Spyware / Malware / Virus Removal

Infection Removal Needed [Solved]

12 min read

Looking for the outcome? Ask AI

xxxerotech Topic Starter

Post #1May 7, 2017, 11:48 AM UTC

I need your help fixing my laptop. I can't run Mozilla Firefox and I believe it's being cause by some kind of infection. Thanks!

ASWMBR

Run date: 2016-11-22 08:48:18

—————————–

08:48:18.000 OS Version: Windows 6.1.7600

08:48:18.000 Number of processors: 2 586 0x170A

08:48:18.002 ComputerName: ADADU-PC UserName: Adadu

08:48:25.127 Initialize success

08:48:25.143 VM: initialized successfully

08:48:25.144 VM: Intel CPU virtualization not supported

08:48:34.075 AVAST engine defs: 16112100

08:48:49.821 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

08:48:49.824 Disk 0 Vendor: TOSHIBA_MK2552GSX LV010A Size: 238475MB BusType: 11

08:48:49.839 Disk 0 MBR read successfully

08:48:49.843 Disk 0 MBR scan

08:48:49.872 Disk 0 Windows 7 default MBR code

08:48:49.889 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

08:48:49.895 Disk 0 Boot: NTFS code=2

08:48:49.906 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 238373 MB offset 206848

08:48:49.912 Disk 0 scanning sectors +488394752

08:48:50.017 Disk 0 scanning C:\Windows\system32\drivers

08:49:03.214 Service scanning

08:49:24.352 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32

08:49:31.089 Modules scanning

08:49:31.097 Disk 0 trace - called modules:

08:49:31.112 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x855911f8]<<

08:49:31.118 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8642dac8]

08:49:31.126 3 CLASSPNP.SYS[8beab59e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x862eb030]

08:49:31.134 \Driver\atapi[0x862e6f38] -> IRP_MJ_CREATE -> 0x855911f8

08:49:31.934 AVAST engine scan C:\Windows

08:49:35.259 AVAST engine scan C:\Windows\system32

08:51:58.792 AVAST engine scan C:\Windows\system32\drivers

08:52:09.872 AVAST engine scan C:\Users\Adadu

08:58:25.453 Disk 0 MBR has been saved successfully to "C:\Users\Adadu\Desktop\MBR.dat"

08:58:25.463 The log file has been saved successfully to "C:\Users\Adadu\Desktop\aswMBR.txt"

Run date: 2016-11-22 08:59:13

—————————–

08:59:13.899 OS Version: Windows 6.1.7600

08:59:13.899 Number of processors: 2 586 0x170A

08:59:13.902 ComputerName: ADADU-PC UserName: Adadu

08:59:14.667 Initialize success

08:59:14.896 VM: initialized successfully

08:59:14.899 VM: Intel CPU virtualization not supported

08:59:22.569 AVAST engine defs: 16112100

08:59:40.038 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

08:59:40.043 Disk 0 Vendor: TOSHIBA_MK2552GSX LV010A Size: 238475MB BusType: 11

08:59:40.119 Disk 0 MBR read successfully

08:59:40.124 Disk 0 MBR scan

08:59:40.131 Disk 0 Windows 7 default MBR code

08:59:40.147 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

08:59:40.184 Disk 0 Boot: NTFS code=2

08:59:40.208 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 238373 MB offset 206848

08:59:40.243 Disk 0 scanning sectors +488394752

08:59:40.354 Disk 0 scanning C:\Windows\system32\drivers

08:59:49.606 Service scanning

09:00:08.917 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32

09:00:14.758 Modules scanning

09:00:14.769 Disk 0 trace - called modules:

09:00:14.813 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x855911f8]<<

09:00:14.823 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8642dac8]

09:00:14.833 3 CLASSPNP.SYS[8beab59e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x862eb030]

09:00:14.843 \Driver\atapi[0x862e6f38] -> IRP_MJ_CREATE -> 0x855911f8

09:00:15.434 AVAST engine scan C:\Windows

09:00:19.019 AVAST engine scan C:\Windows\system32

09:02:11.846 AVAST engine scan C:\Windows\system32\drivers

09:02:22.740 AVAST engine scan C:\Users\Adadu

09:15:24.401 AVAST engine scan C:\ProgramData

09:19:54.078 Disk 0 statistics 2737632/0/0 @ 1.30 MB/s

09:19:54.094 Scan finished successfully

09:53:40.231 Disk 0 MBR has been saved successfully to "C:\Users\Adadu\Desktop\MBR.dat"

09:53:40.237 The log file has been saved successfully to "C:\Users\Adadu\Desktop\aswMBR.txt"

Run date: 2017-05-07 19:23:45

—————————–

19:23:45.618 OS Version: Windows 6.1.7600

19:23:45.619 Number of processors: 2 586 0x170A

19:23:45.622 ComputerName: ADADU-PC UserName: Adadu

19:23:52.367 Initialize success

19:23:52.548 VM: initialized successfully

19:23:52.550 VM: Intel CPU virtualization not supported

19:24:00.511 AVAST engine defs: 17050700

19:24:09.028 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

19:24:09.033 Disk 0 Vendor: TOSHIBA_MK2552GSX LV010A Size: 238475MB BusType: 11

19:24:09.103 Disk 0 MBR read successfully

19:24:09.109 Disk 0 MBR scan

19:24:09.116 Disk 0 Windows 7 default MBR code

19:24:09.131 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

19:24:09.165 Disk 0 Boot: NTFS code=2

19:24:09.181 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 238373 MB offset 206848

19:24:09.216 Disk 0 scanning sectors +488394752

19:24:09.305 Disk 0 scanning C:\Windows\system32\drivers

19:24:27.338 Service scanning

19:24:52.029 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32

19:24:59.456 Modules scanning

19:24:59.467 Disk 0 trace - called modules:

19:24:59.500 ntoskrnl.exe CLASSPNP.SYS disk.sys aswSP.sys halmacpi.dll >>UNKNOWN [0x8558d1f8]<<

19:24:59.510 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86430030]

19:24:59.521 3 aswSP.sys[91c6e661] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x862a2908]

19:24:59.527 \Driver\atapi[0x862e5030] -> IRP_MJ_CREATE -> 0x8558d1f8

19:25:00.067 AVAST engine scan C:\Windows

19:25:03.055 AVAST engine scan C:\Windows\system32

19:27:44.839 AVAST engine scan C:\Windows\system32\drivers

19:27:57.508 AVAST engine scan C:\Users\Adadu

19:28:30.626 Disk 0 MBR has been saved successfully to "C:\Users\Adadu\Desktop\MBR.dat"

19:28:30.718 The log file has been saved successfully to "C:\Users\Adadu\Desktop\aswMBR.txt"

Run date: 2017-05-07 19:23:45

—————————–

19:23:45.618 OS Version: Windows 6.1.7600

19:23:45.619 Number of processors: 2 586 0x170A

19:23:45.622 ComputerName: ADADU-PC UserName: Adadu

19:23:52.367 Initialize success

19:23:52.548 VM: initialized successfully

19:23:52.550 VM: Intel CPU virtualization not supported

19:24:00.511 AVAST engine defs: 17050700

19:24:09.028 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

19:24:09.033 Disk 0 Vendor: TOSHIBA_MK2552GSX LV010A Size: 238475MB BusType: 11

19:24:09.103 Disk 0 MBR read successfully

19:24:09.109 Disk 0 MBR scan

19:24:09.116 Disk 0 Windows 7 default MBR code

19:24:09.131 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

19:24:09.165 Disk 0 Boot: NTFS code=2

19:24:09.181 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 238373 MB offset 206848

19:24:09.216 Disk 0 scanning sectors +488394752

19:24:09.305 Disk 0 scanning C:\Windows\system32\drivers

19:24:27.338 Service scanning

19:24:52.029 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32

19:24:59.456 Modules scanning

19:24:59.467 Disk 0 trace - called modules:

19:24:59.500 ntoskrnl.exe CLASSPNP.SYS disk.sys aswSP.sys halmacpi.dll >>UNKNOWN [0x8558d1f8]<<

19:24:59.510 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86430030]

19:24:59.521 3 aswSP.sys[91c6e661] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x862a2908]

19:24:59.527 \Driver\atapi[0x862e5030] -> IRP_MJ_CREATE -> 0x8558d1f8

19:25:00.067 AVAST engine scan C:\Windows

19:25:03.055 AVAST engine scan C:\Windows\system32

19:27:44.839 AVAST engine scan C:\Windows\system32\drivers

19:27:57.508 AVAST engine scan C:\Users\Adadu

19:28:30.626 Disk 0 MBR has been saved successfully to "C:\Users\Adadu\Desktop\MBR.dat"

19:28:30.718 The log file has been saved successfully to "C:\Users\Adadu\Desktop\aswMBR.txt"

19:28:39.214 Disk 0 MBR has been saved successfully to "C:\Users\Adadu\Desktop\MBR.dat"

19:28:39.220 The log file has been saved successfully to "C:\Users\Adadu\Desktop\aswMBR.txt"

FRST

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-05-2017

Ran by [removed] (administrator) on ADADU-PC (07-05-2017 19:32:17)

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Micro$hit MacOS X 7 Ultimate (X86) Language: English (United States)

Internet Explorer Version 9 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Windows\RTKAUDIOSERVICE.EXE

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(AO Kaspersky Lab) C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\kss.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

() C:\Program Files\SMART BRO\AssistantServices.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe

(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\aswidsagent.exe

() C:\Program Files\SMART BRO\UIExec.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe

(Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Free Time) C:\Program Files\PicosmosTools\PicosmosTools.exe

(AO Kaspersky Lab) C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\kss.exe

(Microsoft Corporation) C:\Windows\System32\StikyNot.exe

(AO Kaspersky Lab) C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\kss.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Farbar) C:\Users\Adadu\Downloads\FRST (1).exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [UIExec] => C:\Program Files\SMART BRO\UIExec.exe [139088 2011-04-02] ()

HKLM\…\Run: [BlueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe

HKLM\…\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-05] (AVAST Software)

HKLM\…\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [28432392 2017-05-01] (Dropbox, Inc.)

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => "C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe"

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\Run: [Picosmos] => C:\Program Files\PicosmosTools\PicosmosTools.exe [5733960 2016-05-21] (Free Time)

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\Run: [KSS] => C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\Run: [Free Download Manager] => "C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\fdm.exe" –minimized

ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2017-04-05] (AVAST Software)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky Software Updater Beta.lnk [2016-07-10]

ShortcutTarget: Kaspersky Software Updater Beta.lnk -> C:\Program Files\Kaspersky Lab\Kaspersky Software Updater Beta\ksu.exe (AO Kaspersky Lab)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk [2016-11-26]

ShortcutTarget: Orbit.lnk -> C:\Program Files\Orbitdownloader\orbitdm.exe (No File)

BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 0.0.0.1 mssplus.mcafee.com

Tcpip\Parameters: [DhcpNameServer] 192.168.254.254 192.168.254.254

Tcpip\..\Interfaces\{A8279C24-18BD-4C66-8A18-90C981C2330E}: [DhcpNameServer] 192.168.254.254 192.168.254.254

Internet Explorer:

==================

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-ph/?ocid=iehp

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.com

hxxp://go.microsoft.com/fwlink/?LinkId=69157

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27] (Adobe Systems Incorporated)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-04-05] (AVAST Software)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-29] (Google Inc.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-29] (Google Inc.)

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-27] (Microsoft Corporation)

FireFox:

========

FF ProfilePath: C:\Users\Adadu\AppData\Roaming\Mozilla\Firefox\Profiles\9sdpg9pi.default-1450624626215 [2016-11-28]

FF NewTab: Mozilla\Firefox\Profiles\9sdpg9pi.default-1450624626215 -> about:newtab

FF DefaultSearchEngine: Mozilla\Firefox\Profiles\9sdpg9pi.default-1450624626215 -> Yahoo!

FF SelectedSearchEngine: Mozilla\Firefox\Profiles\9sdpg9pi.default-1450624626215 -> Yahoo!

FF Homepage: Mozilla\Firefox\Profiles\9sdpg9pi.default-1450624626215 -> about:home

FF Extension: (Firefox Hotfix) - C:\Users\Adadu\AppData\Roaming\Mozilla\Firefox\Profiles\9sdpg9pi.default-1450624626215\Extensions\[removed] [2016-09-09]

FF ProfilePath: C:\Users\Adadu\AppData\Roaming\Mozilla\Firefox\Profiles\qababq48.default-1479725842724 [2016-11-21]

FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF48

FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF48 [2017-04-05]

FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48

FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 [2017-04-05]

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_23_0_0_185.dll [2016-10-26] ()

FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)

FF Plugin HKU\S-1-5-21-3559194677-4052321422-2392058216-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Adadu\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [No File]

FF Plugin HKU\S-1-5-21-3559194677-4052321422-2392058216-1000: www.mydlink.com/Uplayer -> C:\Users\Adadu\AppData\Roaming\D-Link\mydlink services plugin\1.0.2.7\npUplayer.dll [2015-12-11] (D-Link Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npnul32.dll [2009-12-02] (mozilla.org)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)

FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox-branding.js [2009-12-02]

FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox-l10n.js [2009-12-02]

FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox.js [2009-12-02]

FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\reporter.js [2009-12-02]

Chrome:

=======

CHR Profile: C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default [2017-05-07]

CHR Extension: (Google Slides) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-10-26]

CHR Extension: (Google Docs) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-10-26]

CHR Extension: (Google Drive) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-10-26]

CHR Extension: (YouTube) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-10-26]

CHR Extension: (Avast SafePrice) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-03-17]

CHR Extension: (Google Sheets) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-10-26]

CHR Extension: (Google Docs Offline) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-11-01]

CHR Extension: (Avast Online Security) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-04-07]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]

CHR Extension: (Transcribe: transcribe audio/interviews fast!) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogokenmicnjdfhmhocanoemnddmpcjjm [2016-12-27]

CHR Extension: (Gmail) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-10-26]

CHR Extension: (Chrome Media Router) - C:\Users\Adadu\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-29]

CHR HKLM\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5758120 2017-04-05] (AVAST Software s.r.o.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-05] (AVAST Software)

S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-18] (Dropbox, Inc.)

S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-18] (Dropbox, Inc.)

S2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42288 2017-05-01] (Dropbox, Inc.)

R2 kss; C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.292\McCHSvc.exe [239880 2016-02-06] (McAfee, Inc.)

R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

R2 Themes; C:\Windows\system32\themeservice.dll [37376 2009-08-14] (Microsoft Corporation) [File not signed]

R2 UI Assistant Service; C:\Program Files\SMART BRO\AssistantServices.exe [253264 2011-01-24] ()

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [255184 2017-04-05] (AVAST Software s.r.o.)

R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [148208 2017-04-05] (AVAST Software s.r.o.)

R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [267528 2017-04-05] (AVAST Software s.r.o.)

R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [41176 2017-04-05] (AVAST Software s.r.o.)

S3 aswHdsKe; C:\Windows\system32\drivers\aswHdsKe.sys [70008 2017-02-09] (AVAST Software)

S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34136 2017-04-05] (AVAST Software)

R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [31064 2017-04-05] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107928 2017-04-28] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [90336 2017-04-05] (AVAST Software)

R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [62152 2017-04-05] (AVAST Software)

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [764064 2017-04-05] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [472760 2017-04-28] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [118800 2017-04-05] (AVAST Software)

R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [279800 2017-04-05] (AVAST Software)

S3 jakstaVA; C:\Windows\System32\DRIVERS\jaksta_va.sys [91784 2014-12-09] (e2eSoft)

S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2013-03-10] () [File not signed]

S3 ZTEusbvoice; C:\Windows\System32\DRIVERS\ZTEusbvoice.sys [107776 2011-03-26] (ZTE Incorporated)

U3 annkckj9; C:\Windows\system32\Drivers\annkckj9.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)

S3 dbx; system32\DRIVERS\dbx.sys [X]

U3 aswMBR; \??\C:\Users\Adadu\AppData\Local\Temp\aswMBR.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-07 19:30 - 2017-05-07 19:30 - 01769984 _____ (Farbar) C:\Users\Adadu\Downloads\FRST (1).exe

2017-05-07 19:23 - 2017-05-07 19:23 - 05198336 _____ (AVAST Software) C:\Users\Adadu\Downloads\aswMBR (1).exe

2017-05-07 18:55 - 2017-05-07 18:55 - 00001121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2017-05-07 18:55 - 2017-05-07 18:55 - 00001109 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2017-05-07 18:55 - 2017-05-07 18:55 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2017-05-07 18:54 - 2017-05-07 18:54 - 00246096 _____ (Mozilla) C:\Users\Adadu\Downloads\Firefox Setup Stub 53.0.2.exe

2017-05-07 18:54 - 2017-05-07 18:54 - 00179848 _____ (Mozilla) C:\Users\Adadu\Downloads\Firefox Installer.exe

2017-05-07 18:53 - 2017-05-07 18:53 - 00000000 ____D C:\ProgramData\SWCUTemp

2017-05-03 08:40 - 2017-05-03 08:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox

2017-05-01 22:49 - 2017-05-01 22:49 - 00042288 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe

2017-04-15 01:20 - 2017-04-15 01:20 - 00009650 _____ C:\Users\Adadu\Documents\Money_Tracker.xlsx

2017-04-11 18:45 - 2017-04-11 18:45 - 00000216 _____ C:\Users\Adadu\Desktop\hearthstone list.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-07 19:32 - 2016-07-03 12:12 - 00017322 _____ C:\Users\Adadu\Downloads\FRST.txt

2017-05-07 19:32 - 2016-07-03 12:05 - 00000000 ____D C:\FRST

2017-05-07 19:28 - 2016-11-22 08:58 - 00008562 _____ C:\Users\Adadu\Desktop\aswMBR.txt

2017-05-07 19:28 - 2016-11-22 08:58 - 00000512 _____ C:\Users\Adadu\Desktop\MBR.dat

2017-05-07 18:55 - 2016-11-18 09:18 - 00000000 ____D C:\Program Files\Mozilla Firefox

2017-05-07 18:37 - 2016-05-18 15:15 - 00000894 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job

2017-05-07 13:37 - 2016-05-18 15:15 - 00000890 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job

2017-05-07 08:39 - 2013-03-10 00:37 - 00000000 ____D C:\Windows\system32\Macromed

2017-05-06 18:09 - 2009-07-14 12:34 - 00014192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2017-05-06 18:09 - 2009-07-14 12:34 - 00014192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2017-05-06 18:04 - 2009-07-14 12:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2017-05-06 17:00 - 2015-12-29 08:21 - 00000000 ____D C:\Users\Adadu\AppData\Local\Battle.net

2017-05-06 14:00 - 2015-12-29 08:18 - 00000000 ____D C:\Program Files\Battle.net

2017-05-04 08:19 - 2016-10-26 11:43 - 00002141 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2017-05-04 08:19 - 2016-10-26 11:43 - 00002129 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2017-05-03 09:08 - 2015-12-29 08:53 - 00000000 ____D C:\Program Files\Hearthstone

2017-05-03 08:40 - 2016-05-18 15:15 - 00000000 ____D C:\Program Files\Dropbox

2017-05-03 08:39 - 2016-05-18 15:37 - 00000000 ___RD C:\Users\Adadu\Dropbox

2017-05-01 00:51 - 2015-12-21 03:58 - 00000000 ____D C:\Users\Adadu\AppData\Roaming\Azureus

2017-05-01 00:51 - 2015-12-21 03:58 - 00000000 ____D C:\Program Files\Vuze

2017-05-01 00:47 - 2015-12-21 03:58 - 00000000 ____D C:\Users\Adadu\Documents\Vuze Downloads

2017-05-01 00:24 - 2013-03-10 16:18 - 00000000 ____D C:\Users\Adadu\AppData\Roaming\vlc

2017-04-28 21:09 - 2016-04-07 09:51 - 00472760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2017-04-28 21:09 - 2016-04-07 09:51 - 00107928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys

2017-04-21 08:16 - 2013-03-10 00:42 - 00785302 _____ C:\Windows\system32\PerfStringBackup.INI

2017-04-21 08:16 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\inf

2017-04-13 20:43 - 2013-03-10 16:34 - 00000000 ____D C:\Users\Adadu\AppData\Local\Adobe

2017-04-13 20:43 - 2013-03-10 16:02 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2017-04-13 20:43 - 2013-03-10 16:02 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2017-04-07 08:59 - 2016-04-07 09:45 - 00000000 ____D C:\ProgramData\AVAST Software

==================== Files in the root of some directories =======

2016-08-07 12:57 - 2016-08-07 21:57 - 0000103 _____ () C:\Users\Adadu\AppData\Roaming\Camdata.ini

2016-08-07 12:57 - 2016-08-07 21:57 - 0000408 _____ () C:\Users\Adadu\AppData\Roaming\CamLayout.ini

2016-08-07 12:57 - 2016-08-07 21:57 - 0000408 _____ () C:\Users\Adadu\AppData\Roaming\CamShapes.ini

2016-08-07 12:57 - 2016-08-07 21:57 - 0004535 _____ () C:\Users\Adadu\AppData\Roaming\CamStudio.cfg

2016-08-07 12:49 - 2016-08-07 21:53 - 0000096 _____ () C:\Users\Adadu\AppData\Roaming\version2.xml

Some files in TEMP:

====================

2017-04-15 20:55 - 2017-04-15 20:55 - 0056890 _____ () C:\Users\Adadu\AppData\Local\Temp\{1D7E82CF-85F9-43FF-85FC-1665C837A98B}-DropboxClient_23.4.19.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe

[2009-07-14 07:41] - [2009-09-03 13:51] - 2417664 _____ (Microsoft Corporation) 850AC6E1690E59DF6E6F37D076DD7443

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2013-11-20 22:10

==================== End of FRST.txt ============================

ADDITION

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-05-2017

Ran by [removed] (07-05-2017 19:33:10)

Running from C:\Users\[removed]\Downloads

Micro$hit MacOS X 7 Ultimate (X86) (2013-03-09 16:32:21)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Adadu (S-1-5-21-3559194677-4052321422-2392058216-1000 - Administrator - Enabled) => C:\Users\Adadu

Administrator (S-1-5-21-3559194677-4052321422-2392058216-500 - Administrator - Disabled)

Guest (S-1-5-21-3559194677-4052321422-2392058216-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 4.65 (HKLM\…\7-Zip) (Version: - )

Adobe Flash Player 22 ActiveX (HKLM\…\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)

Adobe Flash Player 23 NPAPI (HKLM\…\Adobe Flash Player NPAPI) (Version: 23.0.0.185 - Adobe Systems Incorporated)

Adobe Flash Player 25 PPAPI (HKLM\…\Adobe Flash Player PPAPI) (Version: 25.0.0.148 - Adobe Systems Incorporated)

Adobe Reader 9.2 Lite (HKLM\…\{AC76BA86-7AD7-1033-7B44-A92000000001}) (Version: 9.2.0 - Adobe Systems Incorporated)

Advertising Center (Version: 0.0.0.1 - Nero AG) Hidden

AIMP2 (HKLM\…\AIMP2) (Version: - AIMP DevTeam)

Audacity 2.1.2 (HKLM\…\Audacity®_is1) (Version: 2.1.2 - Audacity Team)

Avast Free Antivirus (HKLM\…\Avast Antivirus) (Version: 17.3.2291 - AVAST Software)

Battle.net (HKLM\…\Battle.net) (Version: - Blizzard Entertainment)

Bejeweled Deluxe 1.862 (HKLM\…\Bejeweled Deluxe 1.862) (Version: - )

CamStudio 2.7.4 (HKLM\…\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.4 - CamStudio Open Source)

CDisplayEx 1.10.29 (HKLM\…\CDisplayEx_is1) (Version: - Progdigy Software S.A.R.L.)

Combo Chaos Deluxe (HKLM\…\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7}) (Version: - HALFPiNT Games)

Cool Timer 5.1.3.0 (HKLM\…\Cool Timer_is1) (Version: - Harmony Hollow Software)

DolbyFiles (Version: 2.0 - Nero AG) Hidden

Dropbox (HKLM\…\Dropbox) (Version: 25.4.28 - Dropbox, Inc.)

Dropbox Update Helper (Version: 1.3.59.1 - Dropbox, Inc.) Hidden

ESET Online Scanner v3 (HKLM\…\ESET Online Scanner) (Version: - )

FormatFactory 3.9.0.1 (HKLM\…\FormatFactory) (Version: 3.9.0.1 - Free Time)

Google Chrome (HKLM\…\Google Chrome) (Version: 58.0.3029.96 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)

Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.21.135 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.33.5 - Google Inc.) Hidden

Hearthstone (HKLM\…\Hearthstone) (Version: - Blizzard Entertainment)

Icecream Ebook Reader version 4.33 (HKLM\…\{B8C30F0F-1F23-49E1-A3ED-44DE17660EE2}_is1) (Version: 4.33 - Icecream Apps)

Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: 8.15.10.1872 - Intel Corporation)

Kaspersky Security Scan (HKLM\…\InstallWIX_{D1282694-0693-41A8-ABC1-6D1FFC1F65C5}) (Version: 16.0.0.1344 - Kaspersky Lab)

Kaspersky Security Scan (Version: 16.0.0.1344 - Kaspersky Lab) Hidden

Kaspersky Software Updater Beta (HKLM\…\InstallWIX_{94C8D443-1D07-4E6D-A9EB-FDBA45A839D8}) (Version: 1.5.2.228 - Kaspersky Lab)

Kaspersky Software Updater Beta (Version: 1.5.2.228 - Kaspersky Lab) Hidden

Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

McAfee Security Scan Plus (HKLM\…\McAfee Security Scan) (Version: 3.11.292.3 - McAfee, Inc.)

Microsoft .NET Framework 4.5.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (HKLM\…\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50709.0 - Microsoft Corporation)

Microsoft Visual Basic 6.0 Professional Edition (HKLM\…\Visual Basic 6.0 Professional Edition) (Version: - )

Microsoft Visual C++ 2005 Redistributable (HKLM\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Web Publishing Wizard 1.53 (HKLM\…\WebPost) (Version: - )

Mozilla Firefox 53.0.2 (x86 en-US) (HKLM\…\Mozilla Firefox 53.0.2 (x86 en-US)) (Version: 53.0.2 - Mozilla)

Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 53.0.2 - Mozilla)

mydlink services plugin (HKLM\…\{1A9B665A-5F27-4F71-BF90-22FDFE7A1635}) (Version: 1.0.2.7 - D-Link Corporation)

Nero 9 (HKLM\…\{8d2871f6-e558-40bf-81ec-6808343d09bf}) (Version: - Nero AG)

PicosmosTools 1.5.1.0 (HKLM\…\PicosmosTools) (Version: 1.5.1.0 - Free Time)

Program4Pc DJ Music Mixer (HKLM\…\{8C6B8ECF-C649-46D9-A8ED-5BE2921F9ECD}) (Version: 5.5 - Program4Pc Inc.)

Realtek High Definition Audio Driver (HKLM\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5653 - Realtek Semiconductor Corp.)

RKLauncher 0.43 Custom (HKLM\…\{40636246-26E3-4471-894D-B3940117ED36}_is1) (Version: - ArG, Inc.)

SafeZone Stable 3.55.2393.596 (Version: 3.55.2393.596 - Avast Software) Hidden

SketchUp 2016 (HKLM\…\{F8F51164-606F-45A2-B706-10B0329BF740}) (Version: 16.1.1450 - Trimble Navigation Limited)

Skype™ 4.1 (HKLM\…\{5C474A83-A45F-470C-9AC8-2BD1C251BF9A}) (Version: 4.1.141 - Skype Technologies S.A.)

SMART BRO (HKLM\…\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.1 - ZTE)

Spybot - Search & Destroy (HKLM\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

VLC media player 1.0.3 (HKLM\…\VLC media player) (Version: 1.0.3 - VideoLAN Team)

Vuze (HKLM\…\8461-7759-5462-8226) (Version: 5.7.3.0 - Azureus Software, Inc.)

WinRAR archiver (HKLM\…\WinRAR archiver) (Version: - )

Yahoo! Messenger (HKLM\…\Yahoo! Messenger) (Version: - Yahoo! Inc.)

Y'z Dock 1.01 (HKLM\…\{B96F3609-1472-45CF-93FD-54743FD9FB61}_is1) (Version: - ArG, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3559194677-4052321422-2392058216-1000_Classes\CLSID\{202B524F-841E-5A9D-8D3F-1010FA1A469E}\InprocServer32 -> C:\Users\Adadu\AppData\Roaming\D-Link\mydlink services plugin\1.0.2.7\npUplayer.dll (D-Link Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0E19EEA5-6B79-4005-9A54-47DC5DA19D2A} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-04-05] (AVAST Software)

Task: {0F851277-EB24-46C6-83FD-0965D17D37F3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-06-13] (Google Inc.)

Task: {1DA838E3-584D-420C-A093-D2B38A2EEEB0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)

Task: {2375F586-1009-41FB-B54E-30D8AF2B781D} - System32\Tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary => %ProgramFiles%\Windows Media Player\wmpnscfg.exe

Task: {25DF2E2B-9DED-4F27-8F8B-B9F9F4C55861} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\system32\Macromed\Flash\FlashUtil32_25_0_0_148_pepper.exe [2017-04-13] (Adobe Systems Incorporated)

Task: {4DFA292C-7CE9-4EB6-8CCC-CA58531187C3} - System32\Tasks\{4B6191D7-2F13-490E-BC8D-22FA730F99A9} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver;=7.18.0.112&LastError;=12002

Task: {9310174F-7D9A-44DD-8FC8-24DF051F0663} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-05-18] (Dropbox, Inc.)

Task: {B2210200-6478-40EE-9C9B-BE78008EE12C} - System32\Tasks\{EA3CB214-0F14-4B6A-8444-7AA5A289BE26} => Firefox.exe hxxp://ui.skype.com/ui/0/7.18.0.112/en/abandoninstall?source=lightinstaller&page;=tsInstall

Task: {C38C8589-53D3-421B-A827-D58DF72471AE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)

Task: {CE708020-5C4A-4FD9-9F85-7A901AA58248} - System32\Tasks\SafeZone scheduled Autoupdate 1459994645 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-03-22] (Avast Software)

Task: {D9BC0A1A-2CE5-4CC3-A444-1B088E1E4C06} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-06-13] (Google Inc.)

Task: {DD729E4E-C834-4317-9B35-8926144928AD} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)

Task: {E453FEA1-4524-4504-8DEC-52A9A21BB1B9} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-05-18] (Dropbox, Inc.)

Task: {E4CDD6DC-DCE2-422B-8149-BF0866EF9810} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-04-13] (AVAST Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Adadu\Music\My Web Sites on MSN\target.lnk -> hxxp://www.msnusers.co

==================== Loaded Modules (Whitelisted) ==============

2017-04-05 09:07 - 2017-04-05 09:07 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

2017-04-05 09:07 - 2017-04-05 09:07 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll

2017-04-05 09:07 - 2017-04-05 09:07 - 00653520 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll

2017-04-05 09:07 - 2017-04-05 09:07 - 00230632 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll

2017-05-07 18:08 - 2017-05-07 18:08 - 05926912 _____ () C:\Program Files\AVAST Software\Avast\defs\17050700\algo.dll

2015-12-15 13:38 - 2015-12-15 13:38 - 00326112 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\dblite.dll

2015-10-27 16:44 - 2015-10-27 16:44 - 00404952 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\ipm_service.dll

2016-04-01 09:07 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2016-04-01 09:07 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl

2016-04-01 09:07 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2016-04-01 09:07 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll

2016-04-01 09:07 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2014-12-12 10:09 - 2011-01-24 20:29 - 00253264 _____ () C:\Program Files\SMART BRO\AssistantServices.exe

2017-04-05 09:06 - 2017-04-05 09:06 - 00134920 _____ () c:\Program Files\AVAST Software\Avast\vaarclient.dll

2017-04-05 09:07 - 2017-04-05 09:07 - 00230632 _____ () c:\Program Files\AVAST Software\Avast\StreamBack.dll

2014-12-12 10:09 - 2011-04-02 10:44 - 00139088 _____ () C:\Program Files\SMART BRO\UIExec.exe

2017-05-03 08:39 - 2017-05-01 22:44 - 00870720 _____ () C:\Program Files\Dropbox\Client\dropbox_watchdog.dll

2017-04-27 13:48 - 2017-04-13 07:43 - 00035792 _____ () C:\Program Files\Dropbox\Client\_multiprocessing.pyd

2017-04-27 13:48 - 2017-04-13 07:43 - 00100296 _____ () C:\Program Files\Dropbox\Client\_ctypes.pyd

2017-04-27 13:48 - 2017-04-13 07:43 - 00018888 _____ () C:\Program Files\Dropbox\Client\select.pyd

2017-04-27 13:48 - 2017-05-01 22:48 - 00019776 _____ () C:\Program Files\Dropbox\Client\tornado.speedups.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00020824 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd

2017-04-27 13:48 - 2017-04-13 07:44 - 00123856 _____ () C:\Program Files\Dropbox\Client\_cffi_backend.pyd

2017-04-27 13:48 - 2017-04-13 07:43 - 00694224 _____ () C:\Program Files\Dropbox\Client\unicodedata.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 01729360 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00020816 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd

2017-05-03 08:39 - 2017-04-13 07:43 - 00145864 _____ () C:\Program Files\Dropbox\Client\pyexpat.pyd

2017-05-03 08:39 - 2017-04-13 07:44 - 00019408 _____ () C:\Program Files\Dropbox\Client\faulthandler.pyd

2017-05-03 08:39 - 2017-04-13 07:43 - 00116688 _____ () C:\Program Files\Dropbox\Client\pywintypes27.dll

2017-04-27 13:48 - 2017-04-13 07:46 - 00105928 _____ () C:\Program Files\Dropbox\Client\win32api.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00022864 _____ () C:\Program Files\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00060736 _____ () C:\Program Files\Dropbox\Client\psutil._psutil_windows.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00038712 _____ () C:\Program Files\Dropbox\Client\fastpath.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00024528 _____ () C:\Program Files\Dropbox\Client\win32event.pyd

2017-05-03 08:39 - 2017-04-13 07:43 - 00392656 _____ () C:\Program Files\Dropbox\Client\pythoncom27.dll

2017-05-03 08:39 - 2017-04-13 07:46 - 00020936 _____ () C:\Program Files\Dropbox\Client\mmapfile.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00116176 _____ () C:\Program Files\Dropbox\Client\win32security.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00392512 _____ () C:\Program Files\Dropbox\Client\win32com.shell.shell.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00124880 _____ () C:\Program Files\Dropbox\Client\win32file.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00026456 _____ () C:\Program Files\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32clipboard.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00175560 _____ () C:\Program Files\Dropbox\Client\win32gui.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00030160 _____ () C:\Program Files\Dropbox\Client\win32pipe.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00043472 _____ () C:\Program Files\Dropbox\Client\win32process.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00048592 _____ () C:\Program Files\Dropbox\Client\win32service.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00057808 _____ () C:\Program Files\Dropbox\Client\win32evtlog.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32profile.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00246608 _____ () C:\Program Files\Dropbox\Client\breakpad.client.windows.handler.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00027488 _____ () C:\Program Files\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd

2017-04-27 13:48 - 2017-04-13 07:45 - 00241104 _____ () C:\Program Files\Dropbox\Client\_jpegtran.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00022336 _____ () C:\Program Files\Dropbox\Client\cpuid.compiled._cpuid.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00025432 _____ () C:\Program Files\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00028616 _____ () C:\Program Files\Dropbox\Client\win32ts.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 01826104 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtCore.pyd

2017-04-27 13:48 - 2017-04-13 07:44 - 00083912 _____ () C:\Program Files\Dropbox\Client\sip.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 01972024 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtGui.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 03928896 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWidgets.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00171336 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00042816 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebChannel.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00531264 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtNetwork.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00133432 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKit.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00224064 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00207680 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtPrintSupport.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00060880 _____ () C:\Program Files\Dropbox\Client\win32print.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00054608 _____ () C:\Program Files\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00022864 _____ () C:\Program Files\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00022872 _____ () C:\Program Files\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00021848 _____ () C:\Program Files\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00022872 _____ () C:\Program Files\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd

2017-04-27 13:48 - 2017-04-13 07:46 - 00349128 _____ () C:\Program Files\Dropbox\Client\winxpgui.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00023896 _____ () C:\Program Files\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00025936 _____ () C:\Program Files\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd

2017-05-03 08:39 - 2017-04-13 07:37 - 00036296 _____ () C:\Program Files\Dropbox\Client\librsync.dll

2017-05-03 08:39 - 2017-05-01 22:48 - 00084288 _____ () C:\Program Files\Dropbox\Client\dropbox_sqlite_ext.DLL

2017-04-27 13:48 - 2017-05-01 22:49 - 00030536 _____ () C:\Program Files\Dropbox\Client\wind3d11.compiled._wind3d11.pyd

2017-05-03 08:39 - 2017-04-13 07:50 - 00017864 _____ () C:\Program Files\Dropbox\Client\libEGL.dll

2017-05-03 08:39 - 2017-04-13 07:50 - 01631184 _____ () C:\Program Files\Dropbox\Client\libGLESv2.dll

2017-05-03 08:39 - 2017-05-01 22:48 - 00357688 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQml.pyd

2017-04-27 13:48 - 2017-05-01 22:49 - 00026456 _____ () C:\Program Files\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd

2017-05-03 08:39 - 2017-05-01 22:48 - 00546104 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQuick.pyd

2016-08-02 08:23 - 2016-08-02 08:23 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2017-04-05 09:06 - 2017-04-05 09:06 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll

2016-05-10 21:33 - 2016-05-10 21:33 - 03187712 _____ () C:\Program Files\PicosmosTools\FFImage.dll

2016-06-02 18:06 - 2016-06-02 18:06 - 45077376 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\libcef.dll

2016-06-02 18:06 - 2016-06-02 18:06 - 01650560 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\libglesv2.dll

2016-06-02 18:06 - 2016-06-02 18:06 - 00082304 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Security Scan\libegl.dll

2017-05-04 08:19 - 2017-05-02 08:12 - 02864984 _____ () C:\Program Files\Google\Chrome\Application\58.0.3029.96\libglesv2.dll

2017-05-04 08:19 - 2017-05-02 08:12 - 00087384 _____ () C:\Program Files\Google\Chrome\Application\58.0.3029.96\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 10:04 - 2016-02-23 09:53 - 00000858 _____ C:\Windows\system32\Drivers\etc\hosts

0.0.0.1 mssplus.mcafee.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Adadu\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.254.254

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 0) (EnableLUA: 0)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RKLauncher.lnk => C:\Windows\pss\RKLauncher.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Y'z Dock.lnk => C:\Windows\pss\Y'z Dock.lnk.CommonStartup

MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe

MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe

MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe

MSCONFIG\startupreg: RtHDVCpl => RtHDVCpl.exe

MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{4B2807DB-1DF1-4BAA-96A5-DC2EAED24D24}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{D9C3FBAD-7CDD-400E-8965-754B24CEF9D6}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{0A554C7A-9475-4C33-875F-CCC7635A253D}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{24B9BAF7-AD86-4D8F-B113-5E28E087B653}C:\users\adadu\desktop\warcraft iii\war3.exe] => (Block) C:\users\adadu\desktop\warcraft iii\war3.exe

FirewallRules: [UDP Query User{CA626E8D-4878-48CB-941E-FB15D120AE83}C:\users\adadu\desktop\warcraft iii\war3.exe] => (Block) C:\users\adadu\desktop\warcraft iii\war3.exe

FirewallRules: [{B5AFE642-E302-4C1C-909D-D180CED95C8F}] => (Allow) C:\Program Files\Vuze\Azureus.exe

FirewallRules: [{0F2350B0-17E8-4050-A230-FF297DF7CD58}] => (Allow) C:\Program Files\Vuze\Azureus.exe

FirewallRules: [TCP Query User{06454344-5098-4587-AD60-8951019278DA}C:\program files\hearthstone\hearthstone.exe] => (Allow) C:\program files\hearthstone\hearthstone.exe

FirewallRules: [UDP Query User{858A25EE-52CC-461C-97A8-4552C54AE1AE}C:\program files\hearthstone\hearthstone.exe] => (Allow) C:\program files\hearthstone\hearthstone.exe

FirewallRules: [{DB625FA1-7C1B-49D7-864A-5A40369E3D21}] => (Block) C:\program files\hearthstone\hearthstone.exe

FirewallRules: [{13CC22F4-031B-4A21-8C97-B347D8251324}] => (Block) C:\program files\hearthstone\hearthstone.exe

FirewallRules: [{A718FEF9-AF6F-4E42-87DB-BB56E34C185F}] => (Allow) C:\Program Files\StarCraft II\Versions\Base42932\SC2.exe

FirewallRules: [{E53BB3C2-AB27-4535-B4DE-837045A226D1}] => (Allow) C:\Program Files\StarCraft II\Versions\Base42932\SC2.exe

FirewallRules: [TCP Query User{07B86830-B7DB-4F31-848A-DCACA54DCD29}C:\users\adadu\downloads\ffinstonline.exe] => (Allow) C:\users\adadu\downloads\ffinstonline.exe

FirewallRules: [UDP Query User{90470C2F-374E-4CC2-B99D-2C538ACBC796}C:\users\adadu\downloads\ffinstonline.exe] => (Allow) C:\users\adadu\downloads\ffinstonline.exe

FirewallRules: [{C1C49A3E-CC4A-4243-825B-A58E06A25D99}] => (Allow) C:\Program Files\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe

FirewallRules: [{C0BBD4CA-EFA4-4741-A16E-454B58A78B3D}] => (Allow) C:\Program Files\FormatFactory\FormatFactory.exe

FirewallRules: [{2F403EF9-F233-4A4D-8842-95FAFD213FB7}] => (Allow) C:\Program Files\FormatFactory\FormatFactory.exe

FirewallRules: [{903945E7-75D4-44FE-84E3-5553E5D0F9E1}] => (Allow) C:\Program Files\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe

FirewallRules: [{44B7A1B7-8FCF-434A-AF7C-CE1BD8BF5E1F}] => (Allow) C:\Program Files\FormatFactory\FFModules\Package\PTInstOnline.exe

FirewallRules: [{9D631472-457A-4455-9F36-FD51B4F7F0D1}] => (Allow) C:\Program Files\PicosmosTools\PTInstOnline.exe

FirewallRules: [{05461AC3-14FD-40CD-81C4-62F0447A9952}] => (Allow) C:\Program Files\Heroes of the Storm\Versions\Base44941\HeroesOfTheStorm.exe

FirewallRules: [{2D5C72E9-B14F-408E-AA5D-C34194BB8B61}] => (Allow) C:\Program Files\Heroes of the Storm\Versions\Base44941\HeroesOfTheStorm.exe

FirewallRules: [TCP Query User{8998D199-3775-4E1C-BA3D-843D1C85A82F}C:\program files\orbitdownloader\orbitnet.exe] => (Allow) C:\program files\orbitdownloader\orbitnet.exe

FirewallRules: [UDP Query User{3B2E8535-B7BF-4DC9-B842-74824ACF8780}C:\program files\orbitdownloader\orbitnet.exe] => (Allow) C:\program files\orbitdownloader\orbitnet.exe

FirewallRules: [{1787E0F3-D5FF-41FE-B6D6-81DB782D63B4}] => (Allow) C:\Program Files\Steam\Steam.exe

FirewallRules: [{C7946221-F165-4041-BDBD-569A905E7D4D}] => (Allow) C:\Program Files\Steam\Steam.exe

FirewallRules: [{710314D9-F782-4839-9DDE-42E6A3B81AC0}] => (Allow) C:\Program Files\Steam\steamapps\common\Magic Duels\MagicDuels.exe

FirewallRules: [{8B04FD0F-099F-490B-87D3-0986A4A3E2B2}] => (Allow) C:\Program Files\Steam\steamapps\common\Magic Duels\MagicDuels.exe

FirewallRules: [{FF5961CE-A6BA-4AC2-9B76-8D2A2565E546}] => (Allow) C:\Program Files\StarCraft II\Versions\Base47185\SC2.exe

FirewallRules: [{EF90C1DA-E8AF-4928-BE2F-3E3E68FA546C}] => (Allow) C:\Program Files\StarCraft II\Versions\Base47185\SC2.exe

FirewallRules: [TCP Query User{AF98FF35-6D97-4461-B48F-15A5226AB522}C:\users\adadu\desktop\warcraft iii\war3.exe] => (Block) C:\users\adadu\desktop\warcraft iii\war3.exe

FirewallRules: [UDP Query User{7C8B80F6-8B64-4242-AA57-B19A31BF1020}C:\users\adadu\desktop\warcraft iii\war3.exe] => (Block) C:\users\adadu\desktop\warcraft iii\war3.exe

FirewallRules: [TCP Query User{0FA03801-4C72-40DB-90D8-9773B7216718}C:\program files\vuze\azureus.exe] => (Allow) C:\program files\vuze\azureus.exe

FirewallRules: [UDP Query User{6F55D5C7-F98E-4EB5-B7FD-EAF4E852AEC8}C:\program files\vuze\azureus.exe] => (Allow) C:\program files\vuze\azureus.exe

FirewallRules: [{44F51154-52B4-4B01-A18D-FDFC78BF6236}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

FirewallRules: [{EA3D64D3-9C24-4682-A6C9-00304BDE85CD}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.590\SZBrowser.exe

FirewallRules: [{60EB0218-45C8-420A-B447-FD325706CD75}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.596\SZBrowser.exe

FirewallRules: [{7B74D2C0-48CD-4402-B202-7387D5042A30}] => (Allow) C:\Program Files\Dropbox\Client\Dropbox.exe

FirewallRules: [{4DD0A9E7-D40B-47D2-8501-6EC0FDED683B}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

FirewallRules: [{177C4F3F-3335-4DB3-BB23-FB35405ECD67}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

FirewallRules: [{18B97B2F-8DF3-4EAF-860E-E9250EE6D01A}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access

StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service

StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater

StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service

StandardProfile\AuthorizedApplications: [C:\Program Files\Orbitdownloader\orbitdm.exe] => Enabled:Orbit

StandardProfile\AuthorizedApplications: [C:\Program Files\Orbitdownloader\orbitnet.exe] => Enabled:Orbit

==================== Restore Points =========================

==================== Faulty Device Manager Devices =============

Name:

Description:

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:

Description:

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Base System Device

Description: Base System Device

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Could not start eventlog service, could not read events.

The Windows Event Log service is starting.

The Windows Event Log service could not be started.

A system error has occurred.

The system cannot find message text for message number 0x1069 in the message file for (null).

More help is available by typing NET HELPMSG 4201.

==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz

Percentage of memory in use: 67%

Total physical RAM: 2911.04 MB

Available physical RAM: 959.56 MB

Total Virtual: 5818.29 MB

Available Virtual: 3608.4 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:15.78 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C706724C)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Juliet

Post #2May 8, 2017, 8:00 PM UTC

1- Please double-click on FRST/FRST64

2- Press Ctrl+y (Ctrl and y keys at the same time)

3- A fixlist.txt file opens up, copy and paste the following into it:

Start::
CreateRestorePoint:
CloseProcesses:
ShortcutTarget: Orbit.lnk -> C:\Program Files\Orbitdownloader\orbitdm.exe (No File)
FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [No File]
FF Plugin HKU\S-1-5-21-3559194677-4052321422-2392058216-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Adadu\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [No File]
U3 annkckj9; C:\Windows\system32\Drivers\annkckj9.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
C:\Windows\system32\Drivers\annkckj9.sys
2017-04-15 20:55 - 2017-04-15 20:55 - 0056890 _____ () C:\Users\Adadu\AppData\Local\Temp\{1D7E82CF-85F9-43FF-85FC-1665C837A98B}-DropboxClient_23.4.19.exe
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
Hosts:
End::

press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~

[external image: BY4dvz9.png]AdwCleaner

Please download AdwCleaner and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
Follow the prompts.
Click [external image: A49sxPr.png]Scan.
Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click [external image: MqHawIb.png]Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.
– File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~
Zemana AntiMalware Free download it from here:

Double-click on the file named Zemana.AntiMalware.Portable to perform a system scan with Zemana AntiMalware Free.

You may be presented with a User Account Control dialog asking you if you want to run this program. If this happens, you should click Yes to allow Zemana AntiMalware to run.
When Zemana AntiMalware starts, click on the Scan button to perform a system scan.
without changing any options, press Scan

When Zemana has finished finished scanning it will show a screen that displays any malware that has been detected. To remove all the malicious files, click on the Next button.

Zemana AntiMalware will now start to remove all the malicious programs from your computer.

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
open Zemana AntiMalware again and locate the latest report
please paste the contents into your reply
When the process is complete, you can close Zemana AntiMalware

please post
Fixlog.txt
AdwCleaner[C1].txt
Zemana AntiMalware log

Juliet

Post #3May 10, 2017, 7:32 PM UTC

still need help?

xxxerotech

Post #4May 11, 2017, 3:10 AM UTC

Yes, please, I do. Let me get back to you after I finish your instructions. Sorry for the late reply.

xxxerotech

Post #5May 11, 2017, 4:21 AM UTC

Here are the logs. I think ZEMANA did it. It detected 4 threats and I had it cleaned.

AdwCleaner[C1].txt

# AdwCleaner v6.046 - Logfile created 11/05/2017 at 12:00:17

# Updated on 24/04/2017 by Malwarebytes

# Database : 2017-05-10.1 [Local]

# Operating System : Windows 7 Ultimate (X86)

# Username : Adadu - ADADU-PC

# Running from : C:\Users\Adadu\Downloads\adwcleaner_6.046.exe

# Mode: Scan

# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious keys found.

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Web browsers ] *****

No malicious Firefox based browser items found.

No malicious Chromium based browser items found.

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [3986 Bytes] - [26/11/2016 16:21:54]

C:\AdwCleaner\AdwCleaner[S1].txt - [781 Bytes] - [03/07/2016 11:55:35]

C:\AdwCleaner\AdwCleaner[S2].txt - [4060 Bytes] - [26/11/2016 16:07:37]

C:\AdwCleaner\AdwCleaner[S3].txt - [1363 Bytes] - [11/05/2017 11:23:07]

C:\AdwCleaner\AdwCleaner[S4].txt - [1285 Bytes] - [11/05/2017 12:00:17]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1358 Bytes] ##########

Fixlog.txt

Fix result of Farbar Recovery Scan Tool (x86) Version: 08-05-2017

Ran by [removed] (11-05-2017 11:02:19) Run:4

Running from C:\Users\[removed]\Desktop

[removed]

Boot Mode: Normal

==============================================

fixlist content:

*****************

CreateRestorePoint:

CloseProcesses:

ShortcutTarget: Orbit.lnk -> C:\Program Files\Orbitdownloader\orbitdm.exe (No File)

FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [No File]

FF Plugin HKU\S-1-5-21-3559194677-4052321422-2392058216-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Adadu\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [No File]

U3 annkckj9; C:\Windows\system32\Drivers\annkckj9.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)

C:\Windows\system32\Drivers\annkckj9.sys

2017-04-15 20:55 - 2017-04-15 20:55 - 0056890 _____ () C:\Users\Adadu\AppData\Local\Temp\{1D7E82CF-85F9-43FF-85FC-1665C837A98B}-DropboxClient_23.4.19.exe

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]

CMD: ipconfig /flushdns

CMD: netsh winsock reset all

CMD: netsh int ipv4 reset

CMD: netsh int ipv6 reset

EmptyTemp:

Hosts:

*****************

Restore point was successfully created.

Processes closed successfully.

C:\Program Files\Orbitdownloader\orbitdm.exe => not found.

HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 => key removed successfully.

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0 => key removed successfully.

C:\Users\Adadu\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll => not found.

annkckj9 => service not found.

"C:\Windows\system32\Drivers\annkckj9.sys" => not found.

C:\Users\Adadu\AppData\Local\Temp\{1D7E82CF-85F9-43FF-85FC-1665C837A98B}-DropboxClient_23.4.19.exe => moved successfully

C:\ProgramData\Reprise => ":wupeogjxldtlfudivq`qsp`27hfm" ADS removed successfully..

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= netsh winsock reset all =========

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= netsh int ipv4 reset =========

Reseting Global, OK!

Reseting Interface, OK!

Restart the computer to complete this action.

========= End of CMD: =========

========= netsh int ipv6 reset =========

There's no user specified settings to be reset.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully

Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B

DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 43809843 B

Java, Flash, Steam htmlcache => 506 B

Windows/system/drivers => 20156310 B

Edge => 0 B

Chrome => 557490203 B

Firefox => 0 B

Opera => 0 B

Temp, IE cache, history, cookies, recent:

Users => 0 B

Default => 0 B

Public => 0 B

ProgramData => 0 B

systemprofile => 692 B

LocalService => 0 B

NetworkService => 0 B

Adadu => 692621405 B

RecycleBin => 13611246013 B

EmptyTemp: => 13.9 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 11:03:26 ====

Zemana AntiMalware log

Zemana AntiMalware 2.72.2.388 (Installed)

——————————————————-

Scan Result : Completed

Scan Date : 2017/5/11

Operating System : Windows 7 32-bit

Processor : 2X Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz

BIOS Mode : Legacy

CUID : 126EC24FFA44D682E1AC85

Scan Type : System Scan

Duration : 10m 14s

Scanned Objects : 47711

Detected Objects : 4

Excluded Objects : 0

Read Level : SCSI

Auto Upload : Enabled

Detect All Extensions : Disabled

Scan Documents : Disabled

Domain Info : WORKGROUP,0,2

Detected Objects

——————————————————-

[removed]

Status : Scanned

Object : %appdata%\mozilla\firefox\profiles\9sdpg9pi.default-1450624626215\extensions\[removed]

MD5 : F4D84EDE07FC20A22993292E221B9B55

Publisher : -

Size : 692271

Version : -

Detection : PUA.FirefoxExt!Gr

Cleaning Action : Repair

Related Objects :

Browser Extension - [removed]

File - %appdata%\mozilla\firefox\profiles\9sdpg9pi.default-1450624626215\extensions\[removed]

FFSetup3.9.0.0.exe

Status : Scanned

Object : %userprofile%\downloads\ffsetup3.9.0.0.exe

MD5 : EBD3DBEF6D659EE1206394F708307231

Publisher : chen jun hao

Size : 162304

Version : 3.9.0.0

Detection : PUA:Win32/FormatFactory!Ep

Cleaning Action : Quarantine

Related Objects :

File - %userprofile%\downloads\ffsetup3.9.0.0.exe

{4b6191d7-2f13-490e-bc8d-22fa730f99a9}

Status : Scanned

Object : NE->c:\windows\system32\tasks\{4b6191d7-2f13-490e-bc8d-22fa730f99a9}

MD5 : -

Publisher : -

Size : -

Version : -

Detection : Adware:Win32/FF.TASKSCHD.GEN.A!Neng

Cleaning Action : Quarantine

Related Objects :

(null) - (null)

{ea3cb214-0f14-4b6a-8444-7aa5a289be26}

Status : Scanned

Object : NE->c:\windows\system32\tasks\{ea3cb214-0f14-4b6a-8444-7aa5a289be26}

MD5 : -

Publisher : -

Size : -

Version : -

Detection : Adware:Win32/FF.TASKSCHD.GEN.A!Neng

Cleaning Action : Quarantine

Related Objects :

(null) - (null)

Cleaning Result

——————————————————-

Cleaned : 4

Reported as safe : 0

Failed : 0

Juliet

Post #6May 11, 2017, 9:25 AM UTC

Download Emsisoft Emergency Kit and save it to your desktop.
Double-click icon then click Install
A Window should open highlighting Start Emergency Kit Scanner
Right click on the icon and select Run as administrator
Click 1. Update now!
Once the update is completed select Settings under Scan
Uncheck Join the Emsisoft Anti-Malware Network
Click Scan at the top
Click On scan completion
Click Quarantine detected objects, then click OK
Click Malware Scan
Once completed click View Report
Save the file to your Desktop using the default file name
Copy and paste the report in your reply

=============

How is the computer now?

xxxerotech

Post #7May 13, 2017, 8:42 AM UTC

Hi. I did the scan. It didn't detect anything. I still can't open my Firefox browser.

Emsisoft Emergency Kit - Version 2017.4

Last update: 5/13/2017 3:48:09 PM

User account: ADADU-PC\Adadu

Computer name: ADADU-PC

OS version: Windows 7x86

Scan settings:

Scan type: Custom Scan

Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: Off

Scan archives: On

ADS Scan: On

File extension filter: Off

Direct disk access: Off

Scan start: 5/13/2017 3:54:27 PM

Scanned 148760

Found 0

Scan end: 5/13/2017 4:28:23 PM

Scan time: 0:33:56

Juliet

Post #8May 13, 2017, 10:41 AM UTC

I think some files needed to use Firefox are corrupt so let's try to save data and refresh.

Instructions on how to backup your Favourites/Bookmarks and other data can be found below.
Backup Firefox Bookmarks

Proceed with the reset once done.
Reset Firefox

~~~
Firefox does not work - Common fixes to get you back up and running/Firefox won't start
https://support.mozilla.org/en-US/kb/firefox-does-not-work-common-fixes

Let me know if anything listed above has helped.

xxxerotech

Post #9May 14, 2017, 11:28 AM UTC

Sorry. None of it work as it needs the Firefox browser. I can only use Google Chrome browser right now. I have Firefox installed but it just won't open the browser. That's why I suspect there's still some kind of infection lurking in my laptop even if nothing is being detected by the malware/adware/virus removal software that we've run so far.

Juliet

Post #10May 14, 2017, 12:17 PM UTC

I personally don't think it's malware, most cases it would have an influence on the other browsers too.

Strangely it's not listed in the Additions logs as being in your add/remove programs list.

And just picked up on this is a MAC machine.(My first attempt to working on a Mac system)
~~~
You might still have an icon for Firefox?

Have you tried booting into safe mode, try starting the browser from there?

I think we're going to have to remove everything related to Firefox and attempt to download and install again.
*************
Try booting into safe mode, try finding and starting Firefox…please let me know what happens.

Use safe mode to isolate issues
https://support.apple.com/en-us/HT201262

xxxerotech

Post #11May 14, 2017, 12:31 PM UTC

I have a Firefox icon on my desktop. It's just when I click it, the browser won't load. I also tried opening Firefox from the program file using Safe Mode, but it didn't load either.

Wow! This is a Mac machine?! That is strange. My sister got it for me. It's Sony Vaio. It seems legit. The sticker says Windows Vista and Intel Centrino.

I also clicked on the link you provide under "Use safe mode to isolate issues" and it took me to this website instead: http://www.viglink.com/shop/merchants.

Alright. I'll go ahead and try boot my laptop into safe mode first.

Juliet

Post #12May 14, 2017, 12:37 PM UTC last edited May 14, 2017, 12:40 PM UTC

don't know why that link redirected
/support.apple.com/en-us/HT201262 thats what it should had been

this is from the FRST scan
[removed]

xxxerotech

Post #13May 14, 2017, 12:40 PM UTC

I've booted in Safe Mode with Networking, and I was able to load Firefox. Doing so fixed the problem I have before which made me think my laptop is infected. My desktop icons are showing up. It's no longer a black square.

I feel stupid for asking this, but do I need to start my laptop in safe mode from now on? Thanks!

Juliet

Post #14May 14, 2017, 12:52 PM UTC

Got to be a fix somewhere.

couple of things we can do, I think.

Try to temporarily disable Avast

Right click on the Avast icon in the system tray
Scroll up to Avast! shields control
Select the desired option from the list

10 minutes,
1 hour,
until the computer is restarted or
permanently.

Reverse to enable.
or
right click avast tray icon and pause shields.

Now, try starting Firefox?

~~~~~
Next
Open Firefox and check for updates to the most current version?
or
would be to remove/delete the version you have now, then redownload and maybe create new rules with Avast if thats the problem.

xxxerotech

Post #15May 14, 2017, 12:52 PM UTC

I also tried this link: /support.apple.com/en-us/HT201262, it still redirects me to this link: http://www.viglink.com/shop/merchants. There must be something else lurking in this laptop that can't be detected.

Darn it. I'm not sure where my sister got this laptop. I also saw Micro$hit MacOS X 7 Ultimate when I checked the profile before. I just didn't pay attention to it, 'cos I thought my sister messed around with it and just renamed it or something.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Infection Removal Needed [Solved]

✨ Ask AI

Ask AI