This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Remove Reimage PC Repair Online [Solved]

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Sorry about my english , i was looking  the driver of my old web cam  silvercrest  and probably i downloaded  wrong file , malwarebyte e AD Cleaner  now  says I am clean but when i use Chrome  to open  aby site often  start  reimage Repair  and often open Yahoo search . I read  how to open e new topic and I can paste  log text  :

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-07-25 09:40:57
—————————–
09:40:57.473    OS Version: Windows x64 6.1.7601 Service Pack 1
09:40:57.473    Number of processors: 2 586 0x4303
09:40:57.474    ComputerName: MULETTO-PC  UserName: Muletto
09:40:57.583    Initialize success
09:40:57.595    VM: initialized successfully
09:40:57.596    VM: Amd CPU virtualization not supported 
09:41:05.193    AVAST engine defs: 17072408
09:41:29.988    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
09:41:29.988    Disk 0 Vendor: Samsung_SSD_840_Series DXT08B0Q Size: 114473MB BusType: 3
09:41:29.988    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-5
09:41:29.988    Disk 1 Vendor: TOSHIBA_DT01ACA100 MS2OA750 Size: 953869MB BusType: 3
09:41:29.998    Disk 2  \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP1T0L0-2
09:41:29.998    Disk 2 Vendor: ST3000DM001-1CH166 CC27 Size: 2861588MB BusType: 3
09:41:29.998    Disk 3  \Device\Harddisk3\DR3 -> \Device\00000063
09:41:30.008    Disk 3 Vendor: AVD  Size: 764434MB BusType: 1
09:41:30.018    Disk 0 MBR read successfully
09:41:30.018    Disk 0 MBR scan
09:41:30.028    Disk 0 Windows 7 default MBR code
09:41:30.028    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        72237 MB offset 63
09:41:30.038    Disk 0 Boot: NTFS     code=2
09:41:30.048    Disk 0 Partition - 00     0F Extended LBA             42233 MB offset 147942585
09:41:30.048    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        42233 MB offset 147942648
09:41:30.068    Disk 0 scanning C:\Windows\system32\drivers
09:41:36.306    Service scanning
09:41:47.503    Modules scanning
09:41:47.503    Disk 0 trace - called modules:
09:41:47.513    ntoskrnl.exe CLASSPNP.SYS disk.sys vidsflt.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 
09:41:47.523    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8001d0a790]
09:41:47.523    3 CLASSPNP.SYS[fffff8800197743f] -> nt!IofCallDriver -> [0xfffffa8001d09e00]
09:41:47.533    5 vidsflt.sys[fffff88000f5c5f1] -> nt!IofCallDriver -> [0xfffffa8001cdc040]
09:41:47.544    7 ACPI.sys[fffff88000eb27a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8001cd1060]
09:41:47.635    AVAST engine scan C:\Windows
09:41:48.205    AVAST engine scan C:\Windows\system32
09:43:17.716    AVAST engine scan C:\Windows\system32\drivers
09:43:26.162    AVAST engine scan C:\Users\Muletto
09:45:17.854    AVAST engine scan C:\ProgramData
09:45:40.664    Disk 0 statistics 3628942/0/0 @ 14,65 MB/s
09:45:40.674    Scan finished successfully
10:18:54.605    Disk 0 MBR has been saved successfully to "C:\Users\Muletto\Desktop\MBR.dat"
10:18:54.605    The log file has been saved successfully to "C:\Users\Muletto\Desktop\aswMBR.txt"
 
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-07-2017
Ran by [removed] (25-07-2017 10:22:06)
Running from C:\Users\[removed]\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2015-08-11 07:25:12)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-365969078-1895578363-2955812647-500 - Administrator - Disabled) => C:\Users\Administrator
Guest (S-1-5-21-365969078-1895578363-2955812647-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-365969078-1895578363-2955812647-1009 - Limited - Enabled)
Muletto (S-1-5-21-365969078-1895578363-2955812647-1001 - Administrator - Enabled) => C:\Users\Muletto
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
7-Zip 16.04 (x64) (HKLM\…\7-Zip) (Version: 16.04 - Igor Pavlov)
AMD Catalyst Install Manager (HKLM\…\{37FCE154-7F59-74F0-3A35-BF503CEB230B}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
Avast Free Antivirus (HKLM-x32\…\Avast Antivirus) (Version: 17.5.2303 - AVAST Software)
Avidemux 2.6 - 64 bits (HKLM-x32\…\Avidemux 2.6 - 64 bits (64-bit)) (Version: 2.6.15.161119 - )
AVS Audio Converter 8.0 (HKLM-x32\…\AVS Audio Converter_is1) (Version: 8.0.2.541 - Online Media Technologies Ltd.)
CamStudio 2.7.4 (HKLM\…\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.4 - CamStudio Open Source)
Canon Easy-WebPrint EX (HKLM-x32\…\Easy-WebPrint EX) (Version: 1.6.0.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\…\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon MG3500 series MP Drivers (HKLM\…\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3500_series) (Version: 1.00 - Canon Inc.)
Canon MG3500 series On-screen Manual (HKLM-x32\…\Canon MG3500 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM-x32\…\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\…\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\…\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\…\CanonQuickMenu) (Version: 2.2.0 - Canon Inc.)
CCleaner (HKLM\…\CCleaner) (Version: 5.31 - Piriform)
D3DX10 (HKLM-x32\…\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Data Lifeguard Diagnostic for Windows 1.31 (HKLM-x32\…\{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1) (Version:  - Western Digital Corporation)
EssentialPIM (HKLM-x32\…\EssentialPIM) (Version: 7.0 - Astonsoft Ltd)
FastStone Image Viewer 5.4 (HKLM-x32\…\FastStone Image Viewer) (Version: 5.4 - FastStone Soft)
FileZilla Client 3.23.0.2 (HKLM-x32\…\FileZilla Client) (Version: 3.23.0.2 - Tim Kosse)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 59.0.3071.115 - Google Inc.)
Google Earth (HKLM-x32\…\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
HandBrake 0.10.0 (HKLM-x32\…\HandBrake) (Version: 0.10.0 - )
HiSuite (HKLM-x32\…\Hi Suite) (Version: 1.0 - Huawei Technologies Co.,Ltd)
HydraVision (HKLM-x32\…\{DA54D3F7-4915-1A37-7EA8-2741F05B77AC}) (Version: 4.2.234.0 - Advanced Micro Devices, Inc.) Hidden
Junk Mail filter update (HKLM-x32\…\{0BE9E708-5DC0-4963-9CFD-0AA519090E79}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Malwarebytes versione 3.1.2.1733 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
Microsoft .NET Framework 4.6.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 (Italiano) (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1040) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\…\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office FrontPage 2003 (HKLM-x32\…\{90170410-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\…\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
PDF-Viewer (HKLM\…\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.313.1 - Tracker Software Products Ltd)
PDF-XChange Viewer (HKLM\…\{9ED333F8-3E6C-4A38-BAFA-728454121CDA}) (Version: 2.5.211.0 - Tracker Software Products (Canada) Ltd.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.65.1025.2012 - Realtek)
Registrazione utente Canon MG3500 series (HKLM-x32\…\Registrazione utente Canon MG3500 series) (Version:  - ‭Canon Inc.)
Seagate DiscWizard (HKLM-x32\…\{621D9815-EDD8-4BD0-843E-041C2B668C58}) (Version: 16.0.5861 - Seagate)
SeaTools for Windows 1.4.0.2 (HKLM-x32\…\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
SketchUp 2015 (HKLM\…\{C9A37A5A-53E3-4B92-B70B-C2F8866A58BA}) (Version: 15.3.331 - Trimble Navigation Limited)
Skype™ 7.38 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.38.101 - Skype Technologies S.A.)
Telegram Desktop versione 1.0.14 (HKU\S-1-5-21-365969078-1895578363-2955812647-1001\…\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 1.0.14 - Telegram Messenger LLP)
VLC media player (HKLM\…\VLC media player) (Version: 2.2.4 - VideoLAN)
WD Access (HKLM-x32\…\{046643f7-6206-46bb-8968-92c37fee39e0}) (Version: 1.4.5949.29996 - Western Digital Technologies, Inc.)
WD Access (HKLM-x32\…\{C0624809-D60D-4AFF-8AF3-9452125AF4C1}) (Version: 1.4.5949.29996 - Western Digital Technologies, Inc) Hidden
WD Drive Utilities (HKLM-x32\…\{48996CDD-DD81-4197-93FE-0971E73C5CA7}) (Version: 1.3.2.2 - Western Digital Technologies, Inc.) Hidden
WD Drive Utilities (HKLM-x32\…\{eab1fb93-61fb-48de-b815-b4e9b68d2ef1}) (Version: 1.3.2.2 - Western Digital Technologies, Inc.)
WD SmartWare Installer (HKLM-x32\…\{e72369b3-306a-4d10-a766-3433a65e8dc2}) (Version: 2.4.14.13 - Western Digital Technologies, Inc.)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-24] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-24] (AVAST Software)
ContextMenuHandlers01: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers01: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-24] (AVAST Software)
ContextMenuHandlers01: [ShellConverter] -> {30A4E07E-068A-4d91-8F05-691283A1336B} => C:\Program Files (x86)\Common Files\AVSMedia\ActiveX\AVSShellConverter64.dll [2015-04-06] (Online Media Technologies Ltd.)
ContextMenuHandlers01: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} =>  -> No File
ContextMenuHandlers03: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-24] (AVAST Software)
ContextMenuHandlers03: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers03: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} =>  -> No File
ContextMenuHandlers04: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers04: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} =>  -> No File
ContextMenuHandlers05: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll [2013-04-29] (Advanced Micro Devices, Inc.)
ContextMenuHandlers05: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} =>  -> No File
ContextMenuHandlers06: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers06: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-24] (AVAST Software)
ContextMenuHandlers06: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers06: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} =>  -> No File
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {016FDCCF-561C-4E56-A89E-069A60B04F24} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-07-24] (AVAST Software)
Task: {2EE70828-82C4-453E-B01A-5881A444A93C} - System32\Tasks\{60998DAF-EBB3-47BC-8D4D-09F93486884E} => C:\Windows\system32\pcalua.exe -a D:\SETUP.EXE -d D:\
Task: {2FD563DA-E4E2-4663-93C9-A08DA7F4552E} - System32\Tasks\{4DB40BF8-6CB8-48F3-B4B0-66DBE9F137BF} => C:\Windows\system32\pcalua.exe -a G:\Win7_7065_11232012\AutoInst.exe -d G:\Win7_7065_11232012
Task: {4C1AA85E-4698-4029-B834-C341CAD6F016} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-11] (Google Inc.)
Task: {5D2DDFFD-35D3-408B-8A0E-07E73F7372AF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-06-13] (Piriform Ltd)
Task: {82C7E16A-9A12-4AF4-AB55-CF1639A08AF3} - System32\Tasks\SafeZone scheduled Autoupdate 1453598960 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe
Task: {8BB1723C-370C-47D2-8EC8-EA91E97A6A97} - System32\Tasks\ASUS\i-Setup095935 => C:\Windows\AMD_Chipset_Win7_V307320\AsusSetup.exe [2015-08-11] (ASUSTek)
Task: {CFF6F7F5-013E-4071-B3F9-0A18143723EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-11] (Google Inc.)
Task: {FEED38CE-410D-4C27-9B50-2FF21BED2078} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-07-12] (AVAST Software)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
2016-12-06 18:17 - 2016-12-06 18:17 - 00052400 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2016-05-04 09:27 - 2016-02-16 11:04 - 00192304 _____ () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe
2013-04-29 23:25 - 2013-04-29 23:25 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-06-18 15:49 - 2013-06-18 15:49 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-04-29 23:08 - 2013-04-29 23:08 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00162032 _____ () c:\Program Files\AVAST Software\Avast\x64\vaarclient.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00831664 _____ () C:\Program Files\AVAST Software\Avast\x64\ffl2.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00276808 _____ () c:\Program Files\AVAST Software\Avast\x64\StreamBack.dll
2017-06-13 15:08 - 2017-06-13 15:08 - 00069632 _____ () C:\Program Files\CCleaner\lang\lang-1040.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00170224 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00192664 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00224256 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
2017-07-24 17:45 - 2017-07-24 17:45 - 05886720 _____ () C:\Program Files\AVAST Software\Avast\defs\17072408\algo.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00689272 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00231664 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll
2017-06-20 11:28 - 2017-06-20 11:28 - 01997792 ____R () C:\Program Files (x86)\Skype\Phone\skypert.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 01065936 _____ () C:\Program Files\AVAST Software\Avast\AvChrome.dll
2017-07-06 06:35 - 2017-07-06 06:35 - 67109376 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-07-24 03:30 - 2017-07-24 03:30 - 00292920 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2015-03-12 02:39 - 2015-03-12 02:39 - 13666960 _____ () C:\Program Files (x86)\Seagate\DiscWizard\ti_managers.dll
2013-01-10 10:43 - 2013-01-10 10:43 - 00014360 _____ () C:\Program Files (x86)\Common Files\Acronis\TibMounter\icudt38.dll
2012-11-16 14:59 - 2012-11-16 14:59 - 00094208 _____ () C:\Program Files (x86)\ATI Technologies\HydraVision\HydraIta.dll
2017-07-25 09:14 - 2017-06-23 04:21 - 02877272 _____ () C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\libglesv2.dll
2017-07-25 09:14 - 2017-06-23 04:21 - 00086360 _____ () C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 04:34 - 2017-07-24 18:47 - 00000826 _____ C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Muletto\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{7B1AC8B2-29F6-4EFC-9B40-C5A3B553F282}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{E942C510-1328-4E3C-B531-4882FC2F9DDF}] => (Allow) LPort=2869
FirewallRules: [{4CE75AD5-84BB-4A2A-9CD9-5CC5E572039D}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{AB4C7AFB-F980-4A55-9794-2CF6BC97A361}C:\program files (x86)\western digital\wd app manager\wdappmanager.exe] => (Allow) C:\program files (x86)\western digital\wd app manager\wdappmanager.exe
FirewallRules: [UDP Query User{D075A659-B1D9-4612-879F-6775D229FE4B}C:\program files (x86)\western digital\wd app manager\wdappmanager.exe] => (Allow) C:\program files (x86)\western digital\wd app manager\wdappmanager.exe
FirewallRules: [{0E33D15E-F23C-4E02-9C72-4349961106E2}] => (Block) C:\program files (x86)\western digital\wd app manager\wdappmanager.exe
FirewallRules: [{BEE7ECDD-7C84-455E-8786-93F7964BAC61}] => (Block) C:\program files (x86)\western digital\wd app manager\wdappmanager.exe
FirewallRules: [{4D289FEB-76CD-4B51-A42A-101197B6CE94}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{4E1BFEBF-4F55-49FF-99F3-197897C7CF9A}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Restore Points =========================
 
12-07-2017 23:57:58 Windows Update
16-07-2017 20:50:28 Windows Backup
23-07-2017 19:19:06 Windows Backup
23-07-2017 22:01:29 Windows Update
24-07-2017 14:37:06 Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (07/25/2017 09:33:24 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Impossibile riattivare il filtro eventi con query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" nello spazio dei nomi "//./root/CIMV2". Errore 0x80041003. Impossibile recapitare gli eventi tramite questo filtro fino alla risoluzione del problema.
 
Error: (07/25/2017 09:33:13 AM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Impossibile trovare il file specificato.
 
Error: (07/25/2017 08:28:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Impossibile riattivare il filtro eventi con query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" nello spazio dei nomi "//./root/CIMV2". Errore 0x80041003. Impossibile recapitare gli eventi tramite questo filtro fino alla risoluzione del problema.
 
Error: (07/25/2017 08:27:42 AM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Impossibile trovare il file specificato.
 
Error: (07/25/2017 08:08:09 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Impossibile riattivare il filtro eventi con query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" nello spazio dei nomi "//./root/CIMV2". Errore 0x80041003. Impossibile recapitare gli eventi tramite questo filtro fino alla risoluzione del problema.
 
Error: (07/25/2017 08:07:55 AM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Impossibile trovare il file specificato.
 
Error: (07/24/2017 10:39:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Impossibile riattivare il filtro eventi con query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" nello spazio dei nomi "//./root/CIMV2". Errore 0x80041003. Impossibile recapitare gli eventi tramite questo filtro fino alla risoluzione del problema.
 
Error: (07/24/2017 10:39:06 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Impossibile trovare il file specificato.
 
Error: (07/24/2017 08:11:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Impossibile riattivare il filtro eventi con query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" nello spazio dei nomi "//./root/CIMV2". Errore 0x80041003. Impossibile recapitare gli eventi tramite questo filtro fino alla risoluzione del problema.
 
Error: (07/24/2017 08:11:37 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Impossibile trovare il file specificato.
 
 
System errors:
=============
Error: (07/25/2017 09:38:23 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: Ricevuto avviso di errore irreversibile: 40.
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Servizio di condivisione in rete Windows Media Player è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 30000 millisecondi: Riavvia il servizio.
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Malwarebytes Service è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 5000 millisecondi: Riavvia il servizio.
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Windows Search è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 30000 millisecondi: Riavvia il servizio.
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Arresto imprevista del servizio Servizio Google Update (gupdate). Questo evento si è già verificato 1 volta(e).
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Cache tipi di carattere Windows Presentation Foundation 3.0.0.0 è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 0 millisecondi: Riavvia il servizio.
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Windows Live ID Sign-in Assistant è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 10000 millisecondi: Riavvia il servizio.
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Arresto imprevista del servizio WD Drive Manager. Questo evento si è già verificato 1 volta(e).
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Arresto imprevista del servizio HuaweiHiSuiteService64.exe. Questo evento si è già verificato 1 volta(e).
 
Error: (07/25/2017 09:32:07 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Arresto imprevista del servizio DbxSvc. Questo evento si è già verificato 1 volta(e).
 
 
CodeIntegrity:
===================================
  Date: 2017-05-01 15:31:36.432
  Description: Impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Users\Muletto\AppData\Local\Temp\EverestDriver.sys. Impossibile trovare l'hash del file nel sistema. Causa possibile: installazione di un file danneggiato o con firma non corretta in seguito a una modifica hardware o software o malware di origine sconosciuta.
 
  Date: 2017-05-01 15:31:36.300
  Description: Impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Users\Muletto\AppData\Local\Temp\EverestDriver.sys. Impossibile trovare l'hash del file nel sistema. Causa possibile: installazione di un file danneggiato o con firma non corretta in seguito a una modifica hardware o software o malware di origine sconosciuta.
 
  Date: 2017-05-01 15:31:36.007
  Description: Impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64. Impossibile trovare l'hash del file nel sistema. Causa possibile: installazione di un file danneggiato o con firma non corretta in seguito a una modifica hardware o software o malware di origine sconosciuta.
 
  Date: 2017-05-01 15:31:35.875
  Description: Impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64. Impossibile trovare l'hash del file nel sistema. Causa possibile: installazione di un file danneggiato o con firma non corretta in seguito a una modifica hardware o software o malware di origine sconosciuta.
 
  Date: 2016-09-09 10:44:33.476
  Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Windows\System32\drivers\aswKbd.sys. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
 
  Date: 2016-09-09 10:44:33.351
  Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Windows\System32\drivers\aswSnx.sys. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
 
  Date: 2016-09-08 14:15:11.102
  Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Windows\System32\drivers\aswKbd.sys. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
 
  Date: 2016-09-08 14:15:11.070
  Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Windows\System32\drivers\aswSnx.sys. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
 
  Date: 2016-09-08 07:19:04.258
  Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Windows\System32\drivers\aswKbd.sys. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
 
  Date: 2016-09-08 07:19:04.211
  Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume1\Windows\System32\drivers\aswSnx.sys. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
 
 
==================== Memory info =========================== 
 
Processor: AMD Athlon™ 64 X2 Dual Core Processor 6000+
Percentage of memory in use: 85%
Total physical RAM: 1791.18 MB
Available physical RAM: 255.92 MB
Total Virtual: 3582.36 MB
Available Virtual: 1506.18 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:70.54 GB) (Free:17.83 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive e: (Volume) (Fixed) (Total:41.24 GB) (Free:9.51 GB) NTFS
Drive f: (Volume) (Fixed) (Total:931.51 GB) (Free:929.37 GB) NTFS
Drive h: (Volume) (Fixed) (Total:1023.99 GB) (Free:126.06 GB) NTFS
Drive i: (Volume) (Fixed) (Total:746.51 GB) (Free:62.81 GB) NTFS
Drive j: (Volume) (Fixed) (Total:1024 GB) (Free:184.07 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 3B6892D7)
Partition 1: (Active) - (Size=70.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=41.2 GB) - (Type=OF Extended)
 
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: B54D2BCB)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
 
========================================================
Disk: 2 (Size: 2048 GB) (Disk ID: A042B4E2)
Partition 1: (Not Active) - (Size=1024 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1024 GB) - (Type=07 NTFS)
 
========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 746.5 GB) (Disk ID: A0A4682A)
Partition 1: (Not Active) - (Size=746.5 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
 
<<<<<<<<<<<<<<<<
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-07-2017
Ran by [removed] (administrator) on MULETTO-PC (25-07-2017 10:21:26)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Italiano (Italia)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Seagate) C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Seagate) C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
() C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe
(Seagate) C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD App Manager\WDAppManager.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Users\Muletto\Desktop\aswMBR.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
==================== Registry (Whitelisted) ====================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [Seagate Scheduler2 Service] => C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe [400672 2015-03-12] (Seagate)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213832 2017-07-24] (AVAST Software)
HKLM\…\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM-x32\…\Run: [DiscWizardMonitor.exe] => C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe [6412896 2015-03-12] (Seagate)
HKLM-x32\…\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104368 2013-01-10] (Acronis)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642304 2013-04-30] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [AMD AVT] => Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
HKLM-x32\…\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1282632 2013-04-02] (CANON INC.)
HKLM-x32\…\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\…\Run: [DriveUtilitiesHelper] => C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe [1890664 2016-01-14] (Western Digital Technologies, Inc.)
HKLM-x32\…\Run: [WDAppManager] => C:\Program Files (x86)\Western Digital\WD App Manager\AppManagerLauncher.exe [21384 2016-04-15] (Western Digital Technologies, Inc.)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9803992 2017-06-13] (Piriform Ltd)
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27784672 2017-06-27] (Skype Technologies S.A.)
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\…\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2012-11-16] (AMD)
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\…\MountPoints2: {958e3a79-114b-11e6-9daa-00e04c692b56} - F:\HiSuiteDownLoader.exe
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\…\MountPoints2: {958e3af0-114b-11e6-9daa-00e04c692b56} - D:\HiSuiteDownLoader.exe
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\…\MountPoints2: {c01851db-fe44-11d5-b7fa-00e04c692b56} - D:\AutoRun.exe
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\…\MountPoints2: {dc8d7c08-3077-11e6-8326-00e04c692b56} - D:\AutoRun.exe
GroupPolicy: Restriction <==== ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{5248A02C-8708-41C6-AF99-C3EBEF188CB0}: [DhcpNameServer] 192.168.0.1
 
Internet Explorer:
==================
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.it/?gws_rd=ssl
SearchScopes: HKU\S-1-5-21-365969078-1895578363-2955812647-1001 -> DefaultScope {76275CB4-AB32-4FB6-A57D-D25F852D5F1D} URL = hxxp://www.google.it/#hl=it&source;=hp&q;={searchTerms}&aq;=f&aqi;=g10&aql;=&oq;=&gs;_rfai=&fp;=9fca69c98b5d77d7
SearchScopes: HKU\S-1-5-21-365969078-1895578363-2955812647-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-365969078-1895578363-2955812647-1001 -> {76275CB4-AB32-4FB6-A57D-D25F852D5F1D} URL = hxxp://www.google.it/#hl=it&source;=hp&q;={searchTerms}&aq;=f&aqi;=g10&aql;=&oq;=&gs;_rfai=&fp;=9fca69c98b5d77d7
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-07-06] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-07-06] (AVAST Software)
BHO-x32: Guida per l'accesso all'account Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
Toolbar: HKU\S-1-5-21-365969078-1895578363-2955812647-1001 -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
 
FireFox:
========
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-06-08] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-06-08] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-06-08] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-06-08] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-365969078-1895578363-2955812647-1001: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-06-08] (Tracker Software Products (Canada) Ltd.)
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.it/
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.google.com","hxxp://www.istartsurf.com/?type=hp&ts;=1410884997&from;=ild&uid;=SamsungXSSDX840XSeries_S19HNEBD381909M","hxxp://www.sweet-page.com/?type=hp&ts;=1416664383&from;=cor&uid;=KINGSTONXSV300S37A240G_50026B77470606F1","hxxp://www.oursurfing.com/?type=hp&ts;=1439622721&z;=03fa4e1a3a66e767d804c7fg6z5c7t4q4o5odmbg2z&from;=2sq&uid;=SamsungXSSDX840XSeries_S19HNEBD381909M","hxxp://www.yoursearching.com/?type=hp&ts;=1451819208&z;=b40a5fddd39e433b9b1ac68g4z6w0geb1g1tfo4e2b&from;=cor&uid;=samsungxssdx840xseries_s19hnebd381909m","hxxps://www.duckduckgo.com"
CHR Profile: C:\Users\Muletto\AppData\Local\Google\Chrome\User Data\Default [2017-07-25]
CHR Extension: (YouTube) - C:\Users\Muletto\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-07-24]
CHR Extension: (Google Search) - C:\Users\Muletto\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]
CHR Extension: (Pagamenti Chrome Web Store) - C:\Users\Muletto\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Muletto\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-11]
CHR Extension: (Chrome Media Router) - C:\Users\Muletto\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-14]
CHR Profile: C:\Users\Muletto\AppData\Local\Google\Chrome\User Data\System Profile [2017-07-24]
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-04-29] (Advanced Micro Devices, Inc.) [File not signed]
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7430992 2017-07-24] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [263312 2017-07-24] (AVAST Software)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42096 2016-11-08] (Dropbox, Inc.)
R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [192304 2016-02-16] ()
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [308088 2016-01-14] (Western Digital Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdrivera.sys [320008 2017-07-24] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\system32\drivers\aswbidsha.sys [198976 2017-07-24] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\system32\drivers\aswbloga.sys [343288 2017-07-24] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\system32\drivers\aswbuniva.sys [57728 2017-07-24] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [46984 2017-07-06] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [146696 2017-07-24] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [110352 2017-07-06] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [84392 2017-07-06] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1015848 2017-07-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [585608 2017-07-06] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [198768 2017-07-06] (AVAST Software)
R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [361336 2017-07-06] (AVAST Software)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77376 2017-06-27] ()
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-02-16] (Huawei Technologies Co., Ltd.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [253856 2017-07-25] (Malwarebytes)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation                           )
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2015-08-12] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [183224 2015-08-12] (Acronis)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2015-08-12] (Acronis International GmbH)
S3 WDC_SAM; C:\Windows\System32\DRIVERS\wdcsam64_prewin8.sys [23200 2016-01-14] (Western Digital Technologies)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-07-25 10:21 - 2017-07-25 10:21 - 00016923 _____ C:\Users\Muletto\Desktop\FRST.txt
2017-07-25 10:21 - 2017-07-25 10:21 - 00000000 ____D C:\FRST
2017-07-25 10:20 - 2017-07-25 10:20 - 02382336 _____ (Farbar) C:\Users\Muletto\Desktop\FRST64.exe
2017-07-25 10:18 - 2017-07-25 10:18 - 00002838 _____ C:\Users\Muletto\Desktop\aswMBR.txt
2017-07-25 10:18 - 2017-07-25 10:18 - 00000512 _____ C:\Users\Muletto\Desktop\MBR.dat
2017-07-25 09:40 - 2017-07-25 09:40 - 05198336 _____ (AVAST Software) C:\Users\Muletto\Desktop\aswMBR.exe
2017-07-25 09:40 - 2017-07-25 09:40 - 00000000 ____D C:\ProgramData\SWCUTemp
2017-07-25 09:14 - 2017-07-25 09:14 - 00002265 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-07-25 09:14 - 2017-07-25 09:14 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-07-24 18:41 - 2017-07-25 09:33 - 00253856 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-07-24 18:41 - 2017-07-24 18:41 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-07-24 18:41 - 2017-07-24 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-07-24 18:41 - 2017-07-24 18:41 - 00000000 ____D C:\Program Files\Malwarebytes
2017-07-24 18:41 - 2017-06-27 12:06 - 00077376 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-07-24 18:38 - 2017-07-24 18:40 - 65033984 _____ (Malwarebytes ) C:\Users\Muletto\Downloads\mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251.exe
2017-07-24 18:27 - 2017-07-24 18:27 - 00412160 _____ C:\Windows\system32\FNTCACHE.DAT
2017-07-24 18:24 - 2017-07-24 18:24 - 08162248 _____ (Malwarebytes) C:\Users\Muletto\Downloads\adwcleaner_7.0.0.0.exe
2017-07-24 18:19 - 2017-07-24 18:19 - 00109296 _____ C:\Users\Muletto\AppData\Local\GDIPFONTCACHEV1.DAT
2017-07-24 17:33 - 2017-07-24 17:33 - 01570472 _____ (SafeBytes Software Inc.) C:\Users\Muletto\Downloads\DriverAssist-Setup.exe
2017-07-24 16:09 - 2017-07-24 16:09 - 00000000 ___HD C:\$AV_ASW
2017-07-24 15:33 - 2017-07-24 15:33 - 00846446 _____ C:\Users\Muletto\Downloads\100plus_intel_network.zip
2017-07-24 15:11 - 2017-07-24 15:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VP-EYE
2017-07-24 15:11 - 2017-07-24 15:11 - 00003040 _____ C:\Windows\System32\Tasks\{60998DAF-EBB3-47BC-8D4D-09F93486884E}
2017-07-24 15:11 - 2017-07-24 15:11 - 00000000 ____D C:\Users\Muletto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VP-EYE
2017-07-24 15:10 - 2017-07-24 15:11 - 00037089 _____ C:\Windows\unvpeye.ini
2017-07-24 15:10 - 2017-07-24 15:11 - 00000000 ____D C:\VP-EYE
2017-07-24 14:39 - 2017-07-25 10:09 - 00000000 ____D C:\Users\Muletto\AppData\Roaming\Skype
2017-07-24 14:39 - 2017-07-24 14:39 - 00002697 _____ C:\Users\Public\Desktop\Skype.lnk
2017-07-24 14:39 - 2017-07-24 14:39 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-07-24 14:39 - 2017-07-24 14:39 - 00000000 ____D C:\ProgramData\Skype
2017-07-24 14:39 - 2017-07-24 14:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-07-24 14:36 - 2017-07-24 14:36 - 01632736 _____ (Skype Technologies S.A.) C:\Users\Muletto\Downloads\SkypeSetup.exe
2017-07-24 03:30 - 2017-07-24 03:30 - 00400464 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2017-07-23 16:17 - 2017-07-23 16:18 - 00000049 _____ C:\Users\Muletto\Desktop\GiordanoFerram.txt
2017-07-18 21:07 - 2017-07-18 21:07 - 00052325 _____ C:\Users\Muletto\Desktop\a1a17541-4ba7-42cc-af91-8fa884bf3328 (1).pdf
2017-07-18 21:05 - 2017-07-18 21:05 - 00052325 _____ C:\Users\Muletto\Desktop\a1a17541-4ba7-42cc-af91-8fa884bf3328.pdf
2017-07-18 16:28 - 2017-07-18 16:28 - 01430812 _____ C:\Users\Muletto\Desktop\TS-PE100—ita—LD.pdf
2017-07-17 22:19 - 2017-07-19 01:02 - 00000101 _____ C:\Users\Muletto\Desktop\IacuzzoFerrra.txt
2017-07-12 08:20 - 2017-05-03 17:29 - 01206272 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-07-12 08:20 - 2017-05-03 15:05 - 01555968 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-07-12 08:20 - 2017-05-03 15:05 - 00620544 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-07-12 08:20 - 2017-05-03 15:05 - 00535552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-07-12 08:20 - 2017-05-03 15:05 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-07-12 08:20 - 2017-05-03 15:05 - 00311296 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-07-12 08:20 - 2017-05-03 15:05 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-07-12 08:20 - 2017-03-23 04:06 - 01691136 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2017-07-12 08:19 - 2017-06-30 06:15 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-07-12 08:19 - 2017-06-30 05:32 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 02319872 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 02222080 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 02058240 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 00778240 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 00491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-07-12 08:19 - 2017-06-30 04:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-07-12 08:19 - 2017-06-30 04:40 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-07-12 08:19 - 2017-06-30 04:40 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-07-12 08:19 - 2017-06-30 04:39 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-07-12 08:19 - 2017-06-30 04:39 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-07-12 08:19 - 2017-06-30 04:38 - 01400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-07-12 08:19 - 2017-06-30 04:38 - 01363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-07-12 08:19 - 2017-06-30 04:38 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-07-12 08:19 - 2017-06-30 04:38 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-07-12 08:19 - 2017-06-30 04:38 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-07-12 08:19 - 2017-06-30 04:38 - 00104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-07-12 08:19 - 2017-06-30 04:38 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-07-12 08:19 - 2017-06-30 04:38 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-07-12 08:19 - 2017-06-30 04:27 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-07-12 08:19 - 2017-06-30 04:27 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-07-12 08:19 - 2017-06-30 04:26 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-07-12 08:19 - 2017-06-30 04:26 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-07-12 08:19 - 2017-06-29 08:27 - 25734656 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-07-12 08:19 - 2017-06-29 08:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-07-12 08:19 - 2017-06-29 08:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-07-12 08:19 - 2017-06-29 08:04 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-07-12 08:19 - 2017-06-29 08:03 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-07-12 08:19 - 2017-06-29 08:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-07-12 08:19 - 2017-06-29 08:02 - 02899456 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-07-12 08:19 - 2017-06-29 08:02 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-07-12 08:19 - 2017-06-29 08:02 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-07-12 08:19 - 2017-06-29 07:55 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-07-12 08:19 - 2017-06-29 07:54 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-07-12 08:19 - 2017-06-29 07:51 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-07-12 08:19 - 2017-06-29 07:50 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-07-12 08:19 - 2017-06-29 07:50 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-07-12 08:19 - 2017-06-29 07:50 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-07-12 08:19 - 2017-06-29 07:50 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-07-12 08:19 - 2017-06-29 07:44 - 05975552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-07-12 08:19 - 2017-06-29 07:43 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-07-12 08:19 - 2017-06-29 07:39 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-07-12 08:19 - 2017-06-29 07:35 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-07-12 08:19 - 2017-06-29 07:31 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-07-12 08:19 - 2017-06-29 07:31 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-07-12 08:19 - 2017-06-29 07:30 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-07-12 08:19 - 2017-06-29 07:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-07-12 08:19 - 2017-06-29 07:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-07-12 08:19 - 2017-06-29 07:23 - 20270592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-07-12 08:19 - 2017-06-29 07:23 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-07-12 08:19 - 2017-06-29 07:23 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-07-12 08:19 - 2017-06-29 07:23 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-07-12 08:19 - 2017-06-29 07:23 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-07-12 08:19 - 2017-06-29 07:22 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-07-12 08:19 - 2017-06-29 07:22 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-07-12 08:19 - 2017-06-29 07:22 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-07-12 08:19 - 2017-06-29 07:19 - 02290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-07-12 08:19 - 2017-06-29 07:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-07-12 08:19 - 2017-06-29 07:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-07-12 08:19 - 2017-06-29 07:14 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-07-12 08:19 - 2017-06-29 07:13 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-07-12 08:19 - 2017-06-29 07:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-07-12 08:19 - 2017-06-29 07:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-07-12 08:19 - 2017-06-29 07:11 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-07-12 08:19 - 2017-06-29 07:09 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-07-12 08:19 - 2017-06-29 07:09 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-07-12 08:19 - 2017-06-29 07:08 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-07-12 08:19 - 2017-06-29 07:07 - 02132992 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-07-12 08:19 - 2017-06-29 07:05 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-07-12 08:19 - 2017-06-29 07:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-07-12 08:19 - 2017-06-29 07:00 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-07-12 08:19 - 2017-06-29 07:00 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-07-12 08:19 - 2017-06-29 06:58 - 15253504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-07-12 08:19 - 2017-06-29 06:58 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-07-12 08:19 - 2017-06-29 06:56 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-07-12 08:19 - 2017-06-29 06:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-07-12 08:19 - 2017-06-29 06:54 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-07-12 08:19 - 2017-06-29 06:53 - 03240960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-07-12 08:19 - 2017-06-29 06:52 - 04549632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-07-12 08:19 - 2017-06-29 06:48 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-07-12 08:19 - 2017-06-29 06:47 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-07-12 08:19 - 2017-06-29 06:46 - 02057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-07-12 08:19 - 2017-06-29 06:46 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-07-12 08:19 - 2017-06-29 06:43 - 13663744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-07-12 08:19 - 2017-06-29 06:41 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-07-12 08:19 - 2017-06-29 06:29 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-07-12 08:19 - 2017-06-29 06:28 - 02767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-07-12 08:19 - 2017-06-29 06:24 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-07-12 08:19 - 2017-06-29 06:23 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-07-12 08:19 - 2017-06-22 16:58 - 03223040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-07-12 08:19 - 2017-06-15 22:23 - 00753664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-07-12 08:19 - 2017-06-13 00:54 - 00370920 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2017-07-12 08:19 - 2017-06-13 00:54 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-07-12 08:19 - 2017-06-13 00:54 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-07-12 08:19 - 2017-06-13 00:49 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 01363456 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2017-07-12 08:19 - 2017-06-13 00:49 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\pdhui.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-07-12 08:19 - 2017-06-13 00:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-07-12 08:19 - 2017-06-13 00:29 - 01227264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2017-07-12 08:19 - 2017-06-13 00:29 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-07-12 08:19 - 2017-06-13 00:29 - 00444928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2017-07-12 08:19 - 2017-06-13 00:29 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2017-07-12 08:19 - 2017-06-13 00:29 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-07-12 08:19 - 2017-06-13 00:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-07-12 08:19 - 2017-06-13 00:29 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-07-12 08:19 - 2017-06-13 00:29 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdhui.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-07-12 08:19 - 2017-06-13 00:28 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-07-12 08:19 - 2017-06-13 00:19 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-07-12 08:19 - 2017-06-13 00:14 - 00379392 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2017-07-12 08:19 - 2017-06-13 00:14 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\perfmon.exe
2017-07-12 08:19 - 2017-06-13 00:14 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\resmon.exe
2017-07-12 08:19 - 2017-06-13 00:12 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-07-12 08:19 - 2017-06-13 00:12 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-07-12 08:19 - 2017-06-13 00:12 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-07-12 08:19 - 2017-06-13 00:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-07-12 08:19 - 2017-06-13 00:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-07-12 08:19 - 2017-06-13 00:06 - 00303616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2017-07-12 08:19 - 2017-06-13 00:06 - 00157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfmon.exe
2017-07-12 08:19 - 2017-06-13 00:06 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resmon.exe
2017-07-12 08:19 - 2017-06-13 00:05 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-07-12 08:19 - 2017-06-10 17:59 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2017-07-12 08:19 - 2017-06-10 17:39 - 00271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-07-12 08:19 - 2017-06-09 17:33 - 01680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-07-12 08:19 - 2017-06-06 17:30 - 01867264 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-07-12 08:19 - 2017-06-06 17:12 - 01499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-07-12 08:19 - 2017-05-30 06:56 - 01895656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-07-12 08:19 - 2017-05-30 06:56 - 00377576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-07-12 08:19 - 2017-05-30 06:56 - 00287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-07-12 08:19 - 2017-05-21 06:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-07-12 08:19 - 2017-05-21 06:06 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-07-12 08:19 - 2017-05-16 17:35 - 00986856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-07-12 08:19 - 2017-05-16 17:35 - 00265448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-07-12 08:19 - 2017-05-16 17:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-07-12 08:19 - 2017-05-03 17:34 - 00094952 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-07-12 08:19 - 2017-05-03 15:05 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-07-06 15:23 - 2017-07-06 15:23 - 00025869 _____ C:\Users\Muletto\Desktop\doc20170619162932.pdf
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-07-25 09:41 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-07-25 09:41 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-07-25 09:37 - 2010-11-21 17:30 - 00744280 _____ C:\Windows\system32\perfh010.dat
2017-07-25 09:37 - 2010-11-21 17:30 - 00148454 _____ C:\Windows\system32\perfc010.dat
2017-07-25 09:37 - 2009-07-14 07:13 - 01669316 _____ C:\Windows\system32\PerfStringBackup.INI
2017-07-25 09:37 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2017-07-25 09:33 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-07-25 09:32 - 2015-10-10 09:23 - 00000000 ____D C:\AdwCleaner
2017-07-25 09:13 - 2015-08-11 09:28 - 00003582 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-07-25 09:13 - 2015-08-11 09:28 - 00003454 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-07-25 09:13 - 2015-08-11 09:28 - 00000000 ____D C:\Program Files (x86)\Google
2017-07-24 22:24 - 2017-01-18 02:56 - 00000000 ____D C:\Users\Muletto\Downloads\Hijiack
2017-07-24 21:47 - 2016-12-03 23:37 - 00000713 _____ C:\Users\Muletto\Desktop\Nuovo documento di testo.txt
2017-07-24 19:25 - 2017-04-13 15:14 - 00000000 ____D C:\Users\Muletto\Documents\CUD
2017-07-24 18:41 - 2015-12-14 21:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-07-24 18:06 - 2015-12-01 10:15 - 00000000 ____D C:\Users\Muletto\AppData\Local\CrashDumps
2017-07-24 17:34 - 2017-04-18 08:50 - 00006101 _____ C:\Users\Muletto\Desktop\Libero.txt
2017-07-24 15:10 - 2016-10-01 10:24 - 00000000 ____D C:\Users\Muletto\AppData\Local\Help
2017-07-24 14:37 - 2015-08-11 17:55 - 00000000 ____D C:\ProgramData\Package Cache
2017-07-24 14:25 - 2015-08-12 09:32 - 00000000 ____D C:\Users\Muletto\Documents\Promemoria
2017-07-24 03:31 - 2015-08-11 09:36 - 00146696 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2017-07-24 03:30 - 2017-03-12 05:52 - 00343288 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbloga.sys
2017-07-24 03:30 - 2017-03-12 05:52 - 00320008 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdrivera.sys
2017-07-24 03:30 - 2017-03-12 05:52 - 00198976 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsha.sys
2017-07-24 03:30 - 2017-03-12 05:52 - 00057728 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbuniva.sys
2017-07-24 03:30 - 2017-03-12 05:52 - 00003914 _____ C:\Windows\System32\Tasks\Avast Emergency Update
2017-07-24 03:30 - 2015-08-11 09:36 - 00146664 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys.150085986221103
2017-07-23 20:09 - 2017-05-22 17:27 - 00000000 ____D C:\Users\Muletto\Documents\Scanner
2017-07-23 09:11 - 2017-04-30 17:17 - 00007629 _____ C:\Users\Muletto\AppData\Local\Resmon.ResmonCfg
2017-07-22 18:05 - 2015-09-29 10:50 - 00000000 ____D C:\Users\Muletto\Desktop\DocVari
2017-07-22 16:35 - 2015-09-01 07:25 - 00000000 ____D C:\Users\Muletto\Desktop\Subito.it
2017-07-21 19:52 - 2017-05-04 21:02 - 00000000 ____D C:\Users\Muletto\Desktop\Ebay
2017-07-12 21:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2017-07-12 20:28 - 2015-08-11 16:23 - 00000000 ____D C:\Windows\system32\appraiser
2017-07-12 09:04 - 2015-08-11 12:37 - 00000000 ____D C:\Windows\system32\MRT
2017-07-12 09:03 - 2015-08-11 12:35 - 135225752 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-07-06 18:28 - 2016-01-07 20:41 - 00001038 _____ C:\Users\Muletto\Desktop\Scadenze.txt
2017-07-06 14:16 - 2016-11-30 07:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux (64 bits)
2017-07-06 14:16 - 2015-12-17 09:17 - 00000000 ____D C:\Users\Muletto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TurboYourPC
2017-07-06 14:02 - 2015-08-11 20:05 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-07-06 06:36 - 2015-08-11 09:36 - 00361336 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2017-07-06 06:35 - 2015-08-11 09:36 - 01015848 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2017-07-06 06:35 - 2015-08-11 09:36 - 00585608 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2017-07-06 06:35 - 2015-08-11 09:36 - 00360792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys.149931577206606
2017-07-06 06:35 - 2015-08-11 09:36 - 00198768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2017-07-06 06:35 - 2015-08-11 09:36 - 00110352 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2017-07-06 06:35 - 2015-08-11 09:36 - 00084392 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2017-07-06 06:35 - 2015-08-11 09:36 - 00046984 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2017-07-06 06:35 - 2015-08-11 09:32 - 00000000 ____D C:\ProgramData\AVAST Software
2017-07-06 06:32 - 2009-07-14 07:08 - 00032556 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-07-03 11:10 - 2015-09-23 16:27 - 00000000 ___RD C:\Users\Muletto\Documents\Scanned Documents
2017-06-29 22:30 - 2016-12-22 07:59 - 00000000 ____D C:\Users\Muletto\AppData\Roaming\vlc
2017-06-29 01:06 - 2015-09-04 22:25 - 00387424 _____ C:\Users\Muletto\Desktop\Formattazione.txt
 
==================== Files in the root of some directories =======
 
2016-01-03 13:15 - 2016-01-03 13:15 - 0000046 _____ () C:\Users\Muletto\AppData\Roaming\Camdata.ini
2016-01-03 13:15 - 2016-01-03 13:15 - 0000408 _____ () C:\Users\Muletto\AppData\Roaming\CamLayout.ini
2016-01-03 13:15 - 2016-01-03 13:15 - 0000408 _____ () C:\Users\Muletto\AppData\Roaming\CamShapes.ini
2016-01-03 13:07 - 2016-01-03 13:07 - 0000096 _____ () C:\Users\Muletto\AppData\Roaming\version2.xml
2017-04-30 17:17 - 2017-07-23 09:11 - 0007629 _____ () C:\Users\Muletto\AppData\Local\Resmon.ResmonCfg
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2017-07-22 11:12
 
==================== End of FRST.txt ============================
 
Start FRST (Please double-click on FRST/FRST64) with Administrator privileges

or Right click on the FRST icon and select Run as administrator

Highlight the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CreateRestorePoint:
EndProcesses:
ContextMenuHandlers01: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
ContextMenuHandlers03: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
ContextMenuHandlers04: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
ContextMenuHandlers05: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
ContextMenuHandlers06: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-365969078-1895578363-2955812647-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-365969078-1895578363-2955812647-1001 -> {76275CB4-AB32-4FB6-A57D-D25F852D5F1D} URL = hxxp://www.google.it/#hl=it&source=hp&q={searchTerms}&aq=f&aqi=g10&aql=&oq=&gs_rfai=&fp=9fca69c98b5d77d7
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.google.com","hxxp://www.istartsurf.com/?type=hp&ts=1410884997&from=ild&uid=SamsungXSSDX840XSeries_S19HNEBD381909M","hxxp://www.sweet-page.com/?type=hp&ts=1416664383&from=cor&uid=KINGSTONXSV300S37A240G_50026B77470606F1","hxxp://www.oursurfing.com/?type=hp&ts=1439622721&z=03fa4e1a3a66e767d804c7fg6z5c7t4q4o5odmbg2z&from=2sq&uid=SamsungXSSDX840XSeries_S19HNEBD381909M","hxxp://www.yoursearching.com/?type=hp&ts=1451819208&z=b40a5fddd39e433b9b1ac68g4z6w0geb1g1tfo4e2b&from=cor&uid=samsungxssdx840xseries_s19hnebd381909m","hxxps://www.duckduckgo.com"
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


~~~~~~~~~~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
  • ~~~~~~~~~~~~~~~~~~~~~

    Zemana AntiMalware Free
    download it from here:


    Double-click on the file named Zemana.AntiMalware.Portable to perform a system scan with Zemana AntiMalware Free.

    You may be presented with a User Account Control dialog asking you if you want to run this program. If this happens, you should click Yes to allow Zemana AntiMalware to run.
    When Zemana AntiMalware starts, click on the Scan button to perform a system scan.
    without changing any options, press Scan

    When Zemana has finished finished scanning it will show a screen that displays any malware that has been detected. To remove all the malicious files, click on the Next button.
    Zemana AntiMalware will now start to remove all the malicious programs from your computer.

    Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
    • open Zemana AntiMalware again and locate the latest report
    • please paste the contents into your reply
    When the process is complete, you can close Zemana AntiMalware
    ~~~~
    please post
    Fixlog.txt
    JRT.txt
    Zemana AntiMalware log
Fix result of Farbar Recovery Scan Tool (x64) Version: 23-07-2017
Ran by [removed] (25-07-2017 14:00:03) Run:1
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
 
CreateRestorePoint:
EndProcesses:
ContextMenuHandlers01: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
ContextMenuHandlers03: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
ContextMenuHandlers04: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
ContextMenuHandlers05: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
ContextMenuHandlers06: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => -> No File
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-365969078-1895578363-2955812647-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-365969078-1895578363-2955812647-1001 -> {76275CB4-AB32-4FB6-A57D-D25F852D5F1D} URL = hxxp://www.google.it/#hl=it&source=hp&q={searchTerms}&aq=f&aqi=g10&aql=&oq=&gs_rfai=&fp=9fca69c98b5d77d7
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.google.com","hxxp://www.istartsurf.com/?type=hp&ts=1410884997&from=ild&uid=SamsungXSSDX840XSeries_S19HNEBD381909M","hxxp://www.sweet-page.com/?type=hp&ts=1416664383&from=cor&uid=KINGSTONXSV300S37A240G_50026B77470606F1","hxxp://www.oursurfing.com/?type=hp&ts=1439622721&z=03fa4e1a3a66e767d804c7fg6z5c7t4q4o5odmbg2z&from=2sq&uid=SamsungXSSDX840XSeries_S19HNEBD381909M","hxxp://www.yoursearching.com/?type=hp&ts=1451819208&z=b40a5fddd39e433b9b1ac68g4z6w0geb1g1tfo4e2b&from=cor&uid=samsungxssdx840xseries_s19hnebd381909m","hxxps://www.duckduckgo.com"
Emptytemp:
 
*****************
 
Restore point was successfully created.
EndProcesses: => Error: No automatic fix found for this entry.
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX => key removed successfully
HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => key not found. 
HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX => key removed successfully
HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => key not found. 
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX => key removed successfully
HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => key not found. 
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX => key removed successfully
HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => key not found. 
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX => key removed successfully
HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => key not found. 
C:\ProgramData\Reprise => ":wupeogjxldtlfudivq`qsp`26hfm" ADS removed successfully.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => key removed successfully
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 
HKU\S-1-5-21-365969078-1895578363-2955812647-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{76275CB4-AB32-4FB6-A57D-D25F852D5F1D} => key removed successfully
HKLM\Software\Classes\CLSID\{76275CB4-AB32-4FB6-A57D-D25F852D5F1D} => key not found. 
Chrome StartupUrls => removed successfully
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 9865580 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 40 B
Edge => 0 B
Chrome => 180594480 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 58558540 B
systemprofile32 => 70056 B
LocalService => 66228 B
NetworkService => 66228 B
Muletto => 61225597 B
Administrator => 75494 B
 
RecycleBin => 134208635 B
EmptyTemp: => 432.1 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 14:00:44 ====
 
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 7 Ultimate x64 
Ran by [removed] (Administrator) on 25/07/2017 at 14:17:05,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
File System: 0 
 
 
 
 
Registry: 0 
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25/07/2017 at 14:20:17,90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Zemana AntiMalware 2.74.2.76 (Installato)
 
——————————————————-
Scan Result            : Completato
Scan Date              : 2017/7/25
Operating System       : Windows 7 64-bit
Processor              : 2X AMD Athlon™ 64 X2 Dual Core Processor 6000+
BIOS Mode              : Legacy
CUID                   : 12AFA834018147C3870CC4
Scan Type              : Scansione del sistema
Duration               : 2m 40s
Scanned Objects        : 56328
Detected Objects       : 5
Excluded Objects       : 0
Read Level             : SCSI
Auto Upload            : Attivato
Detect All Extensions  : Disattivato
Scan Documents         : Disattivato
Domain Info            : MSHOME,0,2
 
Detected Objects
——————————————————-
 
Chrome Startup Url
Status             : Scansionato
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Impostazione del browser sospetta
Cleaning Action    : Ripara
Related Objects    :
                Impostazione del browser - Chrome Startup Url
 
Chrome Startup Url
Status             : Scansionato
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Impostazione del browser sospetta
Cleaning Action    : Ripara
Related Objects    :
                Impostazione del browser - Chrome Startup Url
 
Chrome Startup Url
Status             : Scansionato
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Impostazione del browser sospetta
Cleaning Action    : Ripara
Related Objects    :
                Impostazione del browser - Chrome Startup Url
 
Chrome Startup Url
Status             : Scansionato
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Impostazione del browser sospetta
Cleaning Action    : Ripara
Related Objects    :
                Impostazione del browser - Chrome Startup Url
 
DriverAssist-Setup.exe
Status             : Scansionato
Object             : %userprofile%\downloads\driverassist-setup.exe
MD5                : C1E1AB14892CA5DB2C2441DBBF9B526E
Publisher          : SafeBytes Software Inc.
Size               : 1570472
Version            : 3.5.0.9
Detection          : Scareware:Win32/NonBeneficialOptimizer!Ep
Cleaning Action    : Quarantena
Related Objects    :
                File - %userprofile%\downloads\driverassist-setup.exe
 
 
Cleaning Result
——————————————————-
Cleaned               : 5
Reported as safe      : 0
Failed                : 0
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 
It's nice to have a good teacher at my age :-), TY

 

It's nice to have a good teacher at my age :-), TY

lol, 
 
Since you already have Malwarebytes Anti-Malware on your machine,  let's update it and run a fresh scan
 
Open Malwarebytes Anti-Malware
  • On the Dashboard click on Update Now
  • Go to the Setting Tab
  • Under Setting go to Detection and Protection
  • Under PUP and PUM make sure both are set to show Treat Detections as Malware
  • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan
  • Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
  • When the scan is finished on the bottom right click on SAVE RESULTS then select Copy to Clipboard
  • If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
  • Please paste the log back into this thread for review
  • Exit Malwarebytes
  • ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

    Emsisoft Emergency Kit
Please download Emsisoft Emergency Kit and save it to your desktop. Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop. Leave all settings as they are and click the Extract button at the bottom. A folder named EEK will be created in the root of the drive (usually c:\).
  • After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
  • The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates. Please click Yes so that it downloads the latest database updates.
  • When update is complete, click Malware Scan. When asked if you want the scanner to scan for Potentially Unwanted Programs, click Yes. Emsisoft Emergency Kit will start scanning.
  • When the scan is completed click Quarantine selected objects. Note, this option is only available if malicious objects were detected during the scan.
  • When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
  • Please save the log in Notepad on your desktop and post the contents in your next reply.
  • When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
Please post these 2 logs when finished.

How is your computer now?

Hi,  my Malwarebytes  free version said clean and  Emisoft :

 

Emsisoft Emergency Kit - Versione 2017.6
Ultimo aggiornamento: 26/07/2017 17:17:14
Account utente: Muletto-PC\Muletto
Computer name: MULETTO-PC
OS version: Windows 7x64 Service Pack 1
 
Impostazioni scansione:
 
Tipo scansione: Scansione Malware
Oggetti: Rootkits, Memoria, Tracce, Files
 
Rileva PUPs: On
Archivio scansioni: Off
Scansiona gli allegati delle email: Off
Scansione ADS: On
Filtro estensione dei file: Off
Accesso diretto al disco: Off
 
Scansione avviata: 26/07/2017 17:19:50
C:\Users\Muletto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TurboYourPC rilevati: Application.OptAd (A) [230384]
Key: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRACING\TURBOYOURPC_RASAPI32 rilevati: Application.OptAd (A) [281516]
Key: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRACING\TURBOYOURPC_RASMANCS rilevati: Application.OptAd (A) [281517]
C:\Users\Muletto\Desktop\rkill.exe rilevati: Trojan.GenericKD.12059606 (B) [krnl.xmd]
 
Scansionati 79028
Rilevato 4
 
Fine scansione: 26/07/2017 17:21:40
Tempo scansione: 0:01:50
 
C:\Users\Muletto\Desktop\rkill.exe Trojan.GenericKD.12059606 (B)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRACING\TURBOYOURPC_RASMANCS Application.OptAd (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRACING\TURBOYOURPC_RASAPI32 Application.OptAd (A)
C:\Users\Muletto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TurboYourPC Application.OptAd (A)
 
In quarantena 4
 
<<<<<<<<<<<<<<<
 
 If  I  ask anything to Google  Yahoo.search replay  :D

I forgot Malwarebytes log

 

Malwarebytes
www.malwarebytes.com
 
-Dettagli log-
Data scansione: 26/07/17
Ora scansione: 17:28
File di log: Malw26-07.txt
Amministratore: Sì
 
-Informazioni software-
Versione: 3.1.2.1733
Versione componenti: 1.0.160
Aggiorna versione pacchetto: 1.0.2442
Licenza: Free
 
-Informazioni sistema-
SO: Windows 7 Service Pack 1
CPU: x64
File system: NTFS
Utente: Muletto-PC\Muletto
 
-Riepilogo scansione-
Tipo di scansione: Ricerca elementi nocivi
Risultati: Completata
Elementi analizzati: 374896
Minacce rilevate: 0
(Nessun elemento nocivo rilevato)
Minacce messe in quarantena: 0
(Nessun elemento nocivo rilevato)
Tempo impiegato: 2 min, 58 sec
 
-Opzioni di scansione-
Memoria: Attivata
Esecuzioni automatiche: Attivata
File system: Attivata
Archivi compressi: Attivata
Rootkit: Disattivata
Analisi euristica: Attivata
PUP: Attivata
PUM: Attivata
 
-Dettagli scansione-
Processo: 0
(Nessun elemento nocivo rilevato)
 
Modulo: 0
(Nessun elemento nocivo rilevato)
 
Chiave di registro: 0
(Nessun elemento nocivo rilevato)
 
Valore di registro: 0
(Nessun elemento nocivo rilevato)
 
Dati di registro: 0
(Nessun elemento nocivo rilevato)
 
Flusso di dati: 0
(Nessun elemento nocivo rilevato)
 
Cartella: 0
(Nessun elemento nocivo rilevato)
 
File: 0
(Nessun elemento nocivo rilevato)
 
Settore fisico: 0
(Nessun elemento nocivo rilevato)
 
 
(end)

The situation is going bad  , now iI cannot open document or mail  end i cannot shut down the PC , I have only used the software  that you tell me  , i don not  made any other process or test whith other software , i have not free time to repair the PC but I need the PC 

Have you looked in Device Manager to see if there are any yellow or red flags next to divers used on the system?
The below is a tutorial on how to open and inspect drivers
https://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html

~~
Let's see if resetting browsers will have a good effect.
Instructions on how to backup your Favourites/Bookmarks and other data can be found below.
  • Backup Internet Explorer Favourites
  • Backup Firefox Bookmarks
  • Backup Chrome Bookmarks
    ~~~~~~~~~~
    Proceed with the reset once done.
  • Internet Explorer: How to reset Internet Explorer settings
  • Firefox: Reset Firefox
  • [external image: U5NwUGc.png]Chrome: Chrome - Reset browser settings
~~~~~~~~~~~~~~~~~~~~~~~`
Malwarebytes Anti Rootkit (MBAR) not to be confused with Malwarebytes Anti-Malware
Follow the instructions in the thread below to run a scan with MBAR. Don't forget to update the database before launching the scan, and once launched, leave MBAR running and do not touch your computer until it is done scanning.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

Once MBAR is done scanning, removing threats and rebooting your computer (If any are found), go in its MBAR folder, and copy/paste the content of the mbar-log-TODAYS-DATE.txt log in your next reply.
You can try running Windows Repair toolTweaking.com - Windows Repair All-In-One (Portable)

- Download Windows Repair All-In-One (Portable Version) from here.

- Extract tweaking.com_windows_repair_aio.zip to your Desktop.

- Disable all your antivirus and antimalware software - see how to do that here.
- Right click on 🖼Click to load external image (QfBzvq1.png) and select Run as Administrator (XP users just double click) to start Windows Repair All-In-One.
(Windows Vista/7/8 users: Accept UAC warning if it is enabled.)

- A window will appear. Click Step 2.
[external image: 2f8o60N.png]

- Click the Open Pre-Scan button, then click Start Scan. Wait for Windows Repair to finish scanning.

- Depending on which error Windows Repair found, click Repair Reparse Point or Repair Environment Variable accordingly. When the button changes to "Done!", click the close button to return to Windows Repair.

- Go to Step 3, then click Check in the See If Check Disk Is Needed.

- If Windows Repair stated that errors are found, click Open Check Disk At Next Boot. Choose (/R) Fixes errors on the disk also locate bad sectors and recovers readable information, then click Add To Next Boot. Reboot the computer to let Windows check the disk.
[external image: Ymy7crZ.png]

- Go to Step 4, then click Do It.
[external image: zDtdN75.png]

- Go to Step 5. Under System Restore click Create.
[external image: f7lEe1N.png]

- Go to Repairs and click Open Repairs. Leave all checkmarks as they are, then click Start Repairs.
[external image: PGv2vtD.png]

- By default Windows Repair All-In-One will create a "Logs" folder in its folder on the Desktop. Please post the contents of the log in your next reply.

I cannot find windows repair log  , i replay from infected PC that work only i safemode , I used an usb pen to download the MBAR Anti Rootkit , now i am going to download windows repair again on the desktop , every test you ask I do 2 time . Before when i clic on post replayo open a site  Media Traffic  , if is possible i can attach a screenshot  but I need istructions how attach the jpg.I Cheked the hardware and drives in control panel  , everythink is OK .

 

Malwarebytes Anti-Rootkit BETA 1.9.4.1001
www.malwarebytes.org
 
Database version:
  main:    v2017.07.27.05
  rootkit: v2017.05.27.01
 
Windows 7 Service Pack 1 x64 FAT32 (Safe Mode/Networking)
Internet Explorer 11.0.9600.18738
Muletto :: MULETTO-PC [administrator]
 
27/07/2017 16:55:12
mbar-log-2017-07-27 (16-55-12).txt
 
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 297411
Time elapsed: 9 minute(s), 39 second(s)
 
Memory Processes Detected: 0
(No malicious items detected)
 
Memory Modules Detected: 0
(No malicious items detected)
 
Registry Keys Detected: 0
(No malicious items detected)
 
Registry Values Detected: 0
(No malicious items detected)
 
Registry Data Items Detected: 0
(No malicious items detected)
 
Folders Detected: 0
(No malicious items detected)
 
Files Detected: 0
(No malicious items detected)
 
Physical Sectors Detected: 0
(No malicious items detected)
 
(end)
 

 

 

 

 

Tweaking.com - Windows Repair 2018 (v4.0.0)
——————————————————————————–
 
System Variables
——————————————————————————–
OS: Windows 7 Ultimate
OS Architecture: 64-bit
OS Version: 6.1.7601.23862
OS Service Pack: Service Pack 1
Computer Name: MULETTO-PC
Windows Drive: C:\
Windows Path: C:\Windows
Program Files: C:\Program Files
Program Files (x86): C:\Program Files (x86)
Current Profile: C:\Users\Muletto
Current Profile SID: S-1-5-21-365969078-1895578363-2955812647-1001
Current Profile Classes: S-1-5-21-365969078-1895578363-2955812647-1001_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\Muletto\AppData\Local
——————————————————————————–
 
System Information
——————————————————————————–
System Up Time: 0 Days 02:24:27
 
Process Count: 33
Commit Total: 1,02 GB
Commit Limit: 3,50 GB
Commit Peak: 2,82 GB
Handle Count: 9082
Kernel Total: 268,13 MB
Kernel Paged: 231,90 MB
Kernel Non Paged: 36,23 MB
System Cache: 786,41 MB
Thread Count: 392
——————————————————————————–
 
Memory Before Cleaning with CleanMem
——————————————————————————–
Memory Total: 1,75 GB
Memory Used: 1,17 GB(66,9731%)
Memory Avail.: 591,57 MB
——————————————————————————–
 
Cleaning Memory Before Starting Repairs…
 
Memory After Cleaning with CleanMem
——————————————————————————–
Memory Total: 1,75 GB
Memory Used: 825,57 MB(46,0909%)
Memory Avail.: 965,61 MB
——————————————————————————–
 
Starting Repairs…
   Started at (27/07/2017 19:16:49)
 
Setting Any Missing 'InstallDate' From Uninstall Sections Before Running Repair…
Total Missing 'InstallDate' Fixed: 1
 
01 - Reset Registry Permissions
   Restore Windows 7/8/10 Default Registry Permissions
   Start (27/07/2017 19:16:50)
 
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\hku.7z
Done,  0,22 seconds.
 
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\hklm.7z
Done,  4,23 seconds.
 
   Running Repair Under System Account
   Done (27/07/2017 19:17:47)
 
02 - Reset File Permissions
   Restore Windows 7/8/10 Default File Permissions
   Start (27/07/2017 19:17:48)
 
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\default.7z
Done,  0,14 seconds.
 
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\profile.7z
Done,  0,16 seconds.
 
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\program_files.7z
Done,  0,16 seconds.
 
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\program_files_x86.7z
Done,  0,16 seconds.
 
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\programdata.7z
Done,  0,16 seconds.
 
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\windows.7z
Done,  2,9 seconds.
 
   Running Repair Under System Account
   Done (27/07/2017 19:19:45)
 
03 - Reset Service Permissions
   Start (27/07/2017 19:19:45)
 
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:20:02)
 
04 - Register System Files
   Start (27/07/2017 19:20:02)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:20:21)
 
05 - Repair WMI
   Start (27/07/2017 19:20:21)
 
   Starting Security Center So We Can Export The Security Info.
 
   Exporting Antivirus Info…
   Avast Antivirus Exported.
   Emsisoft Anti-Malware Exported.
 
   Exporting AntiSpyware Info…
   Emsisoft Anti-Malware Exported.
   Windows Defender Exported.
   Avast Antivirus Exported.
 
   Exporting 3rd Party Firewall Info…
   No Firewall Products Reported.
 
   Running Repair Under Current User Account
   Done (27/07/2017 19:21:49)
 
06 - Repair Windows Firewall
   Start (27/07/2017 19:21:49)
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\services.7z
Done,  0,23 seconds.
 
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:22:21)
 
07 - Repair Internet Explorer
   Start (27/07/2017 19:22:21)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:22:27)
 
08 - Repair MDAC/MS Jet
   Start (27/07/2017 19:22:27)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:22:33)
 
09 - Repair Hosts File
   Start (27/07/2017 19:22:33)
   Running Repair Under System Account
   Done (27/07/2017 19:22:34)
 
10 - Remove Policies Set By Infections
   Start (27/07/2017 19:22:34)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:22:42)
 
11 - Repair Start Menu Icons Removed By Infections
   Start (27/07/2017 19:22:43)
   Running Repair Under System Account
   Done (27/07/2017 19:22:44)
 
12 - Repair Icons
   Start (27/07/2017 19:22:44)
   Running Repair Under Current User Account
   Done (27/07/2017 19:23:13)
 
13 - Repair Network
   Start (27/07/2017 19:23:13)
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\services.7z
Done,  0,22 seconds.
 
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:23:33)
 
14 - Remove Temp Files
   Start (27/07/2017 19:23:33)
   Running Repair Under System Account
   Done (27/07/2017 19:23:34)
 
15 - Repair Proxy Settings
   Start (27/07/2017 19:23:34)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:23:36)
 
16 - Repair Windows Updates
   Start (27/07/2017 19:23:36)
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\services.7z
Done,  0,17 seconds.
 
   Running Repair Under Current User Account
   Running Repair Under System Account
   Setting Windows Updates Files That Are In Use To Be Removed At Next Boot.
   Done (27/07/2017 19:24:03)
 
17 - Repair CD/DVD Missing/Not Working
   Start (27/07/2017 19:24:03)
   iTunes or GEARAspiWDM.sys not found, not applying UpperFilters iTunes Reg Key
   Done (27/07/2017 19:24:03)
 
18 - Repair Volume Shadow Copy Service
   Start (27/07/2017 19:24:03)
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\services.7z
Done,  0,16 seconds.
 
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:24:41)
 
19 - Repair Windows Sidebar/Gadgets
   Start (27/07/2017 19:24:41)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:24:44)
 
20 - Repair MSI (Windows Installer)
   Start (27/07/2017 19:24:44)
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\services.7z
Done,  0,25 seconds.
 
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:24:55)
 
21 - Repair Windows Snipping Tool
   Start (27/07/2017 19:24:55)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:24:57)
 
22.01 - Repair bat Association
   Start (27/07/2017 19:24:57)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:24:59)
 
22.02 - Repair cmd Association
   Start (27/07/2017 19:24:59)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:01)
 
22.03 - Repair com Association
   Start (27/07/2017 19:25:01)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:04)
 
22.04 - Repair Directory Association
   Start (27/07/2017 19:25:04)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:06)
 
22.05 - Repair Drive Association
   Start (27/07/2017 19:25:06)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:08)
 
22.06 - Repair exe Association
   Start (27/07/2017 19:25:08)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:10)
 
22.07 - Repair Folder Association
   Start (27/07/2017 19:25:10)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:12)
 
22.08 - Repair inf Association
   Start (27/07/2017 19:25:12)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:15)
 
22.09 - Repair lnk (Shortcuts) Association
   Start (27/07/2017 19:25:15)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:17)
 
22.10 - Repair msc Association
   Start (27/07/2017 19:25:17)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:19)
 
22.11 - Repair reg Association
   Start (27/07/2017 19:25:19)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:21)
 
22.12 - Repair scr Association
   Start (27/07/2017 19:25:21)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:23)
 
23 - Repair Windows Safe Mode
   Start (27/07/2017 19:25:24)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:26)
 
24 - Repair Print Spooler
   Start (27/07/2017 19:25:26)
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\services.7z
Done,  0,19 seconds.
 
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:30)
 
25 - Restore Important Windows Services
   Start (27/07/2017 19:25:30)
 
Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\7\services.7z
Done,  0,27 seconds.
 
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:39)
 
26 - Set Windows Services To Default Startup
   Start (27/07/2017 19:25:39)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:48)
 
27.01 - Repair Windows 8/10 App Store
   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.1.7601.23862
 
28 - Repair Windows 8/10 Component Store
   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.1.7601.23862
 
29 - Restore Windows 8/10 COM+ Unmarshalers
   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.1.7601.23862
 
30 - Repair Windows 'New' Submenu
   Start (27/07/2017 19:25:48)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:50)
 
31 - Restore UAC (User Account Control) Settings
   Start (27/07/2017 19:25:51)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (27/07/2017 19:25:53)
 
32 - Repair Performance Counters
   Start (27/07/2017 19:25:53)
   Running Repair Under Current User Account
   Done (27/07/2017 19:25:59)
 
Cleaning up empty logs…
 
All Selected Repairs Done.
   Done at (27/07/2017 19:25:59)
   Total Repair Time: 00:09:12
 
 
…YOU MUST RESTART YOUR SYSTEM…
 
OK, I restart but the PC work only in safety mode, when I ask to Google terremoto(Earthquake) in Italy the replay arrive from yahoo.search, if I clic on replay to this treadh open new schedule in Chrome about Media Traffic.com or "Reimage PC repair …."
Download and used :
 
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-07-25 09:40:57
2017-07-25 10:21 - 2017-07-25 10:21 - 00016923 _____
 
C:\Users\Muletto\Desktop\FRST.txt
2017-07-25 10:21 - 2017-07-25 10:21 - 00000000 ____D C:\FRST
2017-07-25 10:20 - 2017-07-25 10:20 - 02382336 _____ (Farbar) C:\Users\Muletto\Desktop\FRST64.exe
 
 

Start FRST (Please double-click on FRST/FRST64) with Administrator privileges

 

Please download Junkware Removal Tool
or from here http://downloads.mal…es.org/file/jrt
to your desktop.

 

 

Zemana AntiMalware Free
download it from here:


Double-click on the file named Zemana.AntiMalware.Portable to perform a system scan with Zemana AntiMalware Free.

 

Since you already have Malwarebytes Anti-Malware on your machine,  let's update it and run a fresh scan

 
Open Malwarebytes Anti-Malware

  • On the Dashboard click on Update Now
  •  
  • Emsisoft Emergency Kit

Please download Emsisoft Emergency Kit and save it to your desktop. Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop. Leave all settings as they are and click the Extract button at the bottom. A 

  • Shut down your protection software now to avoid potential conflicts.
  •  

"Have you looked in Device Manager to see if there are any yellow or red flags next to divers used on the system?"

Yesssss , no red or yellow icon

 

Malwarebytes Anti Rootkit (MBAR) not to be confused with Malwarebytes Anti-Malware

Follow the instructions in the thread below to run a scan with MBAR. Don't forget to update the database before launching the scan, and once launched, leave MBAR running and do not touch your computer until it is done scanning.

https://forums.malwa…t-malwarebytes/

 

You can try running Windows Repair toolTweaking.com - Windows Repair All-In-One(Portable)

- Download Windows Repair All-In-One (Portable Version) from here.

 

Final Result that now if i start normal window I cannot open Chrome , Tweaking repair  , Zemana AntiMalware  or any doc , a message said + o - "file system error n xxxxxx" cannot open Chrome.exe or Zemana.exe  . When I use Chrome  and I am  on your" ttps://forums.whatthetech.com/index.php?sho…" if I clic on  "Post" often open new schedule  to Media Traffic.com or "Remove Reimage PC". No Comment ?

I know I'm definitely confused, it just seems that something maybe has been downloaded thats brought all this nasty stuff in with it.

By chance, did you reset your browses? with the information posted in reply #8

OK




Can you please run a new FRST scan
  • Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the programme run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Hi ,   Solved , yesterday night ( in Italy ) , i was looking  and reading  other thread and google replay while i was sleeping :D   , i don't know where but  this word are wake up  " restore point "  :-)  , i remember tha 5 years ago  iI solved a problem like this  after 3 days thread  , the problem is I will be infected  every 4/5 years and i forgot the solution  of restore point. One time I helped my daughter office   when they cannot start windows , by consolle  , in my backup  I have  the istruction  for my daughter  , I paste just for funny  but can you see , my english is terrible  , I leave it in Italy if someone know the language  was September 2009. :

"  Oggetto: Ripristino da DOS

 
Accendi il PC tenendo premuto F8 e sul monitor appare una schermata nera  con varie scelte di avvio :
Modalità provvisoria
Modalità provvisoria con rete
Modalità provvisoria con prompt dei comandi
 
usando le frecce di  direzione scegli quella con prompt dei comandi e premi invio.
 
Adesso devi aspettare che il PC compia tutta la fase di avvio  (fase di boot)  come quando funziona normalmente
però sullo schermo non vedi niente, solo scritte ai bordi tipo "modalità provvisoria " ecc. ecc .
 
Terminata la fase di boot deve apparire una finestra con la barra blu in alto dove è scritto cmd.exe
 e sul nero le classiche scritte di DOS  con la versione  di XP che stai usando e sotto :
 
C:\Documents and setting\Muletto>
"muletto" è il nome che io ho aasegnato al mio PC quindi nella tua scritta di dos apparirà il nome assegnato al tuo PC adesso devi digitare senza errori o spazi quello che vedi dopo "muletto" e partendo con uno  \ , quindi :
 
C:\Documents and setting\Muletto>\windows\system32\restore\rstrui.exe
 
Premi invio e dopo alcuni secondi dovrebbe apparire  la schermata  per il Ripristino Configurazione di sistema e ora vai a scegliere un punto di ripristino  di quando il PC funzionava bene .
Può anche essere che uno degli ultimi punti di ripristino  sia stato generato in automatico per sicurezza durante l'installazione di un programma o nuovi driver  che poi ti hanno mandato in blocco il PC , prova con l'ultimo punto di ripristino oppure con uno precedente  se hai problemi , i dati salvati non vengono cancellati , vengono escluse le installazioni di nuovi programmi e spesso piccoli virus.
Invio e ti chiamo al telefono  con skype"
 
This time  in restore point  i have a point the same day that I downloaded the webcam drives  , for safety I schoose  a point of 2 day before  and now everythink work perfectly  and the Desktop is clean from many icon and Logs  like Zeman , JRD, Malwarebyte and MBR  ecc. ecc.  , anyway TY everybody (need somebody :D  ) and don't forget to remember "Restore Point " to your friend :-)
Restore points can be your friend.
We created one when I instructed you to use FRST.

Let's make sure to remove tools and quarantine folders

DelFix
  • Please download DelFix or from Here and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Click the Run button.
  • – This will remove the specialized tools we used to disinfect your system.
    Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete
    ).
***********

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI