Hiya guys! Hope everyone is well since my last visit!
Running Win 8.1 Pro (62 bit with 32 bit for old programs) on a Surface Pro 3 with i3 core and 4 gig RAM. I use Spybpt S&D;, Avast, and CCleaner regularly.
Okay, so many of my fonts aren't working (they default to others like Arial) so I was trying to find the discs to reload them when I came across 'cbstemp/' in my Windows directory. I've been having trouble with Photoshop using too much memory no matter what drive I assign as the scratch drive as well, and Malwarebytes when I use it has just been claiming to scan '0 bytes' so…I think there's something a bit funny here! Over the last few months I did download some free fonts from the same site Zazzle gets theirs', signed up with Twinspires.com for a bit o' playing with the ponies (aka betting on horse racing), and also downloaded and installed LastPass. All through Firefox, aside from Twinspires.com which I use via Chrome.
As always, hope that makes sense. Here are my logs:
aswMBR:
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-08-15 15:34:19
—————————–
15:34:19.748 OS Version: Windows x64 6.2.9200
15:34:19.748 Number of processors: 4 586 0x4501
15:34:19.748 ComputerName: VYTWO UserName: Zhora
15:34:19.936 Initialize success
15:34:25.007 VM: initialized successfully
15:34:25.007 VM: Intel CPU supported virtualized
15:34:29.161 VM: supported disk I/O storport.sys
15:34:37.570 AVAST engine defs: 17081506
15:37:12.531 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000034
15:37:12.534 Disk 0 Vendor: HFS064G3AMNB-2200A 10108L00 Size: 61057MB BusType: 11
15:37:17.560 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000053
15:37:17.570 Disk 1 Vendor: Generic- 1.00 Size: 61057MB BusType: 1
15:37:17.580 VM: Disk 0 MBR read successfully
15:37:17.585 Disk 0 MBR scan
15:37:17.592 Disk 0 unknown MBR code
15:37:17.599 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1
15:37:17.609 Disk 0 scanning C:\windows\system32\drivers
15:37:17.616 Service scanning
15:37:29.068 Modules scanning
15:37:29.094 Disk 0 trace - called modules:
15:37:29.111 ntoskrnl.exe CLASSPNP.SYS disk.sys aswSP.sys ACPI.sys storport.sys intelpep.sys storahci.sys hal.dll
15:37:29.120 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe00080a90770]
15:37:29.128 3 aswSP.sys[fffff801f52631d2] -> nt!IofCallDriver -> [0xffffe00080020b50]
15:37:29.135 5 ACPI.sys[fffff801f4264c21] -> nt!IofCallDriver -> [0xffffe0008001eb50]
15:37:29.143 7 ACPI.sys[fffff801f4264c21] -> nt!IofCallDriver -> \Device\00000034[0xffffe0008001e060]
15:37:29.267 AVAST engine scan C:\windows
15:37:29.274 AVAST engine scan C:\windows\system32
15:37:29.282 AVAST engine scan C:\windows\system32\drivers
15:37:29.290 AVAST engine scan C:\Users\Christine
15:37:29.297 AVAST engine scan C:\ProgramData
15:37:29.302 Scan finished successfully
15:37:46.494 Disk 0 MBR has been saved successfully to "C:\Users\Christine\Desktop\MBR.dat"
15:37:46.504 The log file has been saved successfully to "C:\Users\Christine\Desktop\aswMBR.txt"
FRST64:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-08-2017 01
Ran by [removed] (administrator) on VYTWO (15-08-2017 15:42:11)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 8.1 Pro (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Western Digital) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16.0.3327.1048_x64__8wekyb3d8bbwe\onenoteim.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(LastPass) C:\Program Files (x86)\LastPass\lastapp_x64.exe
(Microsoft Corporation) C:\Windows\System32\UserAccountBroker.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
() C:\Program Files (x86)\Western Digital\WD Print Share\WDPrintShare.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213832 2017-07-30] (AVAST Software)
HKLM\…\Run: [LastApp] => C:\Program Files (x86)\LastPass\lastapp_x64.exe [20295760 2016-06-23] (LastPass)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-07-14] (Apple Inc.)
HKLM-x32\…\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\…\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2011-03-09] (CyberLink)
HKLM-x32\…\Run: [WD UDS Control Center] => C:\Program Files (x86)\Western Digital\WD Print Share\WDPrintShare.exe [19840512 2012-03-16] ()
HKLM-x32\…\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5234072 2012-02-27] (Western Digital Technologies, Inc.)
HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-02] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1087184 2016-01-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\Run: [Spybot-S&D; Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [5915776 2016-03-21] (Safer-Networking Ltd.)
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9818328 2017-06-30] (Piriform Ltd)
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\Run: [EPLTarget\P0000000000000000] => C:\windows\system32\spool\DRIVERS\x64\3\E_YATINPE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Mystify.scr [133632 2014-10-28] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2015-02-02]
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{F154B9C9-445D-4F68-B7F5-49E2D13B6D8A}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q;={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q;={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-07-02] (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-07-02] (AVAST Software)
FireFox:
========
FF ProfilePath: C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380 [2017-08-15]
FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380 -> Startpage (SSL)
FF Homepage: Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380 -> hxxp://forecast.weather.gov/MapClick.php?CityName=Bellingham&state;=WA&site;=SEW&textField1;=48.7597&textField2;=-122.487&e;=0#.Vfzn9ZetwqM
FF Extension: (YouTube Video and Audio Downloader) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\[removed] [2017-05-20]
FF Extension: (Privacy Badger) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\[removed] [2017-07-24]
FF Extension: (LastPass: Free Password Manager) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\[removed] [2017-08-09]
FF Extension: (uBlock Origin) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\[removed] [2017-07-19]
FF Extension: (Avast Online Security) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\[removed] [2017-06-06]
FF Extension: (ColorfulTabs) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2017-07-06]
FF Extension: (NoScript) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-07-29]
FF Extension: (FireFTP) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2017-01-25]
FF Extension: (Download YouTube Videos as MP4) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2017-02-14]
FF Extension: (Theme Font & Size Changer) - C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\Extensions\{f69e22c7-bc50-414a-9269-0f5c344cd94c}.xpi [2017-06-17]
FF SearchPlugin: C:\Users\Christine\AppData\Roaming\Mozilla\Firefox\Profiles\pnoorcdr.default-1442637247380\searchplugins\startpage-ssl.xml [2015-09-18]
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_26_0_0_137.dll [2017-07-14] ()
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_137.dll [2017-07-14] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-02] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-02] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2017-07-05]
Chrome:
=======
CHR DefaultProfile: Default
CHR StartupUrls: Default -> "hxxps://www.twinspires.com/"
CHR Profile: C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default [2017-08-14]
CHR Extension: (Google Slides) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-29]
CHR Extension: (Google Docs) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-29]
CHR Extension: (Google Drive) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-01-23]
CHR Extension: (YouTube) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-01-23]
CHR Extension: (Google Search) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-23]
CHR Extension: (Avast Online Security (BETA)) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\daanglpcpkjjlkhcbladppjphglbigam [2017-08-11]
CHR Extension: (Google Sheets) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-29]
CHR Extension: (Google Docs Offline) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-22]
CHR Extension: (Avast Online Security) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-06-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-05-06]
CHR Extension: (Gmail) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
CHR Extension: (Chrome Media Router) - C:\Users\Christine\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-11]
CHR HKLM-x32\…\Chrome\Extension: [daanglpcpkjjlkhcbladppjphglbigam] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-08-2017 01
Ran by [removed] (15-08-2017 15:42:58)
Running from C:\Users\[removed]\Desktop
Windows 8.1 Pro (Update) (X64) (2015-01-16 01:32:02)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-4076533348-1329319317-2442182388-500 - Administrator - Disabled)
Guest (S-1-5-21-4076533348-1329319317-2442182388-501 - Limited - Disabled)
Moonscream (S-1-5-21-4076533348-1329319317-2442182388-1004 - Limited - Enabled)
Zhora (S-1-5-21-4076533348-1329319317-2442182388-1001 - Administrator - Enabled) => C:\Users\Christine
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 16.04 (x64 edition) (HKLM\…\{23170F69-40C1-2702-1604-000001000000}) (Version: 16.04.00.0 - Igor Pavlov)
Adobe Flash Player 26 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 26.0.0.137 - Adobe Systems Incorporated)
Adobe Flash Player 26 PPAPI (HKLM-x32\…\Adobe Flash Player PPAPI) (Version: 26.0.0.151 - Adobe Systems Incorporated)
Adobe Photoshop 7.0.1 (HKLM-x32\…\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIM for Windows (HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\AIM) (Version: - AOL Inc.)
Amazon Kindle (HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\Amazon Kindle) (Version: 1.20.1.47037 - Amazon)
Amazon Send to Kindle (HKLM-x32\…\SendToKindle) (Version: 1.1.0.243 - Amazon)
Apple Application Support (32-bit) (HKLM-x32\…\{D2FE6376-E549-4F63-A2C5-CA24DA035DE4}) (Version: 5.6 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{BB109E24-EE90-485B-A28B-ADDEFB40540B}) (Version: 5.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{0A596141-97D5-45FA-9281-98DFAF48D579}) (Version: 10.3.2.3 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
Audacity 2.0.3 (HKLM-x32\…\Audacity_is1) (Version: 2.0.3 - Audacity Team)
AudibleManager (HKLM-x32\…\AudibleManager) (Version: 3801776.1637756.4759644.48 - Audible, Inc.)
Avast Free Antivirus (HKLM-x32\…\Avast Antivirus) (Version: 17.5.2303 - AVAST Software)
Bonjour (HKLM\…\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CCleaner (HKLM\…\CCleaner) (Version: 5.32 - Piriform)
ComicRack v0.9.176 (HKLM\…\ComicRack) (Version: v0.9.176 - cYo Soft)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
Easy Photo Scan (HKLM-x32\…\{BB6241FF-8B76-45A5-95B9-888EDE8E47DC}) (Version: 1.00.0010 - Seiko Epson Corporation)
Epson Customer Research Participation (HKLM\…\{B26449A6-6007-4460-B4FE-C4776115BCEA}) (Version: 1.81.0000 - Seiko Epson Corporation)
Epson Event Manager (HKLM-x32\…\{9F205E94-9E42-4486-A92A-DF3F6CB85444}) (Version: 3.10.0061 - Seiko Epson Corporation)
EPSON Scan (HKLM-x32\…\EPSON Scanner) (Version: - Seiko Epson Corporation)
Epson Software Updater (HKLM-x32\…\{7BAC3F7A-B963-468E-982E-B5608A87408D}) (Version: 4.4.4 - SEIKO EPSON CORPORATION)
EPSON XP-520 Series Printer Uninstall (HKLM\…\EPSON XP-520 Series) (Version: - SEIKO EPSON Corporation)
Epson XP-520 User’s Guide version 1.0 (HKLM-x32\…\UsersGuideEpson XP-520 User’s Guide_is1) (Version: 1.0 - )
EpsonNet Print (HKLM\…\{F983229B-587E-4322-BCB9-D7A49734E5CD}) (Version: 3.0.0.0 - SEIKO EPSON CORPORATION)
FFmpeg (Windows) for Audacity version 2.2.2 (HKLM-x32\…\{9C7E31E3-017F-434C-AC40-24431A354A1E}_is1) (Version: 2.2.2 - )
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 60.0.3112.90 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.169 - Google Inc.) Hidden
iCloud (HKLM\…\{C510BB61-AE0B-4420-87AF-9CF646E86364}) (Version: 6.2.3.17 - Apple Inc.)
iTunes (HKLM\…\{02F95875-9527-49CC-B32F-970ADAEBD1EF}) (Version: 12.6.2.20 - Apple Inc.)
Jarte (HKLM-x32\…\Jarte_is1) (Version: 6.1 - Carolina Road Software L.L.C.)
LastPass for Applications (HKLM-x32\…\LastApp) (Version: - LastPass)
LG ODD Auto Firmware Update (HKLM-x32\…\{6179550A-3E7C-499E-BCC9-9E8113E0A285}) (Version: 10.01.0712.01 - )
Malwarebytes version 3.0.6.1469 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
Microsoft Office Converter Pack (HKLM-x32\…\{6EECB283-E65F-40EF-86D3-D51BF02A8D43}) (Version: 11.0.0.0 - Microsoft Corporation - Office Resource Kit Group)
Microsoft Office Word Viewer 2003 (HKLM-x32\…\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\…\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\…\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 53.0 (x64 en-US) (HKLM\…\Mozilla Firefox 53.0 (x64 en-US)) (Version: 53.0 - Mozilla)
Mozilla Firefox 54.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 54.0.1 (x86 en-US)) (Version: 54.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 53.0 - Mozilla)
Mozilla Thunderbird 52.2.1 (x86 en-US) (HKLM-x32\…\Mozilla Thunderbird 52.2.1 (x86 en-US)) (Version: 52.2.1 - Mozilla)
My Net View (HKLM-x32\…\{FCD12FCE-AAFA-450C-9AF0-290D6DE60B9A}) (Version: 1.0.1.6 - Western Digital)
N-trig Wintab x64 (HKLM-x32\…\{044886EF-A04E-4C84-AAAE-257815D510C5}) (Version: 1.0.17 - N-trig)
Skype™ 7.39 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.39.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
VLC media player (HKLM\…\VLC media player) (Version: 2.2.4 - VideoLAN)
WD Print Share (HKLM-x32\…\{7790101E-94CC-47B0-B715-4955B75C7A30}) (Version: 2.22 - WD Corporation)
WD Quick View (HKLM-x32\…\{BC682D66-153E-44E2-BEF5-9E0DC3D652DB}) (Version: 1.6.0.13 - Western Digital)
zMUD 7.21.0.0 (HKLM-x32\…\zMUD) (Version: 7.21.0.0 - Zugg Software)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-30] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-30] (AVAST Software)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-30] (AVAST Software)
ContextMenuHandlers1: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2017-07-14] (Apple Inc.)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-30] (AVAST Software)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2016-12-14] (Malwarebytes)
ContextMenuHandlers3: [STKContextMenu] -> {90DD7445-E924-4c6e-92AC-01F8C3A7E0C7} => C:\Program Files (x86)\Amazon\SendToKindle\stkContextMenu_243.dll [2016-01-16] (Amazon.com, Inc.)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxOSP] -> {FA507C3F-30C6-4DCA-9EE5-2656072EEC14} => -> No File
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-30] (AVAST Software)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2016-12-14] (Malwarebytes)
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1E1C7106-271A-459F-B744-9AA17B977123} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-18] (Google Inc.)
Task: {3FA8F0B2-0D57-4F73-B7E7-0142B1FCC140} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {45F05E9A-EC03-4480-9ACE-689962C34121} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
Task: {47DA447F-D4CC-485F-B1B3-0BADFB9F5215} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {7060F528-49C6-4FE1-8A1C-D071897AF922} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-18] (Google Inc.)
Task: {7F54B5CE-8A68-4CDE-A4BC-1A31A693471B} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_26_0_0_151_pepper.exe [2017-08-12] (Adobe Systems Incorporated)
Task: {8E39EB3B-A9A8-486B-919E-439F4AA7619D} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-07-30] (AVAST Software)
Task: {AE1DB3A6-0602-4F00-A511-189AC67784E9} - System32\Tasks\{0AF40163-D0E9-4575-B5B7-6456B3D8CEAB} => "c:\program files (x86)\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/7.13.0.101/en/abandoninstall?page=tsMain
Task: {BAAD5EDD-5BB5-431C-99E1-07A3A3015135} - System32\Tasks\EPSON XP-520 Series Update {4E33FB90-EDAD-44F3-80CC-C08FF5D5493B} => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSNPE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {C077AB48-9CA8-4349-9D25-4FE9BF19BC0D} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-07-12] (AVAST Software)
Task: {C5B45104-8538-4181-813C-8A2D4CF98DE2} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {CED8B126-0481-455A-8766-7BEE2D1C2D41} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-06-30] (Piriform Ltd)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\EPSON XP-520 Series Update {4E33FB90-EDAD-44F3-80CC-C08FF5D5493B}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSNPE.EXE:/EXE:{4E33FB90-EDAD-44F3-80CC-C08FF5D5493B} /F:UpdateWORKGROUP\VYTWO$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2016-09-01 18:12 - 2016-09-01 18:12 - 000092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-07-13 20:50 - 2017-07-13 20:50 - 001354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-03-16 18:55 - 2012-03-16 18:55 - 019840512 _____ () C:\Program Files (x86)\Western Digital\WD Print Share\WDPrintShare.exe
2015-01-15 19:55 - 2014-05-13 13:04 - 000109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-01-15 19:55 - 2014-05-13 13:04 - 000167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-01-15 19:55 - 2014-05-13 13:04 - 000416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-15 19:55 - 2012-08-23 11:38 - 000574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-01-15 19:55 - 2012-04-03 18:06 - 000565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2017-07-30 23:29 - 2017-07-30 23:29 - 000170224 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-07-30 23:30 - 2017-07-30 23:30 - 001065936 _____ () C:\Program Files\AVAST Software\Avast\AvChrome.dll
2017-07-02 19:48 - 2017-07-02 19:49 - 067109376 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-07-30 23:30 - 2017-07-30 23:30 - 000192664 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
2017-07-30 23:30 - 2017-07-30 23:30 - 000224256 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
2017-07-30 23:29 - 2017-07-30 23:29 - 000292920 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-07-30 23:30 - 2017-07-30 23:30 - 000689272 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2011-03-09 15:21 - 2011-03-09 15:21 - 000619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2011-03-09 15:21 - 2011-03-09 15:21 - 000013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:359B3BDA [360]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\…\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\…\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\…\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\…\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\…\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\…\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\…\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\…\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\…\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\…\123simsen.com -> www.123simsen.com
There are 7936 more sites.
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\123simsen.com -> www.123simsen.com
There are 7936 more sites.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 06:25 - 2017-08-12 19:47 - 000454436 ____R C:\windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
There are 15596 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\Control Panel\Desktop\\Wallpaper -> C:\Creative\Others Work\chris1.tif
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
HKLM\…\StartupApproved\StartupFolder: => "Microsoft Office.lnk"
HKLM\…\StartupApproved\Run: => "iTunesHelper"
HKLM\…\StartupApproved\Run32: => "Adobe ARM"
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\StartupApproved\Run: => "EPLTarget\P0000000000000000"
HKU\S-1-5-21-4076533348-1329319317-2442182388-1001\…\StartupApproved\Run: => "iCloudServices"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{7A972945-FE4C-4419-A3CC-8261273791E1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8F0DF31B-A64D-40DE-8017-FE8A5B04D501}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{BC1E7BC8-6571-4DC3-810C-7C3BCE45AAB4}C:\program files (x86)\western digital\wd print share\wdprintshare.exe] => (Block) C:\program files (x86)\western digital\wd print share\wdprintshare.exe
FirewallRules: [UDP Query User{B977EEDE-E086-4910-ADA5-A6D424291335}C:\program files (x86)\western digital\wd print share\wdprintshare.exe] => (Block) C:\program files (x86)\western digital\wd print share\wdprintshare.exe
FirewallRules: [TCP Query User{13AD8E24-0E69-49F5-9CDA-2573D8B748A5}C:\program files (x86)\western digital\wd print share\wdprintshare.exe] => (Block) C:\program files (x86)\western digital\wd print share\wdprintshare.exe
FirewallRules: [UDP Query User{69061637-46C7-4C77-83F6-6B9C59A66D39}C:\program files (x86)\western digital\wd print share\wdprintshare.exe] => (Block) C:\program files (x86)\western digital\wd print share\wdprintshare.exe
FirewallRules: [TCP Query User{3B7AA273-24A4-4A7B-8C94-F2A93C444C86}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [UDP Query User{6C6A55F5-D876-4980-B38D-6B9F942EA989}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [TCP Query User{7A4AF99C-3E8F-412C-81DA-B5238CDBFAD6}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{16F1D234-40A3-4417-B27F-DE816431D577}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{B6E25DB1-9B59-4DFE-9FCF-E79ADDB1DEA0}C:\program files\comicrack\comicrack.exe] => (Block) C:\program files\comicrack\comicrack.exe
FirewallRules: [UDP Query User{15F0BE86-1E51-4F60-A8EB-0FBE68C8E07C}C:\program files\comicrack\comicrack.exe] => (Block) C:\program files\comicrack\comicrack.exe
FirewallRules: [TCP Query User{EA4BA878-EE39-4500-A36E-8BFDD10B7207}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{A7F133DC-7E57-43E0-9912-2DE7CD75378B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8265F243-A86D-414A-899C-889E26E3E48E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B7529342-6605-4571-A19F-6A891BEAC89D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E0D8A111-DC1A-40A4-B70E-EAAAE8B58E6F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0850721F-EF00-4C05-8A0B-0A2DA8213E8A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{3B1C1167-2588-4323-BB41-429813634302}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{62D22639-376C-4763-8269-611769C297EF}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [{45FD9A1C-7F4F-400A-ADFD-4AFB443D64E5}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [{FE8DBC33-DB19-4A9A-9803-5A2C97A3C466}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe
FirewallRules: [{3DED08FF-0D96-44A0-B7D5-E18C8A2CFEC2}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe
FirewallRules: [{059E8A9B-6FBC-4C37-B782-C0CD0F037888}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [{78308F9B-7241-46C4-AB54-55D1CDB6AFB0}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [{7EF22AEA-261D-42B1-A58B-9C297568028C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{4B56B02A-BCFF-4550-A520-816DCE882B1C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{25CD0702-7360-4DEA-B155-27676AAE1F5B}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{5405C33A-52C3-4A31-B28B-0F552AE8F031}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service
==================== Restore Points =========================
12-08-2017 20:38:06 Windows Update
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/14/2017 11:03:30 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-4076533348-1329319317-2442182388-1001}/">.
Error: (08/14/2017 12:08:19 AM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-4076533348-1329319317-2442182388-1001}/">.
Error: (08/13/2017 02:50:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: chrome.exe, version: 60.0.3112.90, time stamp: 0x59813988
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x000004cd998a12f0
Faulting process id: 0x4f8
Faulting application start time: 0x01d314664b5689d4
Faulting application path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Faulting module path: unknown
Report Id: 73c3646d-8071-11e7-857e-600292d3746c
Faulting package full name:
Faulting package-relative application ID:
Error: (08/12/2017 11:54:25 PM) (Source: MsiInstaller) (EventID: 1024) (User: VYTWO)
Description: Product: Adobe Reader XI - Update '{AC76BA86-7AD7-0000-2550-7A8C40011020}' could not be installed. Error code 1625. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127
Error: (08/12/2017 11:38:25 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-4076533348-1329319317-2442182388-1001}/">.
Error: (08/12/2017 09:06:30 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-4076533348-1329319317-2442182388-1001}/">.
Error: (08/12/2017 08:53:20 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-4076533348-1329319317-2442182388-1001}/">.
Error: (08/12/2017 08:51:25 PM) (Source: ESENT) (EventID: 455) (User: )
Description: taskhostex (4452) WebCacheLocal: Error -1032 (0xfffffbf8) occurred while opening logfile C:\Users\Christine\AppData\Local\Microsoft\Windows\WebCache\V01.log.
Error: (08/12/2017 08:51:25 PM) (Source: ESENT) (EventID: 489) (User: )
Description: taskhostex (4452) WebCacheLocal: An attempt to open the file "C:\Users\Christine\AppData\Local\Microsoft\Windows\WebCache\V01.log" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8).
Error: (08/12/2017 08:51:14 PM) (Source: ESENT) (EventID: 455) (User: )
Description: taskhostex (4452) WebCacheLocal: Error -1032 (0xfffffbf8) occurred while opening logfile C:\Users\Christine\AppData\Local\Microsoft\Windows\WebCache\V01.log.
System errors:
=============
Error: (08/15/2017 07:38:29 AM) (Source: DCOM) (EventID: 10010) (User: VYTWO)
Description: The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout.
Error: (08/15/2017 07:18:22 AM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer DEPTHCHARGE
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F154B9C9-445D-4F68-B7F5-49E2D13B6D8A}.
The master browser is stopping or an election is being forced.
Error: (08/15/2017 06:00:12 AM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (08/15/2017 05:52:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueStacks Plus Hypervisor service failed to start due to the following error:
The system cannot find the path specified.
Error: (08/14/2017 06:59:55 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
Error: (08/14/2017 03:31:18 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.
Error: (08/14/2017 11:05:42 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Apple Mobile Device Service service.
Error: (08/14/2017 09:30:18 AM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer DEPTHCHARGE
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F154B9C9-445D-4F68-B7F5-49E2D13B6D8A}.
The master browser is stopping or an election is being forced.
Error: (08/14/2017 06:23:13 AM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (08/14/2017 06:19:52 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueStacks Plus Hypervisor service failed to start due to the following error:
The system cannot find the path specified.
CodeIntegrity:
===================================
Date: 2017-08-15 15:40:52.406
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:52.031
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:51.656
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:51.250
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:50.875
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:50.500
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:50.125
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:49.749
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:49.374
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
Date: 2017-08-15 15:40:48.984
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-4020Y CPU @ 1.50GHz
Percentage of memory in use: 54%
Total physical RAM: 4001.07 MB
Available physical RAM: 1808.29 MB
Total Virtual: 4897.07 MB
Available Virtual: 2781.96 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:53.79 GB) (Free:12.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 59.6 GB) (Disk ID: 9E7152E5)
Partition: GPT.
========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: 6FB8D794)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
I also rechecked the availability of the system fonts to Photoshop and Jarte…and they seem to be fine now for some reason. Maybe they were hosed up because of the memory problem that PS was having. I did notice after the first scans that CCleaner was suddenly finding a lot more crap than it had before running them.