: x1lWQRS.gif]

start
CreateRestorePoint:
CloseProcesses:
SearchScopes: HKLM -> {612BE911-EE5A-4C4B-AC17-735F57F2C25A} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {612BE911-EE5A-4C4B-AC17-735F57F2C25A} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
EmptyTemp:
Hosts:
End

At the top of the Firefox window, click on the 3 horizontal lines and then click Add-ons.
The Add-ons Manager tab will open.
See if you can find anything related to Amazon there.
You should be able to uninstall or never activate from there.

Also look at the help link below.
https://support.mozilla.org/t5/Manage-preferences-and-add-ons/Use-plugins-to-play-audio-video-games-and-more/ta-p/4305#w_popular-plugins

dreux

Post #12March 19, 2017, 12:17 AM UTC

Here is the Fixlog.txt:

Fix result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017

Ran by [removed] (18-03-2017 18:44:45) Run:3

Running from C:\Users\[removed]\Desktop

[removed]

Boot Mode: Normal

==============================================

fixlist content:

*****************

start

CreateRestorePoint:

CloseProcesses:

SearchScopes: HKLM -> {612BE911-EE5A-4C4B-AC17-735F57F2C25A} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 -> {612BE911-EE5A-4C4B-AC17-735F57F2C25A} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

EmptyTemp:

Hosts:

End

*****************

Restore point was successfully created.

Processes closed successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{612BE911-EE5A-4C4B-AC17-735F57F2C25A} => key removed successfully

HKCR\CLSID\{612BE911-EE5A-4C4B-AC17-735F57F2C25A} => key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{612BE911-EE5A-4C4B-AC17-735F57F2C25A} => key not found.

HKCR\Wow6432Node\CLSID\{612BE911-EE5A-4C4B-AC17-735F57F2C25A} => key not found.

C:\Windows\System32\Drivers\etc\hosts => moved successfully

Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 32768 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 4247169 B

Java, Flash, Steam htmlcache => 492 B

Windows/system/drivers => 342355 B

Edge => 68837572 B

Chrome => 118809154 B

Firefox => 20214335 B

Opera => 0 B

Temp, IE cache, history, cookies, recent:

Default => 0 B

Users => 0 B

ProgramData => 0 B

Public => 0 B

systemprofile => 0 B

systemprofile32 => 0 B

LocalService => 2994126 B

NetworkService => 3356 B

m => 38844584 B

Ric => 28485003 B

RecycleBin => 2466676 B

EmptyTemp: => 272.1 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 18:46:14 ====

I looked at Firefoxx add-ons and found two from Amazon. I don't have either one but that what the page looks like when I use the search feature. This only affects the first profile. Firefox works normally in the second profile.

Juliet

Post #13March 19, 2017, 12:33 PM UTC

This is what I see listed for the profiles listed on this computer
C:\Users\m\Desktop
Available Profiles: m & Ric
Can you logon to the one that has the Amazon addon that needs to be removed through the Firefox control panel?
~~~~~~~~~~~~~~~~~~~~~~~~~~~`

Zemana AntiMalware Free

download it from here:

Double-click on the file named Zemana.AntiMalware.Portable to perform a system scan with Zemana AntiMalware Free.
You may be presented with a User Account Control dialog asking you if you want to run this program. If this happens, you should click Yes to allow Zemana AntiMalware to run.
When Zemana AntiMalware starts, click on the Scan button to perform a system scan.
without changing any options, press Scan

When Zemana has finished finished scanning it will show a screen that displays any malware that has been detected. To remove all the malicious files, click on the Next button.
Zemana AntiMalware will now start to remove all the malicious programs from your computer.

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.

open Zemana AntiMalware again and locate the latest report
please paste the contents into your reply
When the process is complete, you can close Zemana AntiMalware

~~~~~~~~~~~~~~~~~~``

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:folderfind
Amazon
:filefind
Amazon
:regfind
Amazon
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

dreux

Post #14March 19, 2017, 4:34 PM UTC

I ran the Zemana AntiMalware Free and it did not find anything. Here is the Look log:

SystemLook 30.07.11 by jpshortstuff

Log created at 11:20 on 19/03/2017 by m

Administrator - Elevation successful

WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== folderfind ==========

Searching for "Amazon"

C:\Program Files (x86)\Online Services\Amazon d—— [12:58 10/08/2014]

========== filefind ==========

Searching for "Amazon"

No files found.

========== regfind ==========

Searching for "Amazon"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost\IndexedDB\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationView\Amazon.com.Amazon_343d40qqvtj1t!App]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppSync\DEH\{1AC83E44-312C-4FE8-B832-C535260105E7}]

"PFN"="Amazon.com.Amazon_343d40qqvtj1t"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Notifications\BackgroundCapability\S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535\App.AppXh92avjg6gfwrp50h9adrc6n2b4hq51b9.mca]

"AppUserModelId"="Amazon.com.Amazon_343d40qqvtj1t!App"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData\SubscribedCollections\packagestate-amazon.com.amazon_343d40qqvtj1t-0]

"ChannelSettingsWLSSubscriptionUri"="https://bn1ap000.storage.live.com/mydata/windows/settings/packagestate-amazon.com.amazon_343d40qqvtj1t-0?NotificationSubscriptions(WLS_SubscriptionId_274C9324-F822-4D29-AE79-13E9B4E6BC9A)"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData\SubscribedCollections\windowspackagesettings-amazon.com.amazon_343d40qqvtj1t]

"ChannelSettingsWLSSubscriptionUri"="https://bn1ap000.storage.live.com/mydata/windows/settings/windowspackagesettings-amazon.com.amazon_343d40qqvtj1t?NotificationSubscriptions(WLS_SubscriptionId_7B2FF396-967A-45D6-B3E6-2552D0819490)"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData\SubscribedCollections\windowspackagesettings-notifications-amazon.com.amazon_343d40qqvtj1t]

"ChannelSettingsWLSSubscriptionUri"="https://bn1ap000.storage.live.com/mydata/windows/settings/windowspackagesettings-notifications-amazon.com.amazon_343d40qqvtj1t?NotificationSubscriptions(WLS_SubscriptionId_37BECCD9-FBFE-46F5-B3BC-A9D56A2AD04E)"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\PackageState\Amazon.com.Amazon_343d40qqvtj1t-0]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\WindowsPackageSettings\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\WindowsPackageSettings\Notifications-Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\Namespace\packagestate\amazon.com.amazon_343d40qqvtj1t-0]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\Namespace\windowspackagesettings\amazon.com.amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\Namespace\windowspackagesettings\notifications-amazon.com.amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\RemoteCollectionInfo\packagestate-amazon.com.amazon_343d40qqvtj1t-0]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\RemoteNamespace\packagestate\amazon.com.amazon_343d40qqvtj1t-0]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\RemoteNamespace\windowspackagesettings\amazon.com.amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\RemoteNamespace\windowspackagesettings\notifications-amazon.com.amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications]

"AppX7s0hfyp9xzzvp6xvq9pzkgbs692ay7gc"="Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\com.amazon.kindle\Capabilities"

[HKEY_CURRENT_USER\SOFTWARE\Classes\ActivatableClasses\Package\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Classes\AppX5fpmq124qtfrz1qjxw37dsg5x1tx7b59\Application]

"AppUserModelID"="AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle"

[HKEY_CURRENT_USER\SOFTWARE\Classes\AppX5fpmq124qtfrz1qjxw37dsg5x1tx7b59\Shell\Open]

"ActivatableClassId"="com.amazon.kindle.AppX36b5gv1t0q85e3w9j3nc0mpjbn5mk54n.wwa"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App.AppXh92avjg6gfwrp50h9adrc6n2b4hq51b9.mca]

"Vendor"="Amazon.com"

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

"DisplayName"="Amazon"

"Description"="Amazon for Windows"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Vendor"="Amazon.com"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"DisplayName"="Amazon"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Description"="Amazon for Windows"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.wwa]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Protocol\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.AppX36b5gv1t0q85e3w9j3nc0mpjbn5mk54n.wwa]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Vendor"="Amazon.com"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"DisplayName"="Amazon"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Description"="Amazon for Windows"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.wwa]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CAmazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t%5Cresources.pri]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CAmazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t%5Cresources.pri\1d0c1c7e5b648a4\502b3ce7]

"@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Resources/Amazon}"="Amazon"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CAmazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t%5Cresources.pri\1d0c1c7e5b648a4\502b3ce7]

"@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/SmallLogo.png}"="C:\Program Files\WindowsApps\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\Assets\SmallLogo.png"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535]

"DisplayName"="Amazon"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535]

"Moniker"="Amazon.com.Amazon_343d40qqvtj1t"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\amazon.com.amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Amazon.com.Amazon_343d40qqvtj1t\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

"PackageRootFolder"="C:\Program Files\WindowsApps\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

"DisplayName"="Amazon"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

"PackageID"="Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\Applications\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle]

"ApplicationContentUris"="+https://k4w-dev.aka.amazon.com/+https://read-preprod.amazon.com/ +https://read-pre-prod-de.amazon.com/ +https://read-pre-prod-fr.amazon.com/ +https://read-pre-prod-es.amazon.com/ +https://read-pre-prod-it.amazon.com/ +https://read-pre-prod-uk.amazon.com/ +https://www.amazon.com/ +https://read.amazon.com/ +https://lesen.amazon.de/ +https://lire.amazon.fr/ +https://leer.amazon.es/ +https://leggi.amazon.it/ +https://read.amazon.co.uk/ +http://images-na.ssl-images-amazon.com +https://images-na.ssl-images-amazon.com +https://www.amazon.com.au"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t\PackageStateRoamingCollectionId]

"CollectionId"="Amazon.com.Amazon_343d40qqvtj1t-0"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t\Schemas]

"PackageFullName"="Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t\SplashScreen\Amazon.com.Amazon_343d40qqvtj1t!App]

"Image"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/SplashScreen.png}"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t\SplashScreen\Amazon.com.Amazon_343d40qqvtj1t!App]

"AppName"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Resources/Amazon}"

[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp\SplashScreen\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t]

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{6D4E5AAA-F63E-40CD-A7BC-ABFF02412DE4}"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|Name=Amazon|Desc=Amazon|LUOwn=S-1-5-21-2760267380-1240498038-3798659610-1001|AppPkgId=S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535|EmbedCtxt=Amazon|Platform=2:6:2|Platform2=GTEQ|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{613E168A-1B63-4168-8DD7-A5130AA48D56}"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|Name=Amazon|Desc=Amazon|LUOwn=S-1-5-21-2760267380-1240498038-3798659610-1004|AppPkgId=S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535|EmbedCtxt=Amazon|Platform=2:6:2|Platform2=GTEQ|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System]

"{185C50C2-C2AD-40F4-AD9B-3621B5B0A420}"="v2.24|Action=Block|Active=TRUE|Dir=In|Name=Amazon|Desc=Amazon|LUOwn=S-1-5-21-2760267380-1240498038-3798659610-1001|AppPkgId=S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535|EmbedCtxt=Amazon|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System]

"{570CE60C-2498-4987-B9A7-609B0BD36414}"="v2.24|Action=Block|Active=TRUE|Dir=Out|Name=Amazon|Desc=Amazon|LUOwn=S-1-5-21-2760267380-1240498038-3798659610-1001|AppPkgId=S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535|EmbedCtxt=Amazon|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System]

"{8E5ABC9E-38A2-46A3-9CB0-6DEDEB1F161A}"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|RA42=IntErnet|RA62=IntErnet|Name=Amazon|Desc=Amazon|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-2760267380-1240498038-3798659610-1001|AppPkgId=S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535|EmbedCtxt=Amazon|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System]

"{2463A602-BEBC-43E7-AFB7-7E31B7B6B97D}"="v2.24|Action=Block|Active=TRUE|Dir=In|Name=Amazon|Desc=Amazon|LUOwn=S-1-5-21-2760267380-1240498038-3798659610-1004|AppPkgId=S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535|EmbedCtxt=Amazon|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System]

"{25CBE5BE-F987-465C-A47E-2FFECE3BB0DB}"="v2.24|Action=Block|Active=TRUE|Dir=Out|Name=Amazon|Desc=Amazon|LUOwn=S-1-5-21-2760267380-1240498038-3798659610-1004|AppPkgId=S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535|EmbedCtxt=Amazon|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System]

"{D90B1655-2B2F-4E25-9467-D0124DB5242D}"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|RA42=IntErnet|RA62=IntErnet|Name=Amazon|Desc=Amazon|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-2760267380-1240498038-3798659610-1004|AppPkgId=S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535|EmbedCtxt=Amazon|"

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\Applications\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\Applications\Amazon.com.Amazon_343d40qqvtj1t\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t]

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t\AppxMetadata\AppxBundleManifest.xml"

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\AppxAllUserStore\DownlevelInstalled\S-1-5-21-2760267380-1240498038-3798659610-1001\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\AppxAllUserStore\DownlevelInstalled\S-1-5-21-2760267380-1240498038-3798659610-1001\Amazon.com.Amazon_343d40qqvtj1t\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t]

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t\AppxMetadata\AppxBundleManifest.xml"

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\AppxManifest.xml"

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\AppxAllUserStore\DownlevelInstalled\S-1-5-21-2760267380-1240498038-3798659610-1004\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\AppxAllUserStore\DownlevelInstalled\S-1-5-21-2760267380-1240498038-3798659610-1004\Amazon.com.Amazon_343d40qqvtj1t\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t]

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t\AppxMetadata\AppxBundleManifest.xml"

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\AppxManifest.xml"

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\AppxAllUserStore\Staged\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\AppxAllUserStore\Staged\Amazon.com.Amazon_343d40qqvtj1t\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t]

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_2015.709.2021.4530_neutral_~_343d40qqvtj1t\AppxMetadata\AppxBundleManifest.xml"

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade\Appx\AppxAllUserStore\Staged\Amazon.com.Amazon_343d40qqvtj1t\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

"Path"="C:\Program Files\WindowsApps\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\AppxManifest.xml"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost\IndexedDB\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationView\Amazon.com.Amazon_343d40qqvtj1t!App]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\AppSync\DEH\{1AC83E44-312C-4FE8-B832-C535260105E7}]

"PFN"="Amazon.com.Amazon_343d40qqvtj1t"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Notifications\BackgroundCapability\S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535\App.AppXh92avjg6gfwrp50h9adrc6n2b4hq51b9.mca]

"AppUserModelId"="Amazon.com.Amazon_343d40qqvtj1t!App"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData\SubscribedCollections\packagestate-amazon.com.amazon_343d40qqvtj1t-0]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData\SubscribedCollections\windowspackagesettings-amazon.com.amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\PackageState\Amazon.com.Amazon_343d40qqvtj1t-0]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\WindowsPackageSettings\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\WindowsPackageSettings\Notifications-Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\Namespace\packagestate\amazon.com.amazon_343d40qqvtj1t-0]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\Namespace\windowspackagesettings\amazon.com.amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\Namespace\windowspackagesettings\notifications-amazon.com.amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\RemoteCollectionInfo\packagestate-amazon.com.amazon_343d40qqvtj1t-0]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\RemoteNamespace\packagestate\amazon.com.amazon_343d40qqvtj1t-0]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\RemoteNamespace\windowspackagesettings\amazon.com.amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData\RemoteNamespace\windowspackagesettings\notifications-amazon.com.amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\RegisteredApplications]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\ActivatableClasses\Package\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\AppX5fpmq124qtfrz1qjxw37dsg5x1tx7b59\Application]

"AppUserModelID"="AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\AppX5fpmq124qtfrz1qjxw37dsg5x1tx7b59\Shell\Open]

"ActivatableClassId"="com.amazon.kindle.AppX36b5gv1t0q85e3w9j3nc0mpjbn5mk54n.wwa"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App.AppXh92avjg6gfwrp50h9adrc6n2b4hq51b9.mca]

"Vendor"="Amazon.com"

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

"DisplayName"="Amazon"

"Description"="Amazon for Windows"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Vendor"="Amazon.com"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"DisplayName"="Amazon"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Description"="Amazon for Windows"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Launch\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.wwa]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Protocol\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.AppX36b5gv1t0q85e3w9j3nc0mpjbn5mk54n.wwa]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Vendor"="Amazon.com"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"DisplayName"="Amazon"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Description"="Amazon for Windows"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Extensions\ContractId\Windows.Search\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.wwa]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CAmazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t%5Cresources.pri]

"@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Resources/Amazon}"="Amazon"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535]

"DisplayName"="Amazon"

"Moniker"="Amazon.com.Amazon_343d40qqvtj1t"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\amazon.com.amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Amazon.com.Amazon_343d40qqvtj1t\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

"PackageRootFolder"="C:\Program Files\WindowsApps\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

"DisplayName"="Amazon"

"PackageID"="Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\Applications\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\com.amazon.kindle]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t\PackageStateRoamingCollectionId]

"CollectionId"="Amazon.com.Amazon_343d40qqvtj1t-0"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t\Schemas]

"PackageFullName"="Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

"Image"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/SplashScreen.png}"

"AppName"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Resources/Amazon}"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp\SplashScreen\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\ActivatableClasses\Package\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\AppX5fpmq124qtfrz1qjxw37dsg5x1tx7b59\Application]

"AppUserModelID"="AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\AppX5fpmq124qtfrz1qjxw37dsg5x1tx7b59\Shell\Open]

"ActivatableClassId"="com.amazon.kindle.AppX36b5gv1t0q85e3w9j3nc0mpjbn5mk54n.wwa"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App.AppXh92avjg6gfwrp50h9adrc6n2b4hq51b9.mca]

"Vendor"="Amazon.com"

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

"DisplayName"="Amazon"

"Description"="Amazon for Windows"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Vendor"="Amazon.com"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"DisplayName"="Amazon"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Launch\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Description"="Amazon for Windows"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Launch\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.wwa]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Protocol\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.AppX36b5gv1t0q85e3w9j3nc0mpjbn5mk54n.wwa]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Vendor"="Amazon.com"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Icon"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/TileLogo.png}"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"DisplayName"="Amazon"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Search\PackageId\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t\ActivatableClassId\App]

"Description"="Amazon for Windows"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Extensions\ContractId\Windows.Search\PackageId\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\ActivatableClassId\com.amazon.kindle.wwa]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CAmazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t%5Cresources.pri]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CAmazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t%5Cresources.pri\1d0c1c7e5b648a4\502b3ce7]

"@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Resources/Amazon}"="Amazon"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1075462752-938795557-416300659-3167647929-3359672805-1183645968-248814535]

"DisplayName"="Amazon"

"Moniker"="Amazon.com.Amazon_343d40qqvtj1t"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\amazon.com.amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Amazon.com.Amazon_343d40qqvtj1t\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t]

"PackageRootFolder"="C:\Program Files\WindowsApps\Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

"DisplayName"="Amazon"

"PackageID"="Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp\Applications\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t]

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t\PackageStateRoamingCollectionId]

"CollectionId"="Amazon.com.Amazon_343d40qqvtj1t-0"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Amazon.com.Amazon_343d40qqvtj1t\Schemas]

"PackageFullName"="Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t"

"Image"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Files/Assets/SplashScreen.png}"

"AppName"="@{Amazon.com.Amazon_3.1.2.8_neutral__343d40qqvtj1t?ms-resource://Amazon.com.Amazon/Resources/Amazon}"

[HKEY_USERS\S-1-5-21-2760267380-1240498038-3798659610-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp\SplashScreen\AMZNMobileLLC.KindleforWindows8_stfe6vwa9jnbp!com.amazon.kindle]

-= EOF =-

Btw, the SystemLook.txt did not show up on the desktop. Also, I uninstalled/installed Firefox on this profile and had the same result, any search would show the Amazon page.

Juliet

Post #15March 20, 2017, 12:54 AM UTC

Most of that information was related to
AMZNMobileLLC.KindleforWindows8
Amazon App for Windows
Kindle app

For Firefox let's try this
Instructions on how to backup your Favorites/Bookmarks and other data can be found below.
Backup Firefox Bookmarks
Proceed with the reset once done.
Firefox: Reset Firefox

~~~

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
Or use this method Press the windows key [external image: Windows_Logo_key.gif]+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

CreateRestorePoint:
CloseProcesses:
C:\Users\m\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk
C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.com/gp/bit/amazonbookmark.html?tag=hp2-desktop-us-20&partner=HP
EmptyTemp:
End

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

laptop seems infected [Solved]

✨ Ask AI

Ask AI