What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Suspecting Malware [Closed]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

Hello Ken,  You helped me greatly on XP a year ago. Now I have almost the same problem on Win 7. I'm running Mozilla Firefox. It barely runs and the computer is extra slow just running non-internet programs. Any tests or treatment I can do before it stops altogether?

Post #2

Oh boy,  Just reviewing other posts I see where you need us to post test results back on to forum.  I'm sorry but I need instructions for that.  All I have here is MS Notepad, and forum replies will not accept its cut and paste, or that's all I know how to do anyway. Sorry I'm a dummy at that!

Post #3

<img data-cke-saved-src="data:text/plain;base64,YXN3TUJSIHZlcnNpb24gMS4wLjEuMjI1MiBDb3B5cmlnaHQoYykgMjAxNCBBVkFTVCBTb2Z0d2FyZQ0KUnVuIGRhdGU6IDIwMTctMDQtMjkgMTk6MTU6MDMNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoxOToxNTowMy41OTMgICAgT1MgVmVyc2lvbjogV2luZG93cyB4NjQgNi4xLjc2MDAgDQoxOToxNTowMy41OTQgICAgTnVtYmVyIG9mIHByb2Nlc3NvcnM6IDEgNTg2IDB4N0MwMg0KMTk6MTU6MDMuNTk4ICAgIENvbXB1dGVyTmFtZTogTEFQVE9QICBVc2VyTmFtZTogcGMNCjE5OjE1OjA1LjA3NSAgICBJbml0aWFsaXplIHN1Y2Nlc3MNCjE5OjE1OjA1LjIyNSAgICBWTTogaW5pdGlhbGl6ZWQgc3VjY2Vzc2Z1bGx5DQoxOToxNTowNS4yMjkgICAgVk06IEFtZCBDUFUgdmlydHVhbGl6YXRpb24gbm90IHN1cHBvcnRlZCANCjE5OjE1OjEzLjUzMiAgICBBVkFTVCBlbmdpbmUgZGVmczogMTcwNDI5MDANCjE5OjE5OjA3LjY5MSAgICBEaXNrIDAgKGJvb3QpIFxEZXZpY2VcSGFyZGRpc2swXERSMCAtPiBcRGV2aWNlXElkZVxJZGVEZXZpY2VQMFQwTDAtMA0KMTk6MTk6MDcuNjk1ICAgIERpc2sgMCBWZW5kb3I6IEhpdGFjaGlfSFRTNTQ1MDE2QjlBMzAwIFBCQk9DNjBGIFNpemU6IDE1MjYyN01CIEJ1c1R5cGU6IDExDQoxOToxOTowNy44NTUgICAgRGlzayAwIE1CUiByZWFkIHN1Y2Nlc3NmdWxseQ0KMTk6MTk6MDcuODU5ICAgIERpc2sgMCBNQlIgc2Nhbg0KMTk6MTk6MDcuODY2ICAgIERpc2sgMCBXaW5kb3dzIDcgZGVmYXVsdCBNQlIgY29kZQ0KMTk6MTk6MDcuODcxICAgIERpc2sgMCBQYXJ0aXRpb24gMSAwMCAgICAgMjcgSGlkZGVuIE5URlMgV2luUkUgTlRGUyAgICAgICAgMTIyOTEgTUIgb2Zmc2V0IDYzDQoxOToxOTowNy44OTUgICAgRGlzayAwIFBhcnRpdGlvbiAyIDgwIChBKSAwNyAgICBIUEZTL05URlMgTlRGUyAgICAgICAgICAxMDEgTUIgb2Zmc2V0IDI1MTczODU1DQoxOToxOTowNy45MDYgICAgRGlzayAwIEJvb3Q6IE5URlMgICAgIGNvZGU9MQ0KMTk6MTk6MDcuOTI0ICAgIERpc2sgMCBQYXJ0aXRpb24gMyAwMCAgICAgMDcgICAgSFBGUy9OVEZTIE5URlMgICAgICAgMTQwMjMyIE1CIG9mZnNldCAyNTM4MjcwMA0KMTk6MTk6MDguMDU0ICAgIERpc2sgMCBzY2FubmluZyBDOlxXaW5kb3dzXHN5c3RlbTMyXGRyaXZlcnMNCjE5OjE5OjI1LjI1NyAgICBTZXJ2aWNlIHNjYW5uaW5nDQoxOToyMDowNi4xNzcgICAgTW9kdWxlcyBzY2FubmluZw0KMTk6MjA6MDYuMTk1ICAgIERpc2sgMCB0cmFjZSAtIGNhbGxlZCBtb2R1bGVzOg0KMTk6MjA6MDYuMjM1ICAgIG50b3Nrcm5sLmV4ZSBDTEFTU1BOUC5TWVMgZGlzay5zeXMgQUNQSS5zeXMgYXRhcG9ydC5TWVMgUENJSURFWC5TWVMgaGFsLmRsbCBtc2FoY2kuc3lzIA0KMTk6MjA6MDYuMjQzICAgIDEgbnQhSW9mQ2FsbERyaXZlciAtPiBcRGV2aWNlXEhhcmRkaXNrMFxEUjBbMHhmZmZmZmE4MDAyZmQxMDYwXQ0KMTk6MjA6MDYuMjU1ICAgIDMgQ0xBU1NQTlAuU1lTW2ZmZmZmODgwMDE2YjQ0M2ZdIC0+IG50IUlvZkNhbGxEcml2ZXIgLT4gWzB4ZmZmZmZhODAwMzAzYjQ2MF0NCjE5OjIwOjA2LjI2NiAgICA1IEFDUEkuc3lzW2ZmZmZmODgwMDBmMTM3ODFdIC0+IG50IUlvZkNhbGxEcml2ZXIgLT4gXERldmljZVxJZGVcSWRlRGV2aWNlUDBUMEwwLTBbMHhmZmZmZmE4MDAyZmNiMDYwXQ0KMTk6MjA6MDYuODMzICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFdpbmRvd3MNCjE5OjIwOjA5LjY1NSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxXaW5kb3dzXHN5c3RlbTMyDQoxOToyMzo1NS45MjEgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcV2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzDQoxOToyNDoxMS43NDkgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcVXNlcnNccGMNCjIwOjEyOjA0LjAxMSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxQcm9ncmFtRGF0YQ0KMjA6MTY6MjMuNjExICAgIERpc2sgMCBzdGF0aXN0aWNzIDQ2MjAyNDEvMC8wIEAgMC43NiBNQi9zDQoyMDoxNjoyMy42NDggICAgU2NhbiBmaW5pc2hlZCBzdWNjZXNzZnVsbHkNCjIwOjI3OjU0LjE5NSAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcV2luZG93c1xTeXN0ZW0zMlxNQlIuZGF0Ig0KMjA6Mjc6NTQuMjE5ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFdpbmRvd3NcU3lzdGVtMzJcYXN3TUJSIExPR2FwcmlsLnR4dCINCjIwOjQ4OjU4LjQxNiAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXE1CUi5kYXQiDQoyMDo0ODo1OC40MjkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXGFzd01CUi50eHQiDQoNDQphc3dNQlIgdmVyc2lvbiAxLjAuMS4yMjUyIENvcHlyaWdodChjKSAyMDE0IEFWQVNUIFNvZnR3YXJlDQpSdW4gZGF0ZTogMjAxNy0wNC0yOSAxOToxNTowMw0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCjE5OjE1OjAzLjU5MyAgICBPUyBWZXJzaW9uOiBXaW5kb3dzIHg2NCA2LjEuNzYwMCANCjE5OjE1OjAzLjU5NCAgICBOdW1iZXIgb2YgcHJvY2Vzc29yczogMSA1ODYgMHg3QzAyDQoxOToxNTowMy41OTggICAgQ29tcHV0ZXJOYW1lOiBMQVBUT1AgIFVzZXJOYW1lOiBwYw0KMTk6MTU6MDUuMDc1ICAgIEluaXRpYWxpemUgc3VjY2Vzcw0KMTk6MTU6MDUuMjI1ICAgIFZNOiBpbml0aWFsaXplZCBzdWNjZXNzZnVsbHkNCjE5OjE1OjA1LjIyOSAgICBWTTogQW1kIENQVSB2aXJ0dWFsaXphdGlvbiBub3Qgc3VwcG9ydGVkIA0KMTk6MTU6MTMuNTMyICAgIEFWQVNUIGVuZ2luZSBkZWZzOiAxNzA0MjkwMA0KMTk6MTk6MDcuNjkxICAgIERpc2sgMCAoYm9vdCkgXERldmljZVxIYXJkZGlzazBcRFIwIC0+IFxEZXZpY2VcSWRlXElkZURldmljZVAwVDBMMC0wDQoxOToxOTowNy42OTUgICAgRGlzayAwIFZlbmRvcjogSGl0YWNoaV9IVFM1NDUwMTZCOUEzMDAgUEJCT0M2MEYgU2l6ZTogMTUyNjI3TUIgQnVzVHlwZTogMTENCjE5OjE5OjA3Ljg1NSAgICBEaXNrIDAgTUJSIHJlYWQgc3VjY2Vzc2Z1bGx5DQoxOToxOTowNy44NTkgICAgRGlzayAwIE1CUiBzY2FuDQoxOToxOTowNy44NjYgICAgRGlzayAwIFdpbmRvd3MgNyBkZWZhdWx0IE1CUiBjb2RlDQoxOToxOTowNy44NzEgICAgRGlzayAwIFBhcnRpdGlvbiAxIDAwICAgICAyNyBIaWRkZW4gTlRGUyBXaW5SRSBOVEZTICAgICAgICAxMjI5MSBNQiBvZmZzZXQgNjMNCjE5OjE5OjA3Ljg5NSAgICBEaXNrIDAgUGFydGl0aW9uIDIgODAgKEEpIDA3ICAgIEhQRlMvTlRGUyBOVEZTICAgICAgICAgIDEwMSBNQiBvZmZzZXQgMjUxNzM4NTUNCjE5OjE5OjA3LjkwNiAgICBEaXNrIDAgQm9vdDogTlRGUyAgICAgY29kZT0xDQoxOToxOTowNy45MjQgICAgRGlzayAwIFBhcnRpdGlvbiAzIDAwICAgICAwNyAgICBIUEZTL05URlMgTlRGUyAgICAgICAxNDAyMzIgTUIgb2Zmc2V0IDI1MzgyNzAwDQoxOToxOTowOC4wNTQgICAgRGlzayAwIHNjYW5uaW5nIEM6XFdpbmRvd3Ncc3lzdGVtMzJcZHJpdmVycw0KMTk6MTk6MjUuMjU3ICAgIFNlcnZpY2Ugc2Nhbm5pbmcNCjE5OjIwOjA2LjE3NyAgICBNb2R1bGVzIHNjYW5uaW5nDQoxOToyMDowNi4xOTUgICAgRGlzayAwIHRyYWNlIC0gY2FsbGVkIG1vZHVsZXM6DQoxOToyMDowNi4yMzUgICAgbnRvc2tybmwuZXhlIENMQVNTUE5QLlNZUyBkaXNrLnN5cyBBQ1BJLnN5cyBhdGFwb3J0LlNZUyBQQ0lJREVYLlNZUyBoYWwuZGxsIG1zYWhjaS5zeXMgDQoxOToyMDowNi4yNDMgICAgMSBudCFJb2ZDYWxsRHJpdmVyIC0+IFxEZXZpY2VcSGFyZGRpc2swXERSMFsweGZmZmZmYTgwMDJmZDEwNjBdDQoxOToyMDowNi4yNTUgICAgMyBDTEFTU1BOUC5TWVNbZmZmZmY4ODAwMTZiNDQzZl0gLT4gbnQhSW9mQ2FsbERyaXZlciAtPiBbMHhmZmZmZmE4MDAzMDNiNDYwXQ0KMTk6MjA6MDYuMjY2ICAgIDUgQUNQSS5zeXNbZmZmZmY4ODAwMGYxMzc4MV0gLT4gbnQhSW9mQ2FsbERyaXZlciAtPiBcRGV2aWNlXElkZVxJZGVEZXZpY2VQMFQwTDAtMFsweGZmZmZmYTgwMDJmY2IwNjBdDQoxOToyMDowNi44MzMgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcV2luZG93cw0KMTk6MjA6MDkuNjU1ICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFdpbmRvd3Ncc3lzdGVtMzINCjE5OjIzOjU1LjkyMSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxXaW5kb3dzXHN5c3RlbTMyXGRyaXZlcnMNCjE5OjI0OjExLjc0OSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxVc2Vyc1xwYw0KMjA6MTI6MDQuMDExICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFByb2dyYW1EYXRhDQoyMDoxNjoyMy42MTEgICAgRGlzayAwIHN0YXRpc3RpY3MgNDYyMDI0MS8wLzAgQCAwLjc2IE1CL3MNCjIwOjE2OjIzLjY0OCAgICBTY2FuIGZpbmlzaGVkIHN1Y2Nlc3NmdWxseQ0KMjA6Mjc6NTQuMTk1ICAgIERpc2sgMCBNQlIgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxXaW5kb3dzXFN5c3RlbTMyXE1CUi5kYXQiDQoyMDoyNzo1NC4yMTkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcV2luZG93c1xTeXN0ZW0zMlxhc3dNQlIgTE9HYXByaWwudHh0Ig0KMjA6NDg6NTguNDE2ICAgIERpc2sgMCBNQlIgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxVc2Vyc1xwY1xEb2N1bWVudHNcTUJSLmRhdCINCjIwOjQ4OjU4LjQyOSAgICBUaGUgbG9nIGZpbGUgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxVc2Vyc1xwY1xEb2N1bWVudHNcYXN3TUJSLnR4dCINCjIwOjU5OjE4Ljc3OCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjA6NTk6MTguNzk1ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIxOjAwOjI1LjI0MCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjE6MDA6MjUuMjUxICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIxOjAyOjMxLjkxNCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjE6MDI6MzEuOTI5ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIzOjE0OjA0LjQyOCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXE1CUi5kYXQiDQoyMzoxNDowNC40MzkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXGFzd01CUi50eHQiDQoNDQo=" src="data:text/plain;base64,YXN3TUJSIHZlcnNpb24gMS4wLjEuMjI1MiBDb3B5cmlnaHQoYykgMjAxNCBBVkFTVCBTb2Z0d2FyZQ0KUnVuIGRhdGU6IDIwMTctMDQtMjkgMTk6MTU6MDMNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoxOToxNTowMy41OTMgICAgT1MgVmVyc2lvbjogV2luZG93cyB4NjQgNi4xLjc2MDAgDQoxOToxNTowMy41OTQgICAgTnVtYmVyIG9mIHByb2Nlc3NvcnM6IDEgNTg2IDB4N0MwMg0KMTk6MTU6MDMuNTk4ICAgIENvbXB1dGVyTmFtZTogTEFQVE9QICBVc2VyTmFtZTogcGMNCjE5OjE1OjA1LjA3NSAgICBJbml0aWFsaXplIHN1Y2Nlc3MNCjE5OjE1OjA1LjIyNSAgICBWTTogaW5pdGlhbGl6ZWQgc3VjY2Vzc2Z1bGx5DQoxOToxNTowNS4yMjkgICAgVk06IEFtZCBDUFUgdmlydHVhbGl6YXRpb24gbm90IHN1cHBvcnRlZCANCjE5OjE1OjEzLjUzMiAgICBBVkFTVCBlbmdpbmUgZGVmczogMTcwNDI5MDANCjE5OjE5OjA3LjY5MSAgICBEaXNrIDAgKGJvb3QpIFxEZXZpY2VcSGFyZGRpc2swXERSMCAtPiBcRGV2aWNlXElkZVxJZGVEZXZpY2VQMFQwTDAtMA0KMTk6MTk6MDcuNjk1ICAgIERpc2sgMCBWZW5kb3I6IEhpdGFjaGlfSFRTNTQ1MDE2QjlBMzAwIFBCQk9DNjBGIFNpemU6IDE1MjYyN01CIEJ1c1R5cGU6IDExDQoxOToxOTowNy44NTUgICAgRGlzayAwIE1CUiByZWFkIHN1Y2Nlc3NmdWxseQ0KMTk6MTk6MDcuODU5ICAgIERpc2sgMCBNQlIgc2Nhbg0KMTk6MTk6MDcuODY2ICAgIERpc2sgMCBXaW5kb3dzIDcgZGVmYXVsdCBNQlIgY29kZQ0KMTk6MTk6MDcuODcxICAgIERpc2sgMCBQYXJ0aXRpb24gMSAwMCAgICAgMjcgSGlkZGVuIE5URlMgV2luUkUgTlRGUyAgICAgICAgMTIyOTEgTUIgb2Zmc2V0IDYzDQoxOToxOTowNy44OTUgICAgRGlzayAwIFBhcnRpdGlvbiAyIDgwIChBKSAwNyAgICBIUEZTL05URlMgTlRGUyAgICAgICAgICAxMDEgTUIgb2Zmc2V0IDI1MTczODU1DQoxOToxOTowNy45MDYgICAgRGlzayAwIEJvb3Q6IE5URlMgICAgIGNvZGU9MQ0KMTk6MTk6MDcuOTI0ICAgIERpc2sgMCBQYXJ0aXRpb24gMyAwMCAgICAgMDcgICAgSFBGUy9OVEZTIE5URlMgICAgICAgMTQwMjMyIE1CIG9mZnNldCAyNTM4MjcwMA0KMTk6MTk6MDguMDU0ICAgIERpc2sgMCBzY2FubmluZyBDOlxXaW5kb3dzXHN5c3RlbTMyXGRyaXZlcnMNCjE5OjE5OjI1LjI1NyAgICBTZXJ2aWNlIHNjYW5uaW5nDQoxOToyMDowNi4xNzcgICAgTW9kdWxlcyBzY2FubmluZw0KMTk6MjA6MDYuMTk1ICAgIERpc2sgMCB0cmFjZSAtIGNhbGxlZCBtb2R1bGVzOg0KMTk6MjA6MDYuMjM1ICAgIG50b3Nrcm5sLmV4ZSBDTEFTU1BOUC5TWVMgZGlzay5zeXMgQUNQSS5zeXMgYXRhcG9ydC5TWVMgUENJSURFWC5TWVMgaGFsLmRsbCBtc2FoY2kuc3lzIA0KMTk6MjA6MDYuMjQzICAgIDEgbnQhSW9mQ2FsbERyaXZlciAtPiBcRGV2aWNlXEhhcmRkaXNrMFxEUjBbMHhmZmZmZmE4MDAyZmQxMDYwXQ0KMTk6MjA6MDYuMjU1ICAgIDMgQ0xBU1NQTlAuU1lTW2ZmZmZmODgwMDE2YjQ0M2ZdIC0+IG50IUlvZkNhbGxEcml2ZXIgLT4gWzB4ZmZmZmZhODAwMzAzYjQ2MF0NCjE5OjIwOjA2LjI2NiAgICA1IEFDUEkuc3lzW2ZmZmZmODgwMDBmMTM3ODFdIC0+IG50IUlvZkNhbGxEcml2ZXIgLT4gXERldmljZVxJZGVcSWRlRGV2aWNlUDBUMEwwLTBbMHhmZmZmZmE4MDAyZmNiMDYwXQ0KMTk6MjA6MDYuODMzICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFdpbmRvd3MNCjE5OjIwOjA5LjY1NSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxXaW5kb3dzXHN5c3RlbTMyDQoxOToyMzo1NS45MjEgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcV2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzDQoxOToyNDoxMS43NDkgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcVXNlcnNccGMNCjIwOjEyOjA0LjAxMSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxQcm9ncmFtRGF0YQ0KMjA6MTY6MjMuNjExICAgIERpc2sgMCBzdGF0aXN0aWNzIDQ2MjAyNDEvMC8wIEAgMC43NiBNQi9zDQoyMDoxNjoyMy42NDggICAgU2NhbiBmaW5pc2hlZCBzdWNjZXNzZnVsbHkNCjIwOjI3OjU0LjE5NSAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcV2luZG93c1xTeXN0ZW0zMlxNQlIuZGF0Ig0KMjA6Mjc6NTQuMjE5ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFdpbmRvd3NcU3lzdGVtMzJcYXN3TUJSIExPR2FwcmlsLnR4dCINCjIwOjQ4OjU4LjQxNiAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXE1CUi5kYXQiDQoyMDo0ODo1OC40MjkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXGFzd01CUi50eHQiDQoNDQphc3dNQlIgdmVyc2lvbiAxLjAuMS4yMjUyIENvcHlyaWdodChjKSAyMDE0IEFWQVNUIFNvZnR3YXJlDQpSdW4gZGF0ZTogMjAxNy0wNC0yOSAxOToxNTowMw0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCjE5OjE1OjAzLjU5MyAgICBPUyBWZXJzaW9uOiBXaW5kb3dzIHg2NCA2LjEuNzYwMCANCjE5OjE1OjAzLjU5NCAgICBOdW1iZXIgb2YgcHJvY2Vzc29yczogMSA1ODYgMHg3QzAyDQoxOToxNTowMy41OTggICAgQ29tcHV0ZXJOYW1lOiBMQVBUT1AgIFVzZXJOYW1lOiBwYw0KMTk6MTU6MDUuMDc1ICAgIEluaXRpYWxpemUgc3VjY2Vzcw0KMTk6MTU6MDUuMjI1ICAgIFZNOiBpbml0aWFsaXplZCBzdWNjZXNzZnVsbHkNCjE5OjE1OjA1LjIyOSAgICBWTTogQW1kIENQVSB2aXJ0dWFsaXphdGlvbiBub3Qgc3VwcG9ydGVkIA0KMTk6MTU6MTMuNTMyICAgIEFWQVNUIGVuZ2luZSBkZWZzOiAxNzA0MjkwMA0KMTk6MTk6MDcuNjkxICAgIERpc2sgMCAoYm9vdCkgXERldmljZVxIYXJkZGlzazBcRFIwIC0+IFxEZXZpY2VcSWRlXElkZURldmljZVAwVDBMMC0wDQoxOToxOTowNy42OTUgICAgRGlzayAwIFZlbmRvcjogSGl0YWNoaV9IVFM1NDUwMTZCOUEzMDAgUEJCT0M2MEYgU2l6ZTogMTUyNjI3TUIgQnVzVHlwZTogMTENCjE5OjE5OjA3Ljg1NSAgICBEaXNrIDAgTUJSIHJlYWQgc3VjY2Vzc2Z1bGx5DQoxOToxOTowNy44NTkgICAgRGlzayAwIE1CUiBzY2FuDQoxOToxOTowNy44NjYgICAgRGlzayAwIFdpbmRvd3MgNyBkZWZhdWx0IE1CUiBjb2RlDQoxOToxOTowNy44NzEgICAgRGlzayAwIFBhcnRpdGlvbiAxIDAwICAgICAyNyBIaWRkZW4gTlRGUyBXaW5SRSBOVEZTICAgICAgICAxMjI5MSBNQiBvZmZzZXQgNjMNCjE5OjE5OjA3Ljg5NSAgICBEaXNrIDAgUGFydGl0aW9uIDIgODAgKEEpIDA3ICAgIEhQRlMvTlRGUyBOVEZTICAgICAgICAgIDEwMSBNQiBvZmZzZXQgMjUxNzM4NTUNCjE5OjE5OjA3LjkwNiAgICBEaXNrIDAgQm9vdDogTlRGUyAgICAgY29kZT0xDQoxOToxOTowNy45MjQgICAgRGlzayAwIFBhcnRpdGlvbiAzIDAwICAgICAwNyAgICBIUEZTL05URlMgTlRGUyAgICAgICAxNDAyMzIgTUIgb2Zmc2V0IDI1MzgyNzAwDQoxOToxOTowOC4wNTQgICAgRGlzayAwIHNjYW5uaW5nIEM6XFdpbmRvd3Ncc3lzdGVtMzJcZHJpdmVycw0KMTk6MTk6MjUuMjU3ICAgIFNlcnZpY2Ugc2Nhbm5pbmcNCjE5OjIwOjA2LjE3NyAgICBNb2R1bGVzIHNjYW5uaW5nDQoxOToyMDowNi4xOTUgICAgRGlzayAwIHRyYWNlIC0gY2FsbGVkIG1vZHVsZXM6DQoxOToyMDowNi4yMzUgICAgbnRvc2tybmwuZXhlIENMQVNTUE5QLlNZUyBkaXNrLnN5cyBBQ1BJLnN5cyBhdGFwb3J0LlNZUyBQQ0lJREVYLlNZUyBoYWwuZGxsIG1zYWhjaS5zeXMgDQoxOToyMDowNi4yNDMgICAgMSBudCFJb2ZDYWxsRHJpdmVyIC0+IFxEZXZpY2VcSGFyZGRpc2swXERSMFsweGZmZmZmYTgwMDJmZDEwNjBdDQoxOToyMDowNi4yNTUgICAgMyBDTEFTU1BOUC5TWVNbZmZmZmY4ODAwMTZiNDQzZl0gLT4gbnQhSW9mQ2FsbERyaXZlciAtPiBbMHhmZmZmZmE4MDAzMDNiNDYwXQ0KMTk6MjA6MDYuMjY2ICAgIDUgQUNQSS5zeXNbZmZmZmY4ODAwMGYxMzc4MV0gLT4gbnQhSW9mQ2FsbERyaXZlciAtPiBcRGV2aWNlXElkZVxJZGVEZXZpY2VQMFQwTDAtMFsweGZmZmZmYTgwMDJmY2IwNjBdDQoxOToyMDowNi44MzMgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcV2luZG93cw0KMTk6MjA6MDkuNjU1ICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFdpbmRvd3Ncc3lzdGVtMzINCjE5OjIzOjU1LjkyMSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxXaW5kb3dzXHN5c3RlbTMyXGRyaXZlcnMNCjE5OjI0OjExLjc0OSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxVc2Vyc1xwYw0KMjA6MTI6MDQuMDExICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFByb2dyYW1EYXRhDQoyMDoxNjoyMy42MTEgICAgRGlzayAwIHN0YXRpc3RpY3MgNDYyMDI0MS8wLzAgQCAwLjc2IE1CL3MNCjIwOjE2OjIzLjY0OCAgICBTY2FuIGZpbmlzaGVkIHN1Y2Nlc3NmdWxseQ0KMjA6Mjc6NTQuMTk1ICAgIERpc2sgMCBNQlIgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxXaW5kb3dzXFN5c3RlbTMyXE1CUi5kYXQiDQoyMDoyNzo1NC4yMTkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcV2luZG93c1xTeXN0ZW0zMlxhc3dNQlIgTE9HYXByaWwudHh0Ig0KMjA6NDg6NTguNDE2ICAgIERpc2sgMCBNQlIgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxVc2Vyc1xwY1xEb2N1bWVudHNcTUJSLmRhdCINCjIwOjQ4OjU4LjQyOSAgICBUaGUgbG9nIGZpbGUgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxVc2Vyc1xwY1xEb2N1bWVudHNcYXN3TUJSLnR4dCINCjIwOjU5OjE4Ljc3OCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjA6NTk6MTguNzk1ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIxOjAwOjI1LjI0MCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjE6MDA6MjUuMjUxICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIxOjAyOjMxLjkxNCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjE6MDI6MzEuOTI5ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIzOjE0OjA0LjQyOCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXE1CUi5kYXQiDQoyMzoxNDowNC40MzkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXGFzd01CUi50eHQiDQoNDQo=" alt="">

Post #4

<img data-cke-saved-src="data:text/plain;base64,YXN3TUJSIHZlcnNpb24gMS4wLjEuMjI1MiBDb3B5cmlnaHQoYykgMjAxNCBBVkFTVCBTb2Z0d2FyZQ0KUnVuIGRhdGU6IDIwMTctMDQtMjkgMTk6MTU6MDMNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoxOToxNTowMy41OTMgICAgT1MgVmVyc2lvbjogV2luZG93cyB4NjQgNi4xLjc2MDAgDQoxOToxNTowMy41OTQgICAgTnVtYmVyIG9mIHByb2Nlc3NvcnM6IDEgNTg2IDB4N0MwMg0KMTk6MTU6MDMuNTk4ICAgIENvbXB1dGVyTmFtZTogTEFQVE9QICBVc2VyTmFtZTogcGMNCjE5OjE1OjA1LjA3NSAgICBJbml0aWFsaXplIHN1Y2Nlc3MNCjE5OjE1OjA1LjIyNSAgICBWTTogaW5pdGlhbGl6ZWQgc3VjY2Vzc2Z1bGx5DQoxOToxNTowNS4yMjkgICAgVk06IEFtZCBDUFUgdmlydHVhbGl6YXRpb24gbm90IHN1cHBvcnRlZCANCjE5OjE1OjEzLjUzMiAgICBBVkFTVCBlbmdpbmUgZGVmczogMTcwNDI5MDANCjE5OjE5OjA3LjY5MSAgICBEaXNrIDAgKGJvb3QpIFxEZXZpY2VcSGFyZGRpc2swXERSMCAtPiBcRGV2aWNlXElkZVxJZGVEZXZpY2VQMFQwTDAtMA0KMTk6MTk6MDcuNjk1ICAgIERpc2sgMCBWZW5kb3I6IEhpdGFjaGlfSFRTNTQ1MDE2QjlBMzAwIFBCQk9DNjBGIFNpemU6IDE1MjYyN01CIEJ1c1R5cGU6IDExDQoxOToxOTowNy44NTUgICAgRGlzayAwIE1CUiByZWFkIHN1Y2Nlc3NmdWxseQ0KMTk6MTk6MDcuODU5ICAgIERpc2sgMCBNQlIgc2Nhbg0KMTk6MTk6MDcuODY2ICAgIERpc2sgMCBXaW5kb3dzIDcgZGVmYXVsdCBNQlIgY29kZQ0KMTk6MTk6MDcuODcxICAgIERpc2sgMCBQYXJ0aXRpb24gMSAwMCAgICAgMjcgSGlkZGVuIE5URlMgV2luUkUgTlRGUyAgICAgICAgMTIyOTEgTUIgb2Zmc2V0IDYzDQoxOToxOTowNy44OTUgICAgRGlzayAwIFBhcnRpdGlvbiAyIDgwIChBKSAwNyAgICBIUEZTL05URlMgTlRGUyAgICAgICAgICAxMDEgTUIgb2Zmc2V0IDI1MTczODU1DQoxOToxOTowNy45MDYgICAgRGlzayAwIEJvb3Q6IE5URlMgICAgIGNvZGU9MQ0KMTk6MTk6MDcuOTI0ICAgIERpc2sgMCBQYXJ0aXRpb24gMyAwMCAgICAgMDcgICAgSFBGUy9OVEZTIE5URlMgICAgICAgMTQwMjMyIE1CIG9mZnNldCAyNTM4MjcwMA0KMTk6MTk6MDguMDU0ICAgIERpc2sgMCBzY2FubmluZyBDOlxXaW5kb3dzXHN5c3RlbTMyXGRyaXZlcnMNCjE5OjE5OjI1LjI1NyAgICBTZXJ2aWNlIHNjYW5uaW5nDQoxOToyMDowNi4xNzcgICAgTW9kdWxlcyBzY2FubmluZw0KMTk6MjA6MDYuMTk1ICAgIERpc2sgMCB0cmFjZSAtIGNhbGxlZCBtb2R1bGVzOg0KMTk6MjA6MDYuMjM1ICAgIG50b3Nrcm5sLmV4ZSBDTEFTU1BOUC5TWVMgZGlzay5zeXMgQUNQSS5zeXMgYXRhcG9ydC5TWVMgUENJSURFWC5TWVMgaGFsLmRsbCBtc2FoY2kuc3lzIA0KMTk6MjA6MDYuMjQzICAgIDEgbnQhSW9mQ2FsbERyaXZlciAtPiBcRGV2aWNlXEhhcmRkaXNrMFxEUjBbMHhmZmZmZmE4MDAyZmQxMDYwXQ0KMTk6MjA6MDYuMjU1ICAgIDMgQ0xBU1NQTlAuU1lTW2ZmZmZmODgwMDE2YjQ0M2ZdIC0+IG50IUlvZkNhbGxEcml2ZXIgLT4gWzB4ZmZmZmZhODAwMzAzYjQ2MF0NCjE5OjIwOjA2LjI2NiAgICA1IEFDUEkuc3lzW2ZmZmZmODgwMDBmMTM3ODFdIC0+IG50IUlvZkNhbGxEcml2ZXIgLT4gXERldmljZVxJZGVcSWRlRGV2aWNlUDBUMEwwLTBbMHhmZmZmZmE4MDAyZmNiMDYwXQ0KMTk6MjA6MDYuODMzICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFdpbmRvd3MNCjE5OjIwOjA5LjY1NSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxXaW5kb3dzXHN5c3RlbTMyDQoxOToyMzo1NS45MjEgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcV2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzDQoxOToyNDoxMS43NDkgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcVXNlcnNccGMNCjIwOjEyOjA0LjAxMSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxQcm9ncmFtRGF0YQ0KMjA6MTY6MjMuNjExICAgIERpc2sgMCBzdGF0aXN0aWNzIDQ2MjAyNDEvMC8wIEAgMC43NiBNQi9zDQoyMDoxNjoyMy42NDggICAgU2NhbiBmaW5pc2hlZCBzdWNjZXNzZnVsbHkNCjIwOjI3OjU0LjE5NSAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcV2luZG93c1xTeXN0ZW0zMlxNQlIuZGF0Ig0KMjA6Mjc6NTQuMjE5ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFdpbmRvd3NcU3lzdGVtMzJcYXN3TUJSIExPR2FwcmlsLnR4dCINCjIwOjQ4OjU4LjQxNiAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXE1CUi5kYXQiDQoyMDo0ODo1OC40MjkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXGFzd01CUi50eHQiDQoNDQphc3dNQlIgdmVyc2lvbiAxLjAuMS4yMjUyIENvcHlyaWdodChjKSAyMDE0IEFWQVNUIFNvZnR3YXJlDQpSdW4gZGF0ZTogMjAxNy0wNC0yOSAxOToxNTowMw0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCjE5OjE1OjAzLjU5MyAgICBPUyBWZXJzaW9uOiBXaW5kb3dzIHg2NCA2LjEuNzYwMCANCjE5OjE1OjAzLjU5NCAgICBOdW1iZXIgb2YgcHJvY2Vzc29yczogMSA1ODYgMHg3QzAyDQoxOToxNTowMy41OTggICAgQ29tcHV0ZXJOYW1lOiBMQVBUT1AgIFVzZXJOYW1lOiBwYw0KMTk6MTU6MDUuMDc1ICAgIEluaXRpYWxpemUgc3VjY2Vzcw0KMTk6MTU6MDUuMjI1ICAgIFZNOiBpbml0aWFsaXplZCBzdWNjZXNzZnVsbHkNCjE5OjE1OjA1LjIyOSAgICBWTTogQW1kIENQVSB2aXJ0dWFsaXphdGlvbiBub3Qgc3VwcG9ydGVkIA0KMTk6MTU6MTMuNTMyICAgIEFWQVNUIGVuZ2luZSBkZWZzOiAxNzA0MjkwMA0KMTk6MTk6MDcuNjkxICAgIERpc2sgMCAoYm9vdCkgXERldmljZVxIYXJkZGlzazBcRFIwIC0+IFxEZXZpY2VcSWRlXElkZURldmljZVAwVDBMMC0wDQoxOToxOTowNy42OTUgICAgRGlzayAwIFZlbmRvcjogSGl0YWNoaV9IVFM1NDUwMTZCOUEzMDAgUEJCT0M2MEYgU2l6ZTogMTUyNjI3TUIgQnVzVHlwZTogMTENCjE5OjE5OjA3Ljg1NSAgICBEaXNrIDAgTUJSIHJlYWQgc3VjY2Vzc2Z1bGx5DQoxOToxOTowNy44NTkgICAgRGlzayAwIE1CUiBzY2FuDQoxOToxOTowNy44NjYgICAgRGlzayAwIFdpbmRvd3MgNyBkZWZhdWx0IE1CUiBjb2RlDQoxOToxOTowNy44NzEgICAgRGlzayAwIFBhcnRpdGlvbiAxIDAwICAgICAyNyBIaWRkZW4gTlRGUyBXaW5SRSBOVEZTICAgICAgICAxMjI5MSBNQiBvZmZzZXQgNjMNCjE5OjE5OjA3Ljg5NSAgICBEaXNrIDAgUGFydGl0aW9uIDIgODAgKEEpIDA3ICAgIEhQRlMvTlRGUyBOVEZTICAgICAgICAgIDEwMSBNQiBvZmZzZXQgMjUxNzM4NTUNCjE5OjE5OjA3LjkwNiAgICBEaXNrIDAgQm9vdDogTlRGUyAgICAgY29kZT0xDQoxOToxOTowNy45MjQgICAgRGlzayAwIFBhcnRpdGlvbiAzIDAwICAgICAwNyAgICBIUEZTL05URlMgTlRGUyAgICAgICAxNDAyMzIgTUIgb2Zmc2V0IDI1MzgyNzAwDQoxOToxOTowOC4wNTQgICAgRGlzayAwIHNjYW5uaW5nIEM6XFdpbmRvd3Ncc3lzdGVtMzJcZHJpdmVycw0KMTk6MTk6MjUuMjU3ICAgIFNlcnZpY2Ugc2Nhbm5pbmcNCjE5OjIwOjA2LjE3NyAgICBNb2R1bGVzIHNjYW5uaW5nDQoxOToyMDowNi4xOTUgICAgRGlzayAwIHRyYWNlIC0gY2FsbGVkIG1vZHVsZXM6DQoxOToyMDowNi4yMzUgICAgbnRvc2tybmwuZXhlIENMQVNTUE5QLlNZUyBkaXNrLnN5cyBBQ1BJLnN5cyBhdGFwb3J0LlNZUyBQQ0lJREVYLlNZUyBoYWwuZGxsIG1zYWhjaS5zeXMgDQoxOToyMDowNi4yNDMgICAgMSBudCFJb2ZDYWxsRHJpdmVyIC0+IFxEZXZpY2VcSGFyZGRpc2swXERSMFsweGZmZmZmYTgwMDJmZDEwNjBdDQoxOToyMDowNi4yNTUgICAgMyBDTEFTU1BOUC5TWVNbZmZmZmY4ODAwMTZiNDQzZl0gLT4gbnQhSW9mQ2FsbERyaXZlciAtPiBbMHhmZmZmZmE4MDAzMDNiNDYwXQ0KMTk6MjA6MDYuMjY2ICAgIDUgQUNQSS5zeXNbZmZmZmY4ODAwMGYxMzc4MV0gLT4gbnQhSW9mQ2FsbERyaXZlciAtPiBcRGV2aWNlXElkZVxJZGVEZXZpY2VQMFQwTDAtMFsweGZmZmZmYTgwMDJmY2IwNjBdDQoxOToyMDowNi44MzMgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcV2luZG93cw0KMTk6MjA6MDkuNjU1ICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFdpbmRvd3Ncc3lzdGVtMzINCjE5OjIzOjU1LjkyMSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxXaW5kb3dzXHN5c3RlbTMyXGRyaXZlcnMNCjE5OjI0OjExLjc0OSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxVc2Vyc1xwYw0KMjA6MTI6MDQuMDExICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFByb2dyYW1EYXRhDQoyMDoxNjoyMy42MTEgICAgRGlzayAwIHN0YXRpc3RpY3MgNDYyMDI0MS8wLzAgQCAwLjc2IE1CL3MNCjIwOjE2OjIzLjY0OCAgICBTY2FuIGZpbmlzaGVkIHN1Y2Nlc3NmdWxseQ0KMjA6Mjc6NTQuMTk1ICAgIERpc2sgMCBNQlIgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxXaW5kb3dzXFN5c3RlbTMyXE1CUi5kYXQiDQoyMDoyNzo1NC4yMTkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcV2luZG93c1xTeXN0ZW0zMlxhc3dNQlIgTE9HYXByaWwudHh0Ig0KMjA6NDg6NTguNDE2ICAgIERpc2sgMCBNQlIgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxVc2Vyc1xwY1xEb2N1bWVudHNcTUJSLmRhdCINCjIwOjQ4OjU4LjQyOSAgICBUaGUgbG9nIGZpbGUgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxVc2Vyc1xwY1xEb2N1bWVudHNcYXN3TUJSLnR4dCINCjIwOjU5OjE4Ljc3OCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjA6NTk6MTguNzk1ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIxOjAwOjI1LjI0MCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjE6MDA6MjUuMjUxICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIxOjAyOjMxLjkxNCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjE6MDI6MzEuOTI5ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIzOjE0OjA0LjQyOCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXE1CUi5kYXQiDQoyMzoxNDowNC40MzkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXGFzd01CUi50eHQiDQoNDQo=" src="data:text/plain;base64,YXN3TUJSIHZlcnNpb24gMS4wLjEuMjI1MiBDb3B5cmlnaHQoYykgMjAxNCBBVkFTVCBTb2Z0d2FyZQ0KUnVuIGRhdGU6IDIwMTctMDQtMjkgMTk6MTU6MDMNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoxOToxNTowMy41OTMgICAgT1MgVmVyc2lvbjogV2luZG93cyB4NjQgNi4xLjc2MDAgDQoxOToxNTowMy41OTQgICAgTnVtYmVyIG9mIHByb2Nlc3NvcnM6IDEgNTg2IDB4N0MwMg0KMTk6MTU6MDMuNTk4ICAgIENvbXB1dGVyTmFtZTogTEFQVE9QICBVc2VyTmFtZTogcGMNCjE5OjE1OjA1LjA3NSAgICBJbml0aWFsaXplIHN1Y2Nlc3MNCjE5OjE1OjA1LjIyNSAgICBWTTogaW5pdGlhbGl6ZWQgc3VjY2Vzc2Z1bGx5DQoxOToxNTowNS4yMjkgICAgVk06IEFtZCBDUFUgdmlydHVhbGl6YXRpb24gbm90IHN1cHBvcnRlZCANCjE5OjE1OjEzLjUzMiAgICBBVkFTVCBlbmdpbmUgZGVmczogMTcwNDI5MDANCjE5OjE5OjA3LjY5MSAgICBEaXNrIDAgKGJvb3QpIFxEZXZpY2VcSGFyZGRpc2swXERSMCAtPiBcRGV2aWNlXElkZVxJZGVEZXZpY2VQMFQwTDAtMA0KMTk6MTk6MDcuNjk1ICAgIERpc2sgMCBWZW5kb3I6IEhpdGFjaGlfSFRTNTQ1MDE2QjlBMzAwIFBCQk9DNjBGIFNpemU6IDE1MjYyN01CIEJ1c1R5cGU6IDExDQoxOToxOTowNy44NTUgICAgRGlzayAwIE1CUiByZWFkIHN1Y2Nlc3NmdWxseQ0KMTk6MTk6MDcuODU5ICAgIERpc2sgMCBNQlIgc2Nhbg0KMTk6MTk6MDcuODY2ICAgIERpc2sgMCBXaW5kb3dzIDcgZGVmYXVsdCBNQlIgY29kZQ0KMTk6MTk6MDcuODcxICAgIERpc2sgMCBQYXJ0aXRpb24gMSAwMCAgICAgMjcgSGlkZGVuIE5URlMgV2luUkUgTlRGUyAgICAgICAgMTIyOTEgTUIgb2Zmc2V0IDYzDQoxOToxOTowNy44OTUgICAgRGlzayAwIFBhcnRpdGlvbiAyIDgwIChBKSAwNyAgICBIUEZTL05URlMgTlRGUyAgICAgICAgICAxMDEgTUIgb2Zmc2V0IDI1MTczODU1DQoxOToxOTowNy45MDYgICAgRGlzayAwIEJvb3Q6IE5URlMgICAgIGNvZGU9MQ0KMTk6MTk6MDcuOTI0ICAgIERpc2sgMCBQYXJ0aXRpb24gMyAwMCAgICAgMDcgICAgSFBGUy9OVEZTIE5URlMgICAgICAgMTQwMjMyIE1CIG9mZnNldCAyNTM4MjcwMA0KMTk6MTk6MDguMDU0ICAgIERpc2sgMCBzY2FubmluZyBDOlxXaW5kb3dzXHN5c3RlbTMyXGRyaXZlcnMNCjE5OjE5OjI1LjI1NyAgICBTZXJ2aWNlIHNjYW5uaW5nDQoxOToyMDowNi4xNzcgICAgTW9kdWxlcyBzY2FubmluZw0KMTk6MjA6MDYuMTk1ICAgIERpc2sgMCB0cmFjZSAtIGNhbGxlZCBtb2R1bGVzOg0KMTk6MjA6MDYuMjM1ICAgIG50b3Nrcm5sLmV4ZSBDTEFTU1BOUC5TWVMgZGlzay5zeXMgQUNQSS5zeXMgYXRhcG9ydC5TWVMgUENJSURFWC5TWVMgaGFsLmRsbCBtc2FoY2kuc3lzIA0KMTk6MjA6MDYuMjQzICAgIDEgbnQhSW9mQ2FsbERyaXZlciAtPiBcRGV2aWNlXEhhcmRkaXNrMFxEUjBbMHhmZmZmZmE4MDAyZmQxMDYwXQ0KMTk6MjA6MDYuMjU1ICAgIDMgQ0xBU1NQTlAuU1lTW2ZmZmZmODgwMDE2YjQ0M2ZdIC0+IG50IUlvZkNhbGxEcml2ZXIgLT4gWzB4ZmZmZmZhODAwMzAzYjQ2MF0NCjE5OjIwOjA2LjI2NiAgICA1IEFDUEkuc3lzW2ZmZmZmODgwMDBmMTM3ODFdIC0+IG50IUlvZkNhbGxEcml2ZXIgLT4gXERldmljZVxJZGVcSWRlRGV2aWNlUDBUMEwwLTBbMHhmZmZmZmE4MDAyZmNiMDYwXQ0KMTk6MjA6MDYuODMzICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFdpbmRvd3MNCjE5OjIwOjA5LjY1NSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxXaW5kb3dzXHN5c3RlbTMyDQoxOToyMzo1NS45MjEgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcV2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzDQoxOToyNDoxMS43NDkgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcVXNlcnNccGMNCjIwOjEyOjA0LjAxMSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxQcm9ncmFtRGF0YQ0KMjA6MTY6MjMuNjExICAgIERpc2sgMCBzdGF0aXN0aWNzIDQ2MjAyNDEvMC8wIEAgMC43NiBNQi9zDQoyMDoxNjoyMy42NDggICAgU2NhbiBmaW5pc2hlZCBzdWNjZXNzZnVsbHkNCjIwOjI3OjU0LjE5NSAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcV2luZG93c1xTeXN0ZW0zMlxNQlIuZGF0Ig0KMjA6Mjc6NTQuMjE5ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFdpbmRvd3NcU3lzdGVtMzJcYXN3TUJSIExPR2FwcmlsLnR4dCINCjIwOjQ4OjU4LjQxNiAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXE1CUi5kYXQiDQoyMDo0ODo1OC40MjkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXGFzd01CUi50eHQiDQoNDQphc3dNQlIgdmVyc2lvbiAxLjAuMS4yMjUyIENvcHlyaWdodChjKSAyMDE0IEFWQVNUIFNvZnR3YXJlDQpSdW4gZGF0ZTogMjAxNy0wNC0yOSAxOToxNTowMw0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCjE5OjE1OjAzLjU5MyAgICBPUyBWZXJzaW9uOiBXaW5kb3dzIHg2NCA2LjEuNzYwMCANCjE5OjE1OjAzLjU5NCAgICBOdW1iZXIgb2YgcHJvY2Vzc29yczogMSA1ODYgMHg3QzAyDQoxOToxNTowMy41OTggICAgQ29tcHV0ZXJOYW1lOiBMQVBUT1AgIFVzZXJOYW1lOiBwYw0KMTk6MTU6MDUuMDc1ICAgIEluaXRpYWxpemUgc3VjY2Vzcw0KMTk6MTU6MDUuMjI1ICAgIFZNOiBpbml0aWFsaXplZCBzdWNjZXNzZnVsbHkNCjE5OjE1OjA1LjIyOSAgICBWTTogQW1kIENQVSB2aXJ0dWFsaXphdGlvbiBub3Qgc3VwcG9ydGVkIA0KMTk6MTU6MTMuNTMyICAgIEFWQVNUIGVuZ2luZSBkZWZzOiAxNzA0MjkwMA0KMTk6MTk6MDcuNjkxICAgIERpc2sgMCAoYm9vdCkgXERldmljZVxIYXJkZGlzazBcRFIwIC0+IFxEZXZpY2VcSWRlXElkZURldmljZVAwVDBMMC0wDQoxOToxOTowNy42OTUgICAgRGlzayAwIFZlbmRvcjogSGl0YWNoaV9IVFM1NDUwMTZCOUEzMDAgUEJCT0M2MEYgU2l6ZTogMTUyNjI3TUIgQnVzVHlwZTogMTENCjE5OjE5OjA3Ljg1NSAgICBEaXNrIDAgTUJSIHJlYWQgc3VjY2Vzc2Z1bGx5DQoxOToxOTowNy44NTkgICAgRGlzayAwIE1CUiBzY2FuDQoxOToxOTowNy44NjYgICAgRGlzayAwIFdpbmRvd3MgNyBkZWZhdWx0IE1CUiBjb2RlDQoxOToxOTowNy44NzEgICAgRGlzayAwIFBhcnRpdGlvbiAxIDAwICAgICAyNyBIaWRkZW4gTlRGUyBXaW5SRSBOVEZTICAgICAgICAxMjI5MSBNQiBvZmZzZXQgNjMNCjE5OjE5OjA3Ljg5NSAgICBEaXNrIDAgUGFydGl0aW9uIDIgODAgKEEpIDA3ICAgIEhQRlMvTlRGUyBOVEZTICAgICAgICAgIDEwMSBNQiBvZmZzZXQgMjUxNzM4NTUNCjE5OjE5OjA3LjkwNiAgICBEaXNrIDAgQm9vdDogTlRGUyAgICAgY29kZT0xDQoxOToxOTowNy45MjQgICAgRGlzayAwIFBhcnRpdGlvbiAzIDAwICAgICAwNyAgICBIUEZTL05URlMgTlRGUyAgICAgICAxNDAyMzIgTUIgb2Zmc2V0IDI1MzgyNzAwDQoxOToxOTowOC4wNTQgICAgRGlzayAwIHNjYW5uaW5nIEM6XFdpbmRvd3Ncc3lzdGVtMzJcZHJpdmVycw0KMTk6MTk6MjUuMjU3ICAgIFNlcnZpY2Ugc2Nhbm5pbmcNCjE5OjIwOjA2LjE3NyAgICBNb2R1bGVzIHNjYW5uaW5nDQoxOToyMDowNi4xOTUgICAgRGlzayAwIHRyYWNlIC0gY2FsbGVkIG1vZHVsZXM6DQoxOToyMDowNi4yMzUgICAgbnRvc2tybmwuZXhlIENMQVNTUE5QLlNZUyBkaXNrLnN5cyBBQ1BJLnN5cyBhdGFwb3J0LlNZUyBQQ0lJREVYLlNZUyBoYWwuZGxsIG1zYWhjaS5zeXMgDQoxOToyMDowNi4yNDMgICAgMSBudCFJb2ZDYWxsRHJpdmVyIC0+IFxEZXZpY2VcSGFyZGRpc2swXERSMFsweGZmZmZmYTgwMDJmZDEwNjBdDQoxOToyMDowNi4yNTUgICAgMyBDTEFTU1BOUC5TWVNbZmZmZmY4ODAwMTZiNDQzZl0gLT4gbnQhSW9mQ2FsbERyaXZlciAtPiBbMHhmZmZmZmE4MDAzMDNiNDYwXQ0KMTk6MjA6MDYuMjY2ICAgIDUgQUNQSS5zeXNbZmZmZmY4ODAwMGYxMzc4MV0gLT4gbnQhSW9mQ2FsbERyaXZlciAtPiBcRGV2aWNlXElkZVxJZGVEZXZpY2VQMFQwTDAtMFsweGZmZmZmYTgwMDJmY2IwNjBdDQoxOToyMDowNi44MzMgICAgQVZBU1QgZW5naW5lIHNjYW4gQzpcV2luZG93cw0KMTk6MjA6MDkuNjU1ICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFdpbmRvd3Ncc3lzdGVtMzINCjE5OjIzOjU1LjkyMSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxXaW5kb3dzXHN5c3RlbTMyXGRyaXZlcnMNCjE5OjI0OjExLjc0OSAgICBBVkFTVCBlbmdpbmUgc2NhbiBDOlxVc2Vyc1xwYw0KMjA6MTI6MDQuMDExICAgIEFWQVNUIGVuZ2luZSBzY2FuIEM6XFByb2dyYW1EYXRhDQoyMDoxNjoyMy42MTEgICAgRGlzayAwIHN0YXRpc3RpY3MgNDYyMDI0MS8wLzAgQCAwLjc2IE1CL3MNCjIwOjE2OjIzLjY0OCAgICBTY2FuIGZpbmlzaGVkIHN1Y2Nlc3NmdWxseQ0KMjA6Mjc6NTQuMTk1ICAgIERpc2sgMCBNQlIgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxXaW5kb3dzXFN5c3RlbTMyXE1CUi5kYXQiDQoyMDoyNzo1NC4yMTkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcV2luZG93c1xTeXN0ZW0zMlxhc3dNQlIgTE9HYXByaWwudHh0Ig0KMjA6NDg6NTguNDE2ICAgIERpc2sgMCBNQlIgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxVc2Vyc1xwY1xEb2N1bWVudHNcTUJSLmRhdCINCjIwOjQ4OjU4LjQyOSAgICBUaGUgbG9nIGZpbGUgaGFzIGJlZW4gc2F2ZWQgc3VjY2Vzc2Z1bGx5IHRvICJDOlxVc2Vyc1xwY1xEb2N1bWVudHNcYXN3TUJSLnR4dCINCjIwOjU5OjE4Ljc3OCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjA6NTk6MTguNzk1ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIxOjAwOjI1LjI0MCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjE6MDA6MjUuMjUxICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIxOjAyOjMxLjkxNCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRGVza3RvcFxNQlIuZGF0Ig0KMjE6MDI6MzEuOTI5ICAgIFRoZSBsb2cgZmlsZSBoYXMgYmVlbiBzYXZlZCBzdWNjZXNzZnVsbHkgdG8gIkM6XFVzZXJzXHBjXERlc2t0b3BcYXN3TUJSLnR4dCINCjIzOjE0OjA0LjQyOCAgICBEaXNrIDAgTUJSIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXE1CUi5kYXQiDQoyMzoxNDowNC40MzkgICAgVGhlIGxvZyBmaWxlIGhhcyBiZWVuIHNhdmVkIHN1Y2Nlc3NmdWxseSB0byAiQzpcVXNlcnNccGNcRG9jdW1lbnRzXGFzd01CUi50eHQiDQoNDQo=" alt="">

Post #5

:welcome:

 

Remember you, been awhile, welcome back.  What you posted wont work, lets give it another try

 

 
[external image: 1QYkxTZ.jpg] Please download aswMBR to your DESKTOP <<<<<
 
  •  
  • Right click the aswMBR icon and select Run as Administrator
  • XP users just Double Click it to run
  • If it says that this computer supports VIRTUALIZATION TECHNOLOGY do you want to use it say Yes
  • Click the Scan button to start scan.
  • Select Quickscan on the dropdown list
  • If you are asked to update the Avast Virus database please allow it to do so.
  • The scan could take 20 minutes or more , please be patient and let it finish
  • It will say Scan Finished when its done.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
 
 
I just want to see the report….Please Do Not Fix Anything
 
============================================================================
 
 
Please download Farbar Recovery Scan Tool and save it to your DESKTOP<<<<<<
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 
How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system
A simple way to check your system: Start –> Computer (right click) –> Properties
 
[external image: FRST_zps5d956a1a.jpg]
 
 
  •  
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Just keep the defaults as in the picture checkmarked
  • Press Scan button.
  • It will produce a log called FRST.txt in the same directory the tool is run from.
  • Please copy and paste log back here.
  • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
 
Post #6

Hi, sorry for the mess up.  I have both the completed logs on the desktop but cannot transfer them to make a reply.  When I make a reply here on the forum it gives me an error message saying that that is too large of a file to accept.  When I cut and paste, it comes out just as it did above.

Post #8 last edited

📎Addition.txt

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-04-2017
Ran by [removed] (29-04-2017 22:04:12)
Running from C:\Users\[removed]\Downloads
Windows 7 Home Premium (X64) (2010-01-31 22:00:41)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2495495804-1520031139-3188645834-500 - Administrator - Disabled)
Guest (S-1-5-21-2495495804-1520031139-3188645834-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2495495804-1520031139-3188645834-1008 - Limited - Enabled)
pc (S-1-5-21-2495495804-1520031139-3188645834-1000 - Administrator - Enabled) => C:\Users\pc
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Acer Arcade Deluxe (HKLM-x32\…\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7029 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7029 - CyberLink Corp.) Hidden
Acer Assist (HKLM-x32\…\Acer Assist) (Version:  - Acer Incorporated)
Acer ePower Management (HKLM-x32\…\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3006 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3006 - Acer Incorporated)
Acer Games (HKLM-x32\…\WildTangent acer Master Uninstall) (Version: 1.0.0.80 - WildTangent)
Acer GridVista (HKLM-x32\…\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\…\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\…\Acer Screensaver) (Version: 1.02.0804 - Acer Incorporated)
Acer Updater (HKLM-x32\…\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Acer Incorporated)
Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 21 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 21.0.0.213 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.18) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.18 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\…\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: Version 7.102.2002.208 - Alps Electric)
Amazon Music (HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\…\Amazon Amazon Music) (Version: 4.3.2.1367 - Amazon Services LLC)
Apple Application Support (HKLM-x32\…\{B2D328BE-45AD-4D92-96F9-2151490A203E}) (Version: 1.3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{328CC232-CFDC-468B-A214-2E21300E4CB5}) (Version: 3.1.0.62 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{C41300B9-185D-475E-BFEC-39EF732F19B1}) (Version: 2.1.2.120 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\…\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
ATI Catalyst Install Manager (HKLM\…\{ACCA82EB-7088-919E-5E1C-100A24F11CCF}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
Avast Free Antivirus (HKLM-x32\…\avast) (Version: 12.1.2272 - AVAST Software)
BeTrapped! (HKLM-x32\…\BeTrapped!) (Version:   - MumboJumbo, LLC)
Bonjour (HKLM\…\{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}) (Version: 2.0.2.0 - Apple Inc.)
Byki (x32 Version: 4.0 - Transparent Language, Inc.) Hidden
Byki Express (HKLM-x32\…\Byki Express) (Version:  - Transparent Language, Inc.)
ccc-core-static (x32 Version: 2009.0729.2227.38498 - ATI) Hidden
CCleaner (HKLM-x32\…\CCleaner) (Version: 2.29 - Piriform)
CLUE Classic (HKLM-x32\…\CLUE Classic) (Version: 1.0.0.0 - RealArcade)
CSE HTML Validator (HKLM-x32\…\CSE HTML Validator) (Version:  - )
Diner Dash (x32 Version: 2.2.0.82 - WildTangent) Hidden
DVDFab 6.0.6.0 (04/09/2009) (HKLM-x32\…\DVDFab 6_is1) (Version:  - Fengtao Software Inc.)
eSobi v2 (HKLM-x32\…\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Google Earth (HKLM-x32\…\{08C0729E-3E50-11DF-9D81-005056806466}) (Version: 5.2.0.5920 - Google)
Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImgBurn (HKLM-x32\…\ImgBurn) (Version: 2.5.5.0 - LIGHTNING UK!)
Inspector Parker (HKLM-x32\…\Inspector Parker) (Version:   - MumboJumbo, LLC)
Internet TV for Windows Media Center (HKLM-x32\…\{9D318C86-AF4C-409F-A6AC-7183FF4CF424}) (Version: 3.2.1.0 - Microsoft Corporation)
iPod for Windows 2006-03-23 (HKLM-x32\…\InstallShield_{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}) (Version: 4.7.0 - Apple Computer, Inc.)
iPod for Windows 2006-03-23 (x32 Version: 4.7.0 - Apple Computer, Inc.) Hidden
iTunes (HKLM\…\{53529DAD-F7C9-476E-87CC-1547C4E3E821}) (Version: 9.2.0.61 - Apple Inc.)
Java(TM) 6 Update 35 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83216035F0}) (Version: 6.0.350 - Oracle)
Java(TM) 6 Update 38 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83216038FF}) (Version: 6.0.380 - Oracle)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\…\LManager) (Version: 3.0.03 - Acer Inc.)
LimeWire 5.6.2 (remove only) (HKLM-x32\…\LimeWire) (Version: 5.5.10 - Lime Wire, LLC)
LimeWire version LimeStart_Shortcuts_1.1 (HKLM-x32\…\LimeWire_is1) (Version: LimeStart_Shortcuts_1.1 - LOTR, Inc. LOL)
Lost Cases Sherlock (HKLM-x32\…\Lost Cases Sherlock) (Version:  - )
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft FrontPage 2000 (HKLM-x32\…\{00120409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 2 (SP2) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version:  - Microsoft)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Works (HKLM-x32\…\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 51.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 51.0.1 (x86 en-US)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 51.0.1.6234 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (HKLM-x32\…\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
NTI Backup Now 5 (HKLM-x32\…\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\…\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
Octoshape Streaming Services (HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\…\Octoshape Streaming Services) (Version:  - )
Paint.NET v3.5.10 (HKLM\…\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
QuickTime (HKLM-x32\…\{3D9892BB-A751-4E48-ADC8-E4289956CE1D}) (Version: 7.66.73.0 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\…\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30095 - Realtek Semiconductor Corp.)
Snagit 9.1.2 (HKLM-x32\…\{B440D659-FECA-4BDD-A12B-5C9F05790FF3}) (Version: 9.1.2.304 - TechSmith Corporation)
TouchCopy 09 (HKLM-x32\…\{08760061-E666-4903-BEBB-5227FC91B82C}) (Version: 9.61 - Wide Angle Software)
Unlocker 1.8.7 (HKLM-x32\…\Unlocker) (Version: 1.8.7 - Cedrick Collomb)
Update for 2007 Microsoft Office System (KB2284654) (HKLM-x32\…\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{FB166E7C-8AA6-48C8-B726-1F25BEE7825A}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Welcome Center (HKLM-x32\…\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sign-in Assistant (HKLM-x32\…\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Upload Tool (HKLM-x32\…\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Center Add-in for Flash (HKLM-x32\…\{E2D09AC2-4153-4817-AAEB-24F92A8BCE88}) (Version: 3.1.1.0 - Microsoft Corporation)
WinRAR 4.20 (64-bit) (HKLM\…\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WireShare (HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\…\WireShare) (Version: 5.6.4.3 - WireShare)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {193D34A7-BF1D-4917-B556-16F53C34BEE9} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2016-07-12] (AVAST Software)
Task: {1DFCEE9A-4EB2-46A1-B7D0-F9B4C5CC096A} - System32\Tasks\{6428514F-7B80-40B9-9CF3-280EAC958338} => C:\Program Files (x86)\WireShare\WireShare.exe [2015-08-01] (WireShare)
Task: {20FF5B19-AAF2-45B6-BAEE-3842C6D40984} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2495495804-1520031139-3188645834-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe 
Task: {3565F34A-4AF8-4CF8-A5C1-449F1D8295AF} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-04-17] (AVAST Software)
Task: {4CB999F2-D10A-4C85-ABEF-7F8320C01AA3} - System32\Tasks\{CDFD5791-8A81-479E-BAA8-05656BE5B2B4} => C:\Program Files (x86)\WireShare\WireShare.exe [2015-08-01] (WireShare)
Task: {7221C269-0FD0-4F06-BBFE-AAFF59B088E1} - System32\Tasks\{3E32F53E-BBBF-4650-B66D-FC0209100A38} => C:\Users\pc\Desktop\AVI-Mux_GUI-1.17.8\AVIMux_GUI.exe 
Task: {A697CEC6-9DBC-4684-81AC-AB8B10F9139C} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2495495804-1520031139-3188645834-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe 
Task: {C706BE9A-D02E-41F3-8D39-C45DDA21D074} - System32\Tasks\{724E4938-606F-4422-AA61-D125BAC5F26F} => pcalua.exe -a D:\IP_Setup.exe -d D:\
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
Shortcut: C:\Users\pc\AppData\Roaming\Microsoft\Windows\Network Shortcuts\17am.com - Shortcut.lnk -> hxxp://17am.co
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-08-22 18:06 - 2016-06-16 12:05 - 05908968 _____ () C:\Users\pc\AppData\Local\Amazon Music\Amazon Music Helper.exe
2008-05-01 20:15 - 2008-05-01 20:15 - 00015872 _____ () C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe
2009-07-07 14:09 - 2009-07-07 14:09 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-12-19 12:15 - 2009-12-19 12:15 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2016-07-12 10:44 - 2016-07-12 10:44 - 00146232 _____ () C:\Program Files\Alwil Software\Avast5\JsonRpcServer.dll
2016-07-12 10:44 - 2016-07-12 10:44 - 00479288 _____ () C:\Program Files\Alwil Software\Avast5\ffl2.dll
2017-04-29 18:21 - 2017-04-29 18:21 - 06026480 _____ () C:\Program Files\Alwil Software\Avast5\defs\17042900\algo.dll
2008-05-01 20:15 - 2008-05-01 20:15 - 00004608 _____ () C:\Program Files (x86)\Unlocker\UnlockerHook.dll
2010-06-03 13:46 - 2010-06-03 13:46 - 00067872 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-07-12 10:46 - 2016-07-12 10:47 - 48936448 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll
2009-02-14 05:04 - 2009-02-14 05:04 - 00756040 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\Users\pc\Documents\SERIFPARTS1.wpp:SummaryInformation [221]
AlternateDataStreams: C:\Users\pc\Documents\SERIFPARTS1.wpp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 18:34 - 2009-06-10 13:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\pc\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: PlayMovie => "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
MSCONFIG\startupreg: Quizulous Plugin => rundll32 C:\PROGRA~2\QUIZUL~1\toolbar\1.bin\q2Plugin.dll,UPF
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{45A752D5-048F-477A-B6EC-F41263BE0D3B}] => (Allow) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{879E36C3-463E-40AD-9356-77B408FB12C3}] => (Allow) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{EB773B7C-1A11-42B4-B4B4-2C2836D3528C}] => (Allow) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{53A7965E-EFA1-4F22-8B95-79C7BCA6693F}] => (Allow) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{4DE9BFE6-CAED-4CF9-A38D-DE505E3723D9}] => (Allow) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe
FirewallRules: [{8B38E37C-FD19-4A5A-AD1C-B972A27D5052}] => (Allow) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe
FirewallRules: [{817CEEC7-F67E-4817-AAF4-1988EE75226C}] => (Allow) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
FirewallRules: [{A10DBA45-9477-4DEE-A5DD-AE98B5DBB118}] => (Allow) C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe
FirewallRules: [{D1DD3CF0-91D5-452E-AF6A-CAC3FA7D0633}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\wlcsdk.exe
FirewallRules: [{0CCC9529-6AE6-4E65-A8F0-8F922EC249E7}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{4C4A6DC8-5346-4380-B1BA-99854DC086BD}] => (Allow) svchost.exe
FirewallRules: [{584B25F3-F6FD-4FAC-8836-F97E387A94D2}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [TCP Query User{F755686A-3C09-4002-AF3A-8F0A162794CC}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{039DBD33-E38E-4260-95D4-8051D42ABF02}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{DAC6376F-1496-418A-A7EE-5438478D8F73}C:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.321\english\setup.exe] => (Block) C:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.321\english\setup.exe
FirewallRules: [UDP Query User{76E656E2-9FFF-4CBC-9F68-5F1D2829BB88}C:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.321\english\setup.exe] => (Block) C:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.321\english\setup.exe
FirewallRules: [{0F500B7D-A9F4-4600-BC76-04D31B661B5B}] => (Allow) C:\Program Files (x86)\LimeWire\LimeWire.exe
FirewallRules: [{F6C4742A-4474-4198-BB59-092CD773F585}] => (Allow) C:\Program Files (x86)\LimeWire\LimeWire.exe
FirewallRules: [TCP Query User{EA34A7B0-5EFE-4403-8B41-C65B921BE5FE}C:\program files (x86)\itunes\itunes.exe] => (Block) C:\program files (x86)\itunes\itunes.exe
FirewallRules: [UDP Query User{F469005E-BBC5-451F-8874-1D33682C3AEE}C:\program files (x86)\itunes\itunes.exe] => (Block) C:\program files (x86)\itunes\itunes.exe
FirewallRules: [{8A4905B2-699B-45F3-B608-4C0D8F6803DA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2AAF4EFF-39D3-4E7E-A014-CEEF2F76C1B8}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{37775F71-C845-4B38-A2AD-E8D118B07561}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{8AE58216-1B06-42B0-BCA1-AECD6240ACD3}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [TCP Query User{9326FC82-D969-4882-9B37-78D9AD09CDE3}C:\program files (x86)\limewire\limewire.exe] => (Block) C:\program files (x86)\limewire\limewire.exe
FirewallRules: [UDP Query User{521D5890-54A3-4B80-A958-D3CE020410DD}C:\program files (x86)\limewire\limewire.exe] => (Block) C:\program files (x86)\limewire\limewire.exe
FirewallRules: [TCP Query User{64B20703-0434-452B-BA04-0BC617D022A4}C:\users\pc\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Block) C:\users\pc\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
FirewallRules: [UDP Query User{C4E09E56-51F1-4215-B1ED-C0B046D1B647}C:\users\pc\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Block) C:\users\pc\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
FirewallRules: [TCP Query User{70B20EFA-308A-45C8-A2AF-341F69934863}E:\aluratek.exe] => (Allow) E:\aluratek.exe
FirewallRules: [UDP Query User{EED4D4EC-8BDC-4248-AAE6-F1ADA2F604B9}E:\aluratek.exe] => (Allow) E:\aluratek.exe
FirewallRules: [TCP Query User{2B04BDB0-E28F-4F15-A768-C2B831E79EB8}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{D3CC0AB5-5363-4DEC-875B-00B5CACF5E32}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{C7D64025-CC8A-4E9A-8C79-A9F07943C961}C:\program files (x86)\real\realplayer\realplay.exe] => (Block) C:\program files (x86)\real\realplayer\realplay.exe
FirewallRules: [UDP Query User{14BE35DA-8218-4B7F-9B26-8489A3017B5C}C:\program files (x86)\real\realplayer\realplay.exe] => (Block) C:\program files (x86)\real\realplayer\realplay.exe
FirewallRules: [{984D95AA-A2C8-44A3-9E16-B378F6D94828}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7D4B57A9-7C63-49CD-8AA4-90D42D1328C9}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{6B8A8F78-3313-4E6E-A80E-EA9F96B41F28}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{43D63CF6-E27F-4698-A217-6D487041D227}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{E45FA607-1F2F-484A-9F91-E70215A23EEE}C:\program files (x86)\wireshare\wireshare.exe] => (Allow) C:\program files (x86)\wireshare\wireshare.exe
FirewallRules: [UDP Query User{168CBB4C-26E3-429C-A60C-F32891E1FD89}C:\program files (x86)\wireshare\wireshare.exe] => (Allow) C:\program files (x86)\wireshare\wireshare.exe
FirewallRules: [{273DD17F-01BC-4F0D-A679-CA24ED41AD2A}] => (Allow) C:\Program Files (x86)\WireShare\WireShare.exe
FirewallRules: [{6750DC9F-7AAE-484D-89B3-416268FB7986}] => (Allow) C:\Program Files (x86)\WireShare\WireShare.exe
FirewallRules: [{507B173F-8046-4BD9-BAFC-4F02FF4D259E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{667AAC52-66B4-47AF-8CD9-F8A7396CAE89}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
==================== Restore Points =========================
 
09-11-2016 18:24:01 Windows Update
04-01-2017 19:22:38 Scheduled Checkpoint
16-01-2017 17:31:58 Windows Update
23-01-2017 16:53:27 Windows Update
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (04/29/2017 06:19:42 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)
Description: Product: Adobe Refresh Manager – Error 1606.Could not access network location %APPDATA%\.
 
Error: (04/29/2017 06:19:42 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)
Description: Product: Adobe Refresh Manager – Error 1606.Could not access network location %APPDATA%\.
 
Error: (04/28/2017 04:19:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 17753
 
Error: (04/28/2017 04:19:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 17753
 
Error: (04/28/2017 04:19:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (04/28/2017 04:19:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 16411
 
Error: (04/28/2017 04:19:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 16411
 
Error: (04/28/2017 04:19:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (04/28/2017 04:19:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 14913
 
Error: (04/28/2017 04:19:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 14913
 
 
System errors:
=============
Error: (04/29/2017 06:20:01 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Update service hung on starting.
 
Error: (04/29/2017 06:14:13 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
 
Error: (04/29/2017 06:14:13 PM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter
 
Error: (04/29/2017 06:14:16 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 6:11:31 PM on ‎4/‎29/‎2017 was unexpected.
 
Error: (04/29/2017 06:11:35 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
 
Error: (04/29/2017 06:11:31 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
 
Error: (04/28/2017 04:18:44 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
 
Error: (04/27/2017 04:15:25 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
 
Error: (04/27/2017 04:15:22 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
 
Error: (04/27/2017 09:57:09 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
 
 
CodeIntegrity:
===================================
  Date: 2017-04-29 18:14:03.760
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-04-29 18:14:03.510
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-01-30 15:52:40.626
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-01-30 15:52:40.251
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-01-21 19:34:49.009
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-01-21 19:34:48.760
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-01-06 23:51:53.938
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-01-06 23:51:53.641
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-12-22 19:52:31.997
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-12-22 19:52:31.778
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: AMD Athlon™ Processor TF-36
Percentage of memory in use: 70%
Total physical RAM: 2812.05 MB
Available physical RAM: 830.99 MB
Total Virtual: 5622.24 MB
Available Virtual: 3071.67 MB
 
==================== Drives ================================
 
Drive c: (Acer) (Fixed) (Total:136.95 GB) (Free:10.93 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: F7C2CF51)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=102 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=136.9 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
Post #9

can result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-04-2017
Ran by [removed] (administrator) on LAPTOP (29-04-2017 22:03:09)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 7 Home Premium (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Octoshape ApS) C:\Users\pc\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
() C:\Users\pc\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
() C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\avastui.exe
(Apple Inc.) C:\Program Files (x86)\iPod\bin\iPodService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(AVAST Software) C:\Users\pc\Downloads\aswMBR(1).exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\…\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [822816 2009-10-29] (Acer Incorporated)
HKLM\…\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)
HKLM\…\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [301056 2009-06-11] (Alps Electric Co., Ltd.)
HKLM-x32\…\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1157128 2009-08-18] (Dritek System Inc.)
HKLM-x32\…\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-03] (Egis Technology Inc.)
HKLM-x32\…\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-29] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [Acer Assist Launcher] => C:\Program Files (x86)\Acer\Acer Assist\launcher.exe [1261568 2007-11-19] ()
HKLM-x32\…\Run: [UnlockerAssistant] => C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe [15872 2008-05-01] ()
HKLM-x32\…\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-03-18] (Apple Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [141624 2010-06-15] (Apple Inc.)
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [8900328 2016-08-13] (AVAST Software)
HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1156824 2016-10-01] (Adobe Systems Incorporated)
HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\…\Run: [Octoshape Streaming Services] => C:\Users\pc\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [70936 2009-01-08] (Octoshape ApS)
HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\…\Run: [Amazon Music] => C:\Users\pc\AppData\Local\Amazon Music\Amazon Music Helper.exe [5908968 2016-06-16] ()
HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\…\MountPoints2: {5055e814-cbc9-11e2-8499-705ab6067265} - E:\Aluratek.exe http://www.iradiopop.com/IRD/pages/register.do?fx=visit
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll [2016-07-12] (AVAST Software)
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-10] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-10] (Egis Technology Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2013-08-08]
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Users\pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2010-02-03]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WireShare On Startup.lnk [2015-08-15]
ShortcutTarget: WireShare On Startup.lnk -> C:\Program Files (x86)\WireShare\WireShare.exe (WireShare)
GroupPolicy\User: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [HKLM] => Proxy is enabled.
ProxyServer: [HKLM] => http=127.0.0.1:8118
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{D2E0846C-020C-4283-985E-EE08AFC52E76}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360110d545l03h4z155t4972x232
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360110d545l03h4z155t4972x232
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360110d545l03h4z155t4972x232
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360110d545l03h4z155t4972x232
HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2495495804-1520031139-3188645834-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360110d545l03h4z155t4972x232
URLSearchHook: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> Default = {CFBFAE00-17A6-11D0-99CB-00C04FD64497}
SearchScopes: HKLM-x32 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 -> {110a9ea2-8810-4c04-b916-cfd4e9427fec} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZXxdm003YYus&ptnrS=ZXxdm003YYus&si=CNzwoMjerLECFYUaQgodJQYA5A&ptb=E674A617-8ABD-412A-B06F-2A9997CF458E&ind=2012072203&n=77edc90b&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> DefaultScope {026428F7-C431-4EB2-BF15-DC177A043CA8} URL = hxxp://ixquick.com/do/metasearch.pl?query={searchTerms}&cat=web&pl=ie&language=english
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {026428F7-C431-4EB2-BF15-DC177A043CA8} URL = hxxp://ixquick.com/do/metasearch.pl?query={searchTerms}&cat=web&pl=ie&language=english
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {0FC38162-DA26-4046-9D1C-3038E2E241B7} URL = hxxp://search.lycos.com/?query={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {110a9ea2-8810-4c04-b916-cfd4e9427fec} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZXxdm003YYus&ptnrS=ZXxdm003YYus&si=CNzwoMjerLECFYUaQgodJQYA5A&ptb=E674A617-8ABD-412A-B06F-2A9997CF458E&ind=2012072203&n=77edc90b&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {163112E6-5F27-4ECC-AB41-6C3F46944477} URL = hxxp://www.ask.com/web?q={searchTerms}&search=search&qsrc=0&o=0&l=dir
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {2E52056C-DA92-4CC1-A9B5-06282AE37E53} URL = hxxp://www.pricestalker.net/ProductSearch.aspx?keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {3567C09C-A7CA-4CCC-A9BA-C6E640199B47} URL = hxxp://search.aol.com/aol/search?invocationType=searchbox.webhome&query={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://blekkosearch.mystart.com/blekkotb_soc/?source=86adbc52&tbp=rbox&toolbarid=blekkotb_soc&u=20120512BFF44932BC92464545134F9F&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {4AB4E0B0-B3A0-40E4-B924-9851B28FAD50} URL = hxxp://www.findname.cn/{searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {4AEF97AB-A338-462E-BE92-9A906ED0803E} URL = hxxp://www.timeanddate.com/worldclock/results.html?query={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {64583D3B-11FE-43E9-85FC-CF0E3E9C8196} URL = hxxp://www.truveo.com/search.php?query={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {787E9173-5E88-4122-81C9-2F9B74133F61} URL = hxxp://en.wikipedia.org/w/index.php?title=Special:Search&search={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {852DDB08-EEA5-4647-BC8A-AEBD18F8D10B} URL = hxxp://2song.net/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {91AE02BA-5ED5-44A9-BB8D-84888AA15160} URL = hxxp://search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20101045,6901,0,8,0
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {9D24ACC9-6138-4C04-9335-43B94BA5ACE6} URL = hxxp://www.alltheweb.com/search?cat=web&cs=utf8&q={searchTerms}&rys=0&itag=crv&_sb_lang=pref
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {A5B39CBF-0C87-4C73-97A5-307543B96AE8} URL = hxxp://searchou.com/?q={searchTerms}&id=60e96c59000000000000701a04b42683&affilt=5&r=411
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {C9CDEE60-BD65-4109-BB37-C58CE3731524} URL = hxxp://www.scrubtheweb.com/cgi-bin/search.cgi?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> {EFFCEEA9-C2B9-4859-AAB2-F3FDCC0757D8} URL = hxxp://buzztap.com/BuzzManager?action=Search&search={searchTerms}
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\Snagit 9\DLLx64\SnagitBHO64.dll [2009-04-17] (TechSmith Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2016-07-12] (AVAST Software)
BHO-x32: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll [2009-04-17] (TechSmith Corporation)
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: No Name -> {2CEBF6C7-2B40-469B-B5D5-CD3F3676C3C4} -> No File
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2013-01-13] (Sun Microsystems, Inc.)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2016-07-12] (AVAST Software)
BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2013-01-13] (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll [2009-04-17] (TechSmith Corporation)
Toolbar: HKU\S-1-5-21-2495495804-1520031139-3188645834-1000 -> No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} -  No File
DPF: HKLM-x32 {DE3135A8-D948-49DC-ABBC-B2EFF418E5FD} hxxp://dizun95pzobbc.cloudfront.net/AIRJ01FPlayer.CAB
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\188b898l.default [2017-04-29]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\188b898l.default -> Ixquick HTTPS
FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\188b898l.default -> Ixquick HTTPS
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\188b898l.default -> Ixquick (SSL)
FF SearchPlugin: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\188b898l.default\searchplugins\blekko-ssl.xml [2013-09-08]
FF SearchPlugin: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\188b898l.default\searchplugins\duckduckgo-de.xml [2013-09-08]
FF SearchPlugin: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\188b898l.default\searchplugins\ixquick-https.xml [2016-03-28]
FF SearchPlugin: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\188b898l.default\searchplugins\ixquick-ssl.xml [2013-09-08]
FF ProfilePath: C:\Users\pc\AppData\Roaming\KompoZer\Profiles\224lx2wf.default [2012-05-11]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2016-07-12]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\Alwil Software\Avast5\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\Alwil Software\Avast5\SafePrice\FF [2016-07-12]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF HKLM-x32\…\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\Alwil Software\Avast5\SafePrice\FF
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-05-02] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-05-02] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2010-06-09] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2010-04-02] (Google)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll [2013-01-13] (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2495495804-1520031139-3188645834-1000: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\pc\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1312180-0-npoctoshape.dll [2013-12-18] (Octoshape ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\pc\AppData\Roaming\mozilla\plugins\npoctoshape.dll [2014-08-19] (Octoshape ApS)

Chrome:
=======
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-07-25]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [197128 2016-07-12] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R3 iPod Service; C:\Program Files (x86)\iPod\bin\iPodService.exe [653616 2010-06-15] (Apple Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 aswHdsKe; C:\Windows\system32\drivers\aswHdsKe.sys [82936 2016-10-07] (AVAST Software)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-07-12] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-07-12] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108304 2016-07-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-07-12] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-07-12] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-07-12] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [473592 2016-07-13] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [162904 2016-07-12] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-08-06] (AVAST Software)
U5 UnlockerDriver5; C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys [4096 2008-05-01] () [File not signed]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
U3 aswMBR; \??\C:\Users\pc\AppData\Local\Temp\aswMBR.sys [X] <==== ATTENTION

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-29 21:43 - 2017-04-29 21:45 - 00031714 _____ C:\Users\pc\Downloads\Addition.txt
2017-04-29 21:41 - 2017-04-29 22:03 - 00023282 _____ C:\Users\pc\Downloads\FRST.txt
2017-04-29 21:29 - 2017-04-29 22:03 - 00000000 ____D C:\FRST
2017-04-29 21:24 - 2017-04-29 21:25 - 02427392 _____ (Farbar) C:\Users\pc\Downloads\FRST64.exe
2017-04-29 20:59 - 2017-04-29 21:05 - 00002426 _____ C:\Users\pc\Desktop\aswMBR.txt
2017-04-29 20:59 - 2017-04-29 21:02 - 00000512 _____ C:\Users\pc\Desktop\MBR.dat
2017-04-29 20:48 - 2017-04-29 20:57 - 00002426 _____ C:\Users\pc\Documents\aswMBR.txt
2017-04-29 20:48 - 2017-04-29 20:48 - 00000512 _____ C:\Users\pc\Documents\MBR.dat
2017-04-29 20:27 - 2017-04-29 20:27 - 00002239 _____ C:\Windows\SysWOW64\aswMBR LOGapril.txt
2017-04-29 20:27 - 2017-04-29 20:27 - 00000512 _____ C:\Windows\SysWOW64\MBR.dat
2017-04-29 19:09 - 2017-04-29 19:09 - 05198336 _____ (AVAST Software) C:\Users\pc\Downloads\aswMBR(1).exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-29 18:28 - 2009-07-13 20:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-04-29 18:28 - 2009-07-13 20:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-04-29 18:26 - 2016-11-26 01:46 - 00000000 ____D C:\Users\pc\AppData\LocalLow\Mozilla
2017-04-29 18:26 - 2016-10-22 11:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-04-29 18:23 - 2010-02-02 21:14 - 00003906 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D0639A83-4A83-45A0-A8BE-650FD8DE0BDD}
2017-04-29 18:22 - 2015-08-14 21:05 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2017-04-29 18:22 - 2009-07-13 21:13 - 00732510 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-29 18:22 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\inf
2017-04-29 18:20 - 2012-06-07 18:57 - 00000000 ____D C:\Windows\Minidump
2017-04-29 18:14 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-29 18:12 - 2015-08-15 00:39 - 00000000 ____D C:\Users\pc\AppData\Roaming\WireShare
2017-04-03 19:51 - 2017-03-21 18:49 - 00000000 ____D C:\Users\pc\AppData\Roaming\audacity

==================== Files in the root of some directories =======

2012-09-13 21:53 - 2010-04-02 02:25 - 0323584 _____ (Quizulous) C:\Program Files (x86)\Uninstall Quizulous Toolbar.dll
2013-11-08 01:02 - 2013-11-08 01:07 - 4216840 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\vcredist.exe
2010-02-05 20:31 - 2010-03-03 20:55 - 0099384 _____ () C:\Users\pc\AppData\Roaming\inst.exe
2012-08-23 20:40 - 2012-08-23 20:40 - 0005052 _____ () C:\Users\pc\AppData\Roaming\INSTALL.LOG
2010-02-05 20:31 - 2010-03-03 20:55 - 0007859 _____ () C:\Users\pc\AppData\Roaming\pcouffin.cat
2010-02-05 20:31 - 2010-03-03 20:55 - 0001167 _____ () C:\Users\pc\AppData\Roaming\pcouffin.inf
2010-02-05 20:31 - 2010-03-03 20:55 - 0000034 _____ () C:\Users\pc\AppData\Roaming\pcouffin.log
2010-02-05 20:31 - 2010-03-03 20:55 - 0082816 _____ (VSO Software) C:\Users\pc\AppData\Roaming\pcouffin.sys
2010-02-01 06:13 - 2015-08-05 18:00 - 0001054 _____ () C:\Users\pc\AppData\Roaming\wklnhst.dat
2010-04-20 22:34 - 2010-04-20 22:34 - 0000048 _____ () C:\Users\pc\AppData\Local\73648-88365-27475-00IP7-22847
2014-08-12 17:21 - 2014-08-21 09:34 - 0004608 _____ () C:\Users\pc\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-02-01 09:51 - 2010-02-01 09:59 - 0000084 _____ () C:\Users\pc\AppData\Local\DVDPATH.TXT
2009-11-05 12:32 - 2009-11-05 12:35 - 0008415 _____ () C:\ProgramData\ArcadeDeluxe3.log

Files to move or delete:
====================
C:\Users\pc\Sherlock-Patch.exe


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-23 17:05

==================== End of FRST.txt ============================

Post #10

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-04-29 19:15:03
—————————–
19:15:03.593    OS Version: Windows x64 6.1.7600
19:15:03.594    Number of processors: 1 586 0x7C02
19:15:03.598    ComputerName: LAPTOP  UserName: pc
19:15:05.075    Initialize success
19:15:05.225    VM: initialized successfully
19:15:05.229    VM: Amd CPU virtualization not supported
19:15:13.532    AVAST engine defs: 17042900
19:19:07.691    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
19:19:07.695    Disk 0 Vendor: Hitachi_HTS545016B9A300 PBBOC60F Size: 152627MB BusType: 11
19:19:07.855    Disk 0 MBR read successfully
19:19:07.859    Disk 0 MBR scan
19:19:07.866    Disk 0 Windows 7 default MBR code
19:19:07.871    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12291 MB offset 63
19:19:07.895    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          101 MB offset 25173855
19:19:07.906    Disk 0 Boot: NTFS     code=1
19:19:07.924    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       140232 MB offset 25382700
19:19:08.054    Disk 0 scanning C:\Windows\system32\drivers
19:19:25.257    Service scanning
19:20:06.177    Modules scanning
19:20:06.195    Disk 0 trace - called modules:
19:20:06.235    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
19:20:06.243    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8002fd1060]
19:20:06.255    3 CLASSPNP.SYS[fffff880016b443f] -> nt!IofCallDriver -> [0xfffffa800303b460]
19:20:06.266    5 ACPI.sys[fffff88000f13781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8002fcb060]
19:20:06.833    AVAST engine scan C:\Windows
19:20:09.655    AVAST engine scan C:\Windows\system32
19:23:55.921    AVAST engine scan C:\Windows\system32\drivers
19:24:11.749    AVAST engine scan C:\Users\pc
20:12:04.011    AVAST engine scan C:\ProgramData
20:16:23.611    Disk 0 statistics 4620241/0/0 @ 0.76 MB/s
20:16:23.648    Scan finished successfully
20:27:54.195    Disk 0 MBR has been saved successfully to "C:\Windows\System32\MBR.dat"
20:27:54.219    The log file has been saved successfully to "C:\Windows\System32\aswMBR LOGapril.txt"
20:48:58.416    Disk 0 MBR has been saved successfully to "C:\Users\pc\Documents\MBR.dat"
20:48:58.429    The log file has been saved successfully to "C:\Users\pc\Documents\aswMBR.txt"
 aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-04-29 19:15:03
—————————–
19:15:03.593    OS Version: Windows x64 6.1.7600
19:15:03.594    Number of processors: 1 586 0x7C02
19:15:03.598    ComputerName: LAPTOP  UserName: pc
19:15:05.075    Initialize success
19:15:05.225    VM: initialized successfully
19:15:05.229    VM: Amd CPU virtualization not supported
19:15:13.532    AVAST engine defs: 17042900
19:19:07.691    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
19:19:07.695    Disk 0 Vendor: Hitachi_HTS545016B9A300 PBBOC60F Size: 152627MB BusType: 11
19:19:07.855    Disk 0 MBR read successfully
19:19:07.859    Disk 0 MBR scan
19:19:07.866    Disk 0 Windows 7 default MBR code
19:19:07.871    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12291 MB offset 63
19:19:07.895    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          101 MB offset 25173855
19:19:07.906    Disk 0 Boot: NTFS     code=1
19:19:07.924    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       140232 MB offset 25382700
19:19:08.054    Disk 0 scanning C:\Windows\system32\drivers
19:19:25.257    Service scanning
19:20:06.177    Modules scanning
19:20:06.195    Disk 0 trace - called modules:
19:20:06.235    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
19:20:06.243    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8002fd1060]
19:20:06.255    3 CLASSPNP.SYS[fffff880016b443f] -> nt!IofCallDriver -> [0xfffffa800303b460]
19:20:06.266    5 ACPI.sys[fffff88000f13781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8002fcb060]
19:20:06.833    AVAST engine scan C:\Windows
19:20:09.655    AVAST engine scan C:\Windows\system32
19:23:55.921    AVAST engine scan C:\Windows\system32\drivers
19:24:11.749    AVAST engine scan C:\Users\pc
20:12:04.011    AVAST engine scan C:\ProgramData
20:16:23.611    Disk 0 statistics 4620241/0/0 @ 0.76 MB/s
20:16:23.648    Scan finished successfully
20:27:54.195    Disk 0 MBR has been saved successfully to "C:\Windows\System32\MBR.dat"
20:27:54.219    The log file has been saved successfully to "C:\Windows\System32\aswMBR LOGapril.txt"
20:48:58.416    Disk 0 MBR has been saved successfully to "C:\Users\pc\Documents\MBR.dat"
20:48:58.429    The log file has been saved successfully to "C:\Users\pc\Documents\aswMBR.txt"
20:59:18.778    Disk 0 MBR has been saved successfully to "C:\Users\pc\Desktop\MBR.dat"
20:59:18.795    The log file has been saved successfully to "C:\Users\pc\Desktop\aswMBR.txt"
21:00:25.240    Disk 0 MBR has been saved successfully to "C:\Users\pc\Desktop\MBR.dat"
21:00:25.251    The log file has been saved successfully to "C:\Users\pc\Desktop\aswMBR.txt"
21:02:31.914    Disk 0 MBR has been saved successfully to "C:\Users\pc\Desktop\MBR.dat"
21:02:31.929    The log file has been saved successfully to "C:\Users\pc\Desktop\aswMBR.txt"
23:14:04.428    Disk 0 MBR has been saved successfully to "C:\Users\pc\Documents\MBR.dat"
23:14:04.439    The log file has been saved successfully to "C:\Users\pc\Documents\aswMBR.txt"

Post #11

Good Morning,

 

You have quite a mess going on.  Sometimes I scratch my and head and wonder what people do to mess up there computer so bad. You have a bad proxy set which means your internet is being routed through a bogus server. We can deal with that in a bit.

 

First go into Programs and Features in the Control Panel and uninstall both Limewire and WireShare, programs like these are most likely how you got into this situation in the first place.

 

Second, go into your Downloads folder and look for FRST64, right click it and select CUT, come back to your Desktop and right click on a blank space and select PASTE, we need to have any and all programs that I will have you run run from the desktop, it will run more effectiently there than being buried in a folder.

 

Then lets see how much these programs find and remove. Do like you did before when posting your logs, take as many replies as you need

 

All our tools and scanners work more efficiently when run from the DESKTOP in lieu of being buried in some folder, so download and run these tools right from the DESKTOP
 
 
-AdwCleaner-by Xplode
 
Click on this link to download : ADWCleaner TO YOUR DESKTOP
 
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
 
[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]
 
 
  •  
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
 
 
 
===============================================================================
 
 
 
 
[external image: Capture_zpsge1t2tk9.jpg] Please download Junkware Removal Tool TO YOUR DESKTOP
  •  
  • Download the one from Bleeping Computer
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
 
 
 
 
===============================================================================
 
 
 
Download Malwarebytes' Anti-Malware  TO YOUR DESKTOP
 
  •  
  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
 
 
[external image: 3.0.6_zps4qucu0yg.jpg]
 
 
  •  
  • After the installation IS complete let it update if it asks.
  • Under SETTINGS…..APPLICATIONS leave everything at default
  • Under SETTINGS…..PROTECTION make sure AUTOMATIC QUARANTINE is on. 
  • Then go to the Dashboard and click on SCAN NOW
  • When the scan is finished click on EXPORT SUMMARY……COPY TO CLIPBOARD
  • Then come back to this thread and and under REPLY TO THIS TOPIC, right click in the reply and select Paste
  • Then click on POST
  • Exit Malwarebytes

 

 

 

Post #12

Good Morning,

 

How are you coming along my friend.  I know you said your PC is real slow so dont let my instructions overwhelm you. After you run them all you should notice a big improvement. Just do them one at a time. If you have problems running one, forget it for now and move on to the next one.  Run one and then post the log and then go on to the other ones, do them one at a time

 

1. Run ADWCleaner and post the log.

2. Run Junkware Removal and post the log

3. Download and install Malwarebytes, run the scan and post the log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI