What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware check after repair install

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,
 
Earlier this week I performed a W7 install with the help of Ztrucker  :thumbup:  via this thread:
https://forums.whatthetech.com/index.php?showtopic=131298
 
I am concerned about any malware/viruses that may have been on the computer prior to the repai install. Ztrucker thought both that there likely isn’t anything remaing but that it doesn’t hurt to check. So here I am.
 
I was able to download aswMBR and run the scan (log is copied in below).
 
I had trouble with the Farbar. First, everytime I clicked on the link to download the PC would shut down and restart. I did remove some extensions from the Chrome browser earlier in the day and thought that perhaps that was the reason. (Although I did also try to download with IE but the PC shut down and restarted there also). 
 
I restored the PC back to earlier this week when I completed the repair install. After the retore I was able to download Farbar but have been unable to run it as an administrator, I also tried not as an admin with no luck. Initially, Norton 360 didn’t like this but I instructed it to run and then disabled the firewall and auto-protect.
 
What happens is when I try to run it two windows pop up very quickly and disappear as quickly. One window being the disclaimer window.
 
Any suggestions on how to get the Farbar to run?
 
Thanks for help, Denise
 
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-10-06 15:03:16
—————————–
15:03:16.906    OS Version: Windows x64 6.1.7601 Service Pack 1
15:03:16.906    Number of processors: 2 586 0x170A
15:03:16.907    ComputerName: CAROL-PC  UserName: carol
15:03:19.063    Initialize success
15:03:19.068    VM: initialized successfully
15:03:19.069    VM: Intel CPU supported 
15:05:18.463    VM: supported disk I/O iaStor.sys
15:16:28.992    AVAST engine defs: 17030301
15:17:13.916    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
15:17:13.919    Disk 0 Vendor: WDC_WD64 01.0 Size: 610480MB BusType: 3
15:17:14.116    VM: Disk 0 MBR read successfully
15:17:14.120    Disk 0 MBR scan
15:17:14.136    Disk 0 Windows 7 default MBR code
15:17:14.148    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        14000 MB offset 2048
15:17:14.165    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 28674048
15:17:14.171    Disk 0 default boot code
15:17:14.198    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       596378 MB offset 28878848
15:17:14.249    Disk 0 scanning C:\Windows\system32\drivers
15:17:22.617    Service scanning
15:17:43.712    Modules scanning
15:17:43.732    Disk 0 trace - called modules:
15:17:43.747    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 
15:17:43.758    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80057fd060]
15:17:43.768    3 CLASSPNP.SYS[fffff8800120143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80047c3050]
15:17:45.375    AVAST engine scan C:\Windows
15:17:48.529    AVAST engine scan C:\Windows\system32
15:21:07.044    AVAST engine scan C:\Windows\system32\drivers
15:21:27.010    AVAST engine scan C:\Users\carol
15:42:50.624    AVAST engine scan C:\ProgramData
15:52:32.218    Disk 0 statistics 4417218/0/22 @ 1.35 MB/s
15:52:32.227    Scan finished successfully
15:54:51.124    Disk 0 MBR has been saved successfully to "C:\Users\carol\Desktop\MBR.dat"
15:54:51.131    The log file has been saved successfully to "C:\Users\carol\Desktop\aswMBR.txt"
 
 

 

Post #2
Read over the links below to ensure you have disabled Norton correctly.
http://www.nortonsecurityonline.com/faq/art/how-to-temporarily-disable-norton-security/
https://support.norton.com/sp/en/us/home/current/solutions/v116457581_ns_retail_en_us

Then try to run Farbar Recovery Scan Tool again.
If it still wont run let's try booting into safe mode to see if we can use it from there.
Below links have instructions on how to boot into safe mode.
https://www.pcworld.com/article/2984712/windows/how-to-enter-windows-10s-safe-mode.html
http://www.thewindowsclub.com/boot-windows-10-in-safe-mode
https://support.microsoft.com/en-us/help/12376/windows-10-start-your-pc-in-safe-mode


Also, let's see if we can get this tool downloaded, please follow the instructions found on this link.
https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/


Let me know how you make out.
Post #3
Hi Juliet,
 
I was able to get the Farbar to work in safe mode, but ran into a number og error windows as described: Error saving file C:\FRST\HIVES\BCD !  Continue w/next file [RegCreate Key Ex:5-Access denied]
 
I selected Yes as a guess. This was followed by several more error windows all starting with Error saving file but diffent endings as follows
C:\FRST\HIVES\System C:\FRST\HIVES\Software C:\FRST\HIVES\Default
C:\FRST\HIVES\Security C:\FRST\HIVES\SAM
C:\FRST\HIVES\users\00000001\ntuser.dat!  and
C:\FRST\HIVES\userclass\00000002\UsrClass.dat
 
I then ran the scan & tried to copy in both the scan and additional log but it was to log to post. So i copied in the additional text but don't see an option to attach a document.
 
I downloaded and ran the Malwarebytes scan but it came back with nothing to clean.
 
 
Thanks, Denise
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-10-2017
Ran by [removed] (07-10-2017 17:54:52)
Running from C:\Users\[removed]\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2017-09-29 00:42:44)
Boot Mode: Safe Mode (minimal)
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-3023560301-1441740751-2596322319-500 - Administrator - Enabled)
carol (S-1-5-21-3023560301-1441740751-2596322319-1000 - Administrator - Enabled) => C:\Users\carol
Guest (S-1-5-21-3023560301-1441740751-2596322319-501 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Microsoft Security Essentials (Disabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AV: Norton Security Suite (Disabled - Up to date) {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
AS: Microsoft Security Essentials (Disabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Security Suite (Disabled - Up to date) {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
FW: Norton Security Suite (Disabled) {084FC016-54FB-7A6D-DFFC-2B9050228CD1}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
4500_G510gm_Help (HKLM-x32\…\{DF0B357C-5874-47D0-81E7-79AA890B0CE0}) (Version: 000.0.439.000 - Hewlett-Packard) Hidden
4500G510gm (HKLM-x32\…\{BE0D4271-69C9-4f28-AD9B-BB33D126A30E}) (Version: 000.0.423.000 - Hewlett-Packard) Hidden
4500G510gm_Software_Min (HKLM-x32\…\{28379381-B56A-43e1-B505-3098D82B1C30}) (Version: 000.0.423.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (HKLM\…\{55D55008-E5F6-47D6-B16F-B2A40D4D145F}) (Version: 6.2.1 - Hewlett-Packard) Hidden
Acer eRecovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3007 - Acer Incorporated)
Acer Game Console (HKLM-x32\…\Acer Game Console) (Version:  - WildTangent) Hidden
Acer Games (HKLM-x32\…\WildTangent acer Master Uninstall) (Version: 1.0.0.80 - WildTangent)
Acer Registration (HKLM-x32\…\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\…\Acer Screensaver) (Version: 1.1.0318.2010 - Acer Incorporated)
Acer System Information (HKLM-x32\…\{72199E33-4F2A-4B7F-8E25-95DDDD50A678}) (Version: 1.0.0 - Acer)
Acer Updater (HKLM-x32\…\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)
Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.012.20098 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 27 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 27.0.0.130 - Adobe Systems Incorporated)
Adobe Flash Player 27 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 27.0.0.130 - Adobe Systems Incorporated)
Advertising Center (HKLM-x32\…\{B2EC4A38-B545-4A00-8214-13FE0E915E6D}) (Version: 0.0.0.2 - Nero AG) Hidden
AVG 2016 (HKLM\…\{32218623-385A-439D-932A-F03EDE611D5F}) (Version: 16.0.4749 - AVG Technologies) Hidden
AVG PC TuneUp 2014 (en-US) (HKLM-x32\…\{8CD86D42-C4DD-4E40-9211-164DFFBCA4DB}) (Version: 14.0.1001.295 - AVG) Hidden
Bejeweled 2 Deluxe (HKLM-x32\…\WT078749) (Version: 2.2.0.82 - WildTangent) Hidden
Blackhawk Striker 2 (HKLM-x32\…\WT078953) (Version: 2.2.0.82 - WildTangent) Hidden
Bob the Builder Can-Do-Zoo (HKLM-x32\…\WT078961) (Version: 2.2.0.82 - WildTangent) Hidden
BufferChm (HKLM-x32\…\{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}) (Version: 130.0.331.000 - Hewlett-Packard) Hidden
Build-a-lot 2 (HKLM-x32\…\WT079193) (Version: 2.2.0.82 - WildTangent) Hidden
Comcast Desktop Software (v1.2.0.9) (HKLM-x32\…\{CEF7211D-CE3A-44C4-B321-D84A2099AE94}) (Version: 23 - Comcast)
D3DX10 (HKLM-x32\…\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (HKLM-x32\…\{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}) (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (HKLM-x32\…\{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}) (Version: 130.0.372.000 - Hewlett-Packard) Hidden
DocMgr (HKLM-x32\…\{92A51949-EE4C-466D-AAF0-99E74A49A63F}) (Version: 130.0.000.000 - Hewlett-Packard) Hidden
DocProc (HKLM-x32\…\{9B362566-EC1B-4700-BB9C-EC661BDE2175}) (Version: 13.0.0.0 - Hewlett-Packard) Hidden
eBay Worldwide (HKLM-x32\…\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
Escape Rosecliff Island (HKLM-x32\…\WT079218) (Version: 2.2.0.82 - WildTangent) Hidden
Faerie Solitaire (HKLM-x32\…\WT079017) (Version: 2.2.0.82 - WildTangent) Hidden
FATE - The Traitor Soul (HKLM-x32\…\WT079021) (Version: 2.2.0.82 - WildTangent) Hidden
Fax (HKLM-x32\…\{440B915A-0C85-45DB-92AE-75AE14704A64}) (Version: 130.0.418.000 - Hewlett-Packard) Hidden
File Type Assistant (HKLM-x32\…\Trusted Software Assistant_is1) (Version: 2014.5.6.0 - ) <==== ATTENTION
Flash Movie Player 1.5 (HKLM-x32\…\Flash Movie Player) (Version: 1.5 - Eolsoft)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
GPBaseService2 (HKLM-x32\…\{63FF21C9-A810-464F-B60A-3111747B1A6D}) (Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hotkey Utility (HKLM-x32\…\Hotkey Utility) (Version: 2.05.3009 - Acer Incorporated)
HP Document Manager 2.0 (HKLM\…\HP Document Manager) (Version: 2.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\…\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Officejet 4500 G510g-m (HKLM\…\{E5083D57-D93F-404C-A91F-1C50D67C2BEB}) (Version: 13.0 - HP)
HP Smart Web Printing 4.5 (HKLM\…\HP Smart Web Printing) (Version: 4.5 - HP)
HP Solution Center 13.0 (HKLM\…\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\…\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPProductAssistant (HKLM-x32\…\{C43326F5-F135-4551-8270-7F7ABA0462E1}) (Version: 130.0.371.000 - Hewlett-Packard) Hidden
Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImagXpress (HKLM-x32\…\{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}) (Version: 7.0.74.0 - Nero AG) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version:  - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\…\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Internet Helper Anti-phishing (HKLM-x32\…\Internet Helper Anti-phishing) (Version: 1.2.0.0 - Internet Helper (Powered by Panda Security))
Itibiti RTC (HKLM-x32\…\{730E03E4-350E-48E5-9D3E-4329903D454D}) (Version: 0.0.1 - Itibiti Inc) Hidden <==== ATTENTION
Java 8 Update 144 (64-bit) (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F64180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
Java 8 Update 144 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F32180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
Jewel Quest Solitaire 3 (HKLM-x32\…\WT079065) (Version: 2.2.0.82 - WildTangent) Hidden
Junk Mail filter update (HKLM-x32\…\{0BE9E708-5DC0-4963-9CFD-0AA519090E79}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
LibreOffice 3.5 (HKLM-x32\…\{EF790F1C-CB0C-4B95-8C54-60783F3B6661}) (Version: 3.5.4.2 - The Document Foundation)
Microsoft .NET Framework 4.7 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\…\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2010 - English (HKLM-x32\…\{90140011-0061-0409-0000-0000000FF1CE}) (Version: 14.0.6109.5003 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\…\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\…\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\…\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\…\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\…\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\…\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Monopoly (HKLM-x32\…\WT079097) (Version: 2.2.0.82 - WildTangent) Hidden
Movie Maker (HKLM-x32\…\{38F03569-A636-4CF3-BDDE-032C8C251304}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\…\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mystery P.I. - Lost in Los Angeles (HKLM-x32\…\WT079101) (Version: 2.2.0.82 - WildTangent) Hidden
MyWinLocker (HKLM-x32\…\{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}) (Version: 3.1.206.0 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\…\{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.206.0 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\…\InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.206.0 - Egis Technology Inc.)
Nero 9 Essentials (HKLM-x32\…\{e91d40c0-7df2-4eea-a808-69d9e41ca849}) (Version:  - Nero AG)
Network64 (HKLM\…\{A4DDB2AB-ECCD-4C3A-8633-77D5A1A0E542}) (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Norton Security Suite (HKLM-x32\…\N360) (Version: 22.10.1.10 - Symantec Corporation)
OCR Software by I.R.I.S. 13.0 (HKLM\…\HPOCR) (Version: 13.0 - HP)
OpenOffice 4.0.0 (HKLM-x32\…\{55E61709-D7D4-43C0-B45D-BFAF5C09A02D}) (Version: 4.00.9702 - Apache Software Foundation)
OpenOffice Impress Free Download Packages (HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\OpenOffice Impress Free Download Packages) (Version:  - ) <==== ATTENTION
Penguins! (HKLM-x32\…\WT079105) (Version: 2.2.0.82 - WildTangent) Hidden
Performancer (HKLM-x32\…\{5F189DF5-2D05-472B-9091-84D9848AE48B}{dfc86759}) (Version:  - 24soft) <==== ATTENTION
Plants vs. Zombies (HKLM-x32\…\WT079109) (Version: 2.2.0.82 - WildTangent) Hidden
Polar Bowler (HKLM-x32\…\WT079113) (Version: 2.2.0.82 - WildTangent) Hidden
Polar Golfer (HKLM-x32\…\WT079117) (Version: 2.2.0.82 - WildTangent) Hidden
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)
Scan (HKLM-x32\…\{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}) (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Scrabble Plus (HKLM-x32\…\WT079149) (Version: 2.2.0.82 - WildTangent) Hidden
ShopAtHome.com Helper (HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\ShopAtHome.com Helper) (Version: 7.10.2.6 - ShopAtHome.com) <==== ATTENTION
Shredder (HKLM\…\{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}) (Version: 2.0.5.0 - Egis Technology Inc.) Hidden
Shredder (HKLM-x32\…\{C2695E83-CF1D-43D1-84FE-B3BEC561012A}) (Version: 2.0.5.0 - Egis Technology Inc.) Hidden
SmartWebPrinting (HKLM-x32\…\{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolutionCenter (HKLM-x32\…\{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (HKLM-x32\…\{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden
The Price is Right (HKLM-x32\…\WT079153) (Version: 2.2.0.82 - WildTangent) Hidden
Toolbox (HKLM-x32\…\{6BBA26E9-AB03-4FE7-831A-3535584CA002}) (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (HKLM-x32\…\{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}) (Version: 130.0.376.000 - Hewlett-Packard) Hidden
Virtual Families (HKLM-x32\…\WT079643) (Version: 2.2.0.82 - WildTangent) Hidden
Virtual Villagers - A New Home (HKLM-x32\…\WT079173) (Version: 2.2.0.82 - WildTangent) Hidden
Visual Studio 2010 x64 Redistributables (HKLM\…\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WebReg (HKLM-x32\…\{43CDF946-F5D9-4292-B006-BA0D92013021}) (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Welcome Center (HKLM-x32\…\Acer Welcome Center) (Version: 1.00.3013 - Acer Incorporated)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Resource Kit Tools - SubInAcl.exe (HKLM-x32\…\{D3EE034D-5B92-4A55-AA02-2E6D0A6A96EE}) (Version: 5.2.3790.1164 - Microsoft Corporation)
Windows SideShow Managed Runtime 1.0 (HKLM-x32\…\{3516C69A-024D-42A8-B948-FFAA7B9CC49A}) (Version: 1.0.1.0 - Microsoft Corporation)
WinZip 21.5 (HKLM\…\{CD95F661-A5C4-44F5-A6AA-ECDD91C2410F}) (Version: 21.5.12480 - WinZip Computing, S.L. )
Word Free (HKLM-x32\…\wordfree) (Version:  - )
WordFree and Options (HKLM\…\WordFree_and_Options) (Version: 1.0 - WordFree and Options)
Yahoo! Install Manager (HKLM-x32\…\YInstHelper) (Version:  - )
Yahtzee (HKLM-x32\…\WT079179) (Version: 2.2.0.82 - WildTangent) Hidden
Zuma Deluxe (HKLM-x32\…\WT078774) (Version: 2.2.0.82 - WildTangent) Hidden
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ShellIconOverlayIdentifiers: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll [2010-02-01] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll [2010-02-01] (Egis Technology Inc.)
ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers1: [EDSshellExt] -> {29FF7AB0-BE34-4992-A30B-53A9D86EE239} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\mwlshellext.dll [2010-02-01] (Egis Technology Inc.)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers1: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshls64.dll [2017-04-22] (WinZip Computing, S.L.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers3: [ShredderContextMenu] -> {521065F1-DE6C-4E46-BBCB-89B0D0BE860D} => C:\Program Files (x86)\EgisTec Shredder\x64\ShredderContextMenu.dll [2010-01-20] (Egis Technology Inc.)
ContextMenuHandlers4: [EDSshellExt] -> {29FF7AB0-BE34-4992-A30B-53A9D86EE239} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\mwlshellext.dll [2010-02-01] (Egis Technology Inc.)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshls64.dll [2017-04-22] (WinZip Computing, S.L.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2011-02-11] (Intel Corporation)
ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers6: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshls64.dll [2017-04-22] (WinZip Computing, S.L.)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {08E54377-2316-4608-B84B-10891019D759} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files (x86)\File Type Assistant\tsasetup.exe [2014-05-06] ( ) <==== ATTENTION
Task: {0D440409-BB79-4CCC-B2E6-FAF290C9149D} - \RocketTab -> No File <==== ATTENTION
Task: {10D28827-E47F-4CD0-B696-2810F0C8D406} - System32\Tasks\{FB6A4CB3-2A68-4F1C-AD56-BA3B00AAE7CB} => "C:\Program Files (x86)\Internet Explorer\iexplore.exe" hxxp://ui.skype.com/ui/0/4.1.0.179.367/en/abandoninstall?source=lightinstaller&page;=tsMain&installinfo;=google-toolbar:notoffered;notincluded,google-chrome:notoffered;notincluded
Task: {157D295D-24D2-492B-90F6-621261180871} - \TweakBit\FixMyPC\Start FixMyPC оn logon -> No File <==== ATTENTION
Task: {2070012D-BD95-4065-B0BD-BE3ACD78D4FD} - System32\Tasks\IHUninstallTrackingTASK => CMD /C DEL C:\Users\carol\AppData\Local\Temp\IHU1A72.tmp.exe <==== ATTENTION
Task: {213F0603-7FA5-4B57-AEBC-DBA8F3D44CE3} - System32\Tasks\RunTool => C:\Users\carol\AppData\Local\9b5c8493-304a-4fa0-9bd3-a0d03f5220bc\sysad.exe <==== ATTENTION
Task: {25F0D31B-204C-4695-9AAF-53D5D662BEF6} - System32\Tasks\SpeedMaxPc Registration3 => C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\UUS3.dll" RunUns
Task: {295D6EB8-596B-4CDC-8315-724E3AD82188} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {2FB33B15-7E29-4DB2-B39E-269FBD9A68F2} - System32\Tasks\Norton 360\Norton Security Suite Error Processor => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\SymErr.exe [2017-08-24] (Symantec Corporation)
Task: {3173E276-674E-4666-9111-0FBF5F3D9498} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-01-07] (Google Inc.)
Task: {3C4FE846-D64B-4697-B2CF-8D25ED6F104F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-01-07] (Google Inc.)
Task: {3C51A276-5AF7-435C-B823-3049E64E6F49} - System32\Tasks\WinZip Update Notifier => C:\Program Files\WinZip\WZUpdateNotifier.exe [2017-04-22] (WinZip)
Task: {6D18A214-B6AD-46A9-BE09-0667E644AF83} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {7BF28171-2BA8-457E-96D1-BF6D5573BB4D} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\WSCStub.exe [2017-08-24] (Symantec Corporation)
Task: {85CB78FF-807B-4F7D-A9B2-0C6C667D67ED} - System32\Tasks\Adobe online update program => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {88F550D4-608E-4FD0-B6B4-4DE47A6F6F95} - System32\Tasks\Norton 360\Norton Security Suite Error Analyzer => C:\Program Files (x86)\Norton Security Suite\Engine\22.10.1.10\SymErr.exe [2017-08-24] (Symantec Corporation)
Task: {9025989E-868C-4284-B518-205FB91ED3A5} - System32\Tasks\{67A6487D-C69E-4D08-B9AD-7BBDC8DC5D70} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\SelectRebates\SelectRebatesUninstall.exe"
Task: {9E27248D-D93E-47CA-8651-74E13AAFD7F6} - System32\Tasks\0 => c:\program files (x86)\internet explorer\iexplore.exe  <==== ATTENTION
Task: {A20E1206-3691-43EB-8F29-6E228A0320C0} - System32\Tasks\MyTurboPC.com Registration3 => C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\Common Files\MyTurboPC.com\UUS3\UUS3.dll" RunUns
Task: {A9DB109B-CD73-49A7-9F0F-9D9EEE4EDB83} - \PCM_carol_PCMedic_RS_WeeklyTask -> No File <==== ATTENTION
Task: {AF3252E6-04F4-4E26-B7F1-F06FACB194F3} - \RocketTab Update Task -> No File <==== ATTENTION
Task: {B20C08D9-FA77-4B58-A2CA-0F02A45D3861} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {B7B12F05-3C22-4DB6-A155-BB43C9C421ED} - \PCM_carol_PCMedic_LogonTask -> No File <==== ATTENTION
Task: {D2D3433C-15FE-4682-99BB-EE7D3DFCBD6C} - System32\Tasks\4710 => wscript.exe C:\Users\carol\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {D59959B5-E60C-4E87-B512-F08C44D26737} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2017-07-21] (Oracle Corporation)
Task: {D7563B1D-FBF2-4188-A8A0-D973AC8B018B} - System32\Tasks\ProgramUpdateCheck => C:\Program Files (x86)\File Type Assistant\TSAssist.exe [2014-05-06] (FTA ApS) <==== ATTENTION
Task: {DAE43856-188D-4572-8BBA-7FEE54EE7DC8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-12] (Adobe Systems Incorporated)
Task: {F0DE6428-4D68-4998-ABE0-993C41C3252B} - System32\Tasks\{9D975654-99E6-45D8-866B-2930B9CE8B43} => C:\Windows\system32\pcalua.exe -a "C:\Users\carol\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1ANQQOGL\tinyword[1].exe" -d C:\Users\carol\Desktop
Task: {FBED01EF-7D4A-4D16-8CD0-97064A0F17CB} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security Suite\Upgrade.exe [2017-08-24] (Symantec Corporation)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\MyTurboPC.com Registration3.job => rundll32.exe  C:\Program Files (x86)\Common Files\MyTurboPC.com\UUS3\UUS3.dll RunUns C:\Program Files (x86)\Common Files\MyTurboPC.com
Task: C:\Windows\Tasks\SpeedMaxPc Registration3.job => rundll32.exe  C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\UUS3.dll
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\Users\carol\Documents\12327922-000006FD.eml:OEStandardProperty [1627]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\1001movie.com -> 1001movie.com
 
There are 6091 more sites.
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 21:34 - 2015-08-01 11:06 - 000000052 _____ C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\carol\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{44756A77-8006-405F-A2BB-586AE7EF1830}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{257CC6D6-D227-4CCB-9C03-674B62A5C246}] => (Allow) LPort=1900
FirewallRules: [{E26C1118-8918-42F7-A29B-21B64333D743}] => (Allow) LPort=2869
FirewallRules: [{1392B3B7-6D61-4207-893C-F66B94C1C561}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{B46AFE81-0FC7-4D93-96AC-077B8F48D7F0}] => (Allow) C:\Program Files (x86)\File Type Assistant\TSAssist.exe
FirewallRules: [{B434074B-C117-4D82-84BA-6D77533B6D5E}] => (Allow) C:\Program Files (x86)\File Type Assistant\TSAssist.exe
FirewallRules: [{235B14B1-6F6E-43F6-98AE-EBF5422021C5}] => (Allow) C:\Program Files (x86)\File Type Assistant\TSAssist.exe
FirewallRules: [{604680D9-5BE5-4D38-ABE3-4FA7FFD1EEA3}] => (Allow) C:\Program Files (x86)\File Type Assistant\TSAssist.exe
FirewallRules: [{C5700ACA-B579-43B3-B5BB-23DFA7EAB246}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [{E84B5583-E9FE-49DC-9BCE-4FDF6E291F04}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{CD2706C7-3141-461D-B814-A57868053189}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{01E33564-2B87-432E-ABDB-8E4BC58B3BF2}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{B9F447E1-1FD0-4FE6-AAFC-3C72BA56E100}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqfxt08.exe
FirewallRules: [{B661DE7D-9067-48FD-9D01-343EF72E5B64}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxs08.exe
FirewallRules: [{8263B64F-7559-4FF4-B1D6-45B135089327}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{DBDD5585-D4E7-4BCC-AE2D-14E5035EA959}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{CC36AFB1-B4BD-45F2-8C1F-C46F6FFE3C32}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpzwiz01.exe
FirewallRules: [{6D39E014-7FB5-4C62-A8B2-F475EC3DCFFB}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{0C31A2BA-C5F2-4C22-B6EE-02A644751A37}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{0D2B7525-ABC4-4693-A453-355150574732}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{B3E3712B-09BB-4D66-B786-3070A791AFC1}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposfx08.exe
FirewallRules: [{F1C276A0-376A-4176-9734-B2B946592B9B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxm08.exe
FirewallRules: [{65EAF601-E82A-412E-97F2-2968EDC1A231}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{7B79F216-F0A7-4DA7-8356-458C2EDD552B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
FirewallRules: [{408DA168-F32B-4D16-BEFB-57ED9C157ABE}] => (Allow) D:\setup\hpznui40.exe
FirewallRules: [{310F7DDC-8D37-4C8E-A18B-7F631FCE6D5F}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
 
==================== Restore Points =========================
 
02-10-2017 17:21:30 October 2nd 2017
06-10-2017 14:44:48 Windows Update
06-10-2017 17:16:06 Restore Operation
06-10-2017 17:46:41 Windows Update
 
==================== Faulty Device Manager Devices =============
 
Name: Microsoft PS/2 Mouse
Description: Microsoft PS/2 Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (10/07/2017 05:49:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (10/07/2017 05:41:13 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.
 
Error: (10/07/2017 05:41:13 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0061-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.
 
Error: (10/07/2017 05:38:39 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Activation context generation failed for "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3.
The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.
 
Error: (10/07/2017 05:32:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (10/07/2017 05:31:13 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
The action cannot be completed. Try the action again. If the problem continues, contact Microsoft Product Support.
 
Error: (10/06/2017 06:27:43 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.
 
Error: (10/06/2017 06:27:43 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0061-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.
 
Error: (10/06/2017 06:18:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (10/06/2017 06:17:43 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
The action cannot be completed. Try the action again. If the problem continues, contact Microsoft Product Support.
 
 
System errors:
=============
Error: (10/07/2017 05:48:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: 
The dependency service or group failed to start.
 
Error: (10/07/2017 05:48:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: 
The dependency service or group failed to start.
 
Error: (10/07/2017 05:48:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: 
The dependency service or group failed to start.
 
Error: (10/07/2017 05:48:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: 
The dependency service or group failed to start.
 
Error: (10/07/2017 05:48:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: 
The dependency service or group failed to start.
 
Error: (10/07/2017 05:48:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: 
The dependency service or group failed to start.
 
Error: (10/07/2017 05:48:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: 
The dependency service or group failed to start.
 
Error: (10/07/2017 05:48:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: 
The dependency service or group failed to start.
 
Error: (10/07/2017 05:48:34 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server:
{BA126AD1-2166-11D1-B1D0-00805FC1270E}
 
Error: (10/07/2017 05:48:34 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89}
 
 
CodeIntegrity:
===================================
  Date: 2011-11-20 19:14:08.513
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20111111.030\IDSviA64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2011-11-20 19:14:08.435
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20111111.030\IDSviA64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2011-11-20 19:13:03.918
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20111111.030\IDSviA64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2011-11-20 19:13:03.840
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20111111.030\IDSviA64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
==================== Memory info =========================== 
 
Processor: Pentium(R) Dual-Core CPU E5700 @ 3.00GHz
Percentage of memory in use: 16%
Total physical RAM: 4061.18 MB
Available physical RAM: 3396.99 MB
Total Virtual: 8120.54 MB
Available Virtual: 7507.24 MB
 
==================== Drives ================================
 
Drive c: (Acer) (Fixed) (Total:582.4 GB) (Free:511.21 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: DF7F8205)
Partition 1: (Not Active) - (Size=13.7 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=582.4 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
Post #4
I really need to see FRST.txt
**

How to Attach a File to Your Reply
——————–
  • Click in the reply window to reply first
  • If necessary click the More Reply Options button in the lower right hand corner of the Reply to this topic section of the Post
  • In the lower left hand corner you should see a Browse button under Attach Files
  • Click the Browse button and a new window will open
  • Navigate to and double click on the file you want to attach
  • Once the file path is entered into the box click Attach This File
  • If successful, you will see the file name appear above Attach Files with a green check mark to the left
  • When you are done with your message and hit Reply the file will automatically be attached to your reply
=========

Multiple Resident Protection warning!

Always have one (and no more than one!) AntiVirus program! In this case having more of them will not provide you with better protection - instead they may cause slowness, lock-ups and even mark another ones as harmful, leading to leave your system unstable and even damaged. Please choose only one from the listed below to stay with and uninstall the others:

AV: Microsoft Security Essentials (Disabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AV: Norton Security Suite (Disabled - Up to date) {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
The below 2 entries might be residue, look for them in your add/remove programs list to see if they are still there.
AVG 2016 (HKLM\…\{32218623-385A-439D-932A-F03EDE611D5F}) (Version: 16.0.4749 - AVG Technologies) Hidden
AVG PC TuneUp 2014 (en-US) (HKLM-x32\…\{8CD86D42-C4DD-4E40-9211-164DFFBCA4DB}) (Version: 14.0.1001.295 - AVG) Hidden

We need to uninstall some programs.

File Type Assistant (HKLM-x32\…\Trusted Software Assistant_is1) (Version: 2014.5.6.0 - ) <==== ATTENTION
Itibiti RTC (HKLM-x32\…\{730E03E4-350E-48E5-9D3E-4329903D454D}) (Version: 0.0.1 - Itibiti Inc) Hidden <==== ATTENTION
OpenOffice Impress Free Download Packages (HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\OpenOffice Impress Free Download Packages) (Version: - ) <==== ATTENTION
Performancer (HKLM-x32\…\{5F189DF5-2D05-472B-9091-84D9848AE48B}{dfc86759}) (Version: - 24soft) <==== ATTENTION
ShopAtHome.com Helper (HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\…\ShopAtHome.com Helper) (Version: 7.10.2.6 - ShopAtHome.com) <==== ATTENTION


After completing uninstalls, please manually reboot your machine!


~~~
Let's see if we can get Farbar Recovery tool to run in normal mode.
IF, it throws out errors, boot back into safe mode to try and run the fix again.
**
Start Farbar Recovery Scan Tool (Please double-click on FRST/FRST64) with Administrator privileges

Highlight the below information then hit the Ctrl + C keys at the same time
or
Right click/highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
Task: {08E54377-2316-4608-B84B-10891019D759} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files (x86)\File Type Assistant\tsasetup.exe [2014-05-06] ( ) <==== ATTENTION
Task: {0D440409-BB79-4CCC-B2E6-FAF290C9149D} - \RocketTab -> No File <==== ATTENTION
Task: {157D295D-24D2-492B-90F6-621261180871} - \TweakBit\FixMyPC\Start FixMyPC оn logon -> No File <==== ATTENTION
Task: {2070012D-BD95-4065-B0BD-BE3ACD78D4FD} - System32\Tasks\IHUninstallTrackingTASK => CMD /C DEL C:\Users\carol\AppData\Local\Temp\IHU1A72.tmp.exe <==== ATTENTION
Task: {213F0603-7FA5-4B57-AEBC-DBA8F3D44CE3} - System32\Tasks\RunTool => C:\Users\carol\AppData\Local\9b5c8493-304a-4fa0-9bd3-a0d03f5220bc\sysad.exe <==== ATTENTION
Task: {25F0D31B-204C-4695-9AAF-53D5D662BEF6} - System32\Tasks\SpeedMaxPc Registration3 => C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\UUS3.dll" RunUns
Task: {9025989E-868C-4284-B518-205FB91ED3A5} - System32\Tasks\{67A6487D-C69E-4D08-B9AD-7BBDC8DC5D70} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\SelectRebates\SelectRebatesUninstall.exe"
Task: {9E27248D-D93E-47CA-8651-74E13AAFD7F6} - System32\Tasks\0 => c:\program files (x86)\internet explorer\iexplore.exe <==== ATTENTION
Task: {A20E1206-3691-43EB-8F29-6E228A0320C0} - System32\Tasks\MyTurboPC.com Registration3 => C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\Common Files\MyTurboPC.com\UUS3\UUS3.dll" RunUns
Task: {A9DB109B-CD73-49A7-9F0F-9D9EEE4EDB83} - \PCM_carol_PCMedic_RS_WeeklyTask -> No File <==== ATTENTION
Task: {AF3252E6-04F4-4E26-B7F1-F06FACB194F3} - \RocketTab Update Task -> No File <==== ATTENTION
ask: {B7B12F05-3C22-4DB6-A155-BB43C9C421ED} - \PCM_carol_PCMedic_LogonTask -> No File <==== ATTENTION
Task: {D2D3433C-15FE-4682-99BB-EE7D3DFCBD6C} - System32\Tasks\4710 => wscript.exe C:\Users\carol\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {D7563B1D-FBF2-4188-A8A0-D973AC8B018B} - System32\Tasks\ProgramUpdateCheck => C:\Program Files (x86)\File Type Assistant\TSAssist.exe [2014-05-06] (FTA ApS) <==== ATTENTION
Task: {F0DE6428-4D68-4998-ABE0-993C41C3252B} - System32\Tasks\{9D975654-99E6-45D8-866B-2930B9CE8B43} => C:\Windows\system32\pcalua.exe -a "C:\Users\carol\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1ANQQOGL\tinyword[1].exe" -d C:\Users\carol\Desktop
Task: C:\Windows\Tasks\MyTurboPC.com Registration3.job => rundll32.exe C:\Program Files (x86)\Common Files\MyTurboPC.com\UUS3\UUS3.dll RunUns C:\Program Files (x86)\Common Files\MyTurboPC.com
Task: C:\Windows\Tasks\SpeedMaxPc Registration3.job => rundll32.exe C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\UUS3.dll
AlternateDataStreams: C:\Users\carol\Documents\12327922-000006FD.eml:OEStandardProperty [1627]
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Post #5
Hi Juliet,
 
Itibiti RTC and Shopathome are’t in the Programs and Features section to uninstall,
 
When I try to uninstall Performancer I receive a RunDLL window that says ‘There was a problem starting C:\PROGRA~3\PERFOR~1\PERFOR~1. DLL The specified module could not be found’
 
I tried to run FRST in normal mode with the same result; appears/disappears. So wemt to safe mode. 
Just a clarification please. When you say double click with Administrator privileges I have been right clicking and selecting ‘run as administrator’ because if I double click there is nothing that indicates an administrator. I hope this is okay? 
 
Before going to safe mode I copied the text you sited into notepad as Unicode since it said ANSI format would lose something. I did this since I can’t get the internet in safe mode. (I used notepad as my mom has this Word Free program that isn’t saving docs that I can re open. I’ll try to find her somwthing better when all is well with the PC). I hope using notepad as I did doesn’t effect the outcome.
 
I have attached the original FRST log and the Fixlog below
===================================================
 
Fix result of Farbar Recovery Scan Tool (x64) Version: 06-10-2017
Ran by [removed] (08-10-2017 18:03:25) Run:1
Running from C:\Users\[removed]\Downloads
[removed]
Boot Mode: Safe Mode (minimal)
==============================================
 
fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
Task: {08E54377-2316-4608-B84B-10891019D759} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files (x86)\File Type Assistant\tsasetup.exe [2014-05-06] ( ) <==== ATTENTION
Task: {0D440409-BB79-4CCC-B2E6-FAF290C9149D} - \RocketTab -> No File <==== ATTENTION
Task: {157D295D-24D2-492B-90F6-621261180871} - \TweakBit\FixMyPC\Start FixMyPC оn logon -> No File <==== ATTENTION
Task: {2070012D-BD95-4065-B0BD-BE3ACD78D4FD} - System32\Tasks\IHUninstallTrackingTASK => CMD /C DEL C:\Users\carol\AppData\Local\Temp\IHU1A72.tmp.exe <==== ATTENTION
Task: {213F0603-7FA5-4B57-AEBC-DBA8F3D44CE3} - System32\Tasks\RunTool => C:\Users\carol\AppData\Local\9b5c8493-304a-4fa0-9bd3-a0d03f5220bc\sysad.exe <==== ATTENTION
Task: {25F0D31B-204C-4695-9AAF-53D5D662BEF6} - System32\Tasks\SpeedMaxPc Registration3 => C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\UUS3.dll" RunUns
Task: {9025989E-868C-4284-B518-205FB91ED3A5} - System32\Tasks\{67A6487D-C69E-4D08-B9AD-7BBDC8DC5D70} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\SelectRebates\SelectRebatesUninstall.exe"
Task: {9E27248D-D93E-47CA-8651-74E13AAFD7F6} - System32\Tasks\0 => c:\program files (x86)\internet explorer\iexplore.exe <==== ATTENTION
Task: {A20E1206-3691-43EB-8F29-6E228A0320C0} - System32\Tasks\MyTurboPC.com Registration3 => C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\Common Files\MyTurboPC.com\UUS3\UUS3.dll" RunUns
Task: {A9DB109B-CD73-49A7-9F0F-9D9EEE4EDB83} - \PCM_carol_PCMedic_RS_WeeklyTask -> No File <==== ATTENTION
Task: {AF3252E6-04F4-4E26-B7F1-F06FACB194F3} - \RocketTab Update Task -> No File <==== ATTENTION
ask: {B7B12F05-3C22-4DB6-A155-BB43C9C421ED} - \PCM_carol_PCMedic_LogonTask -> No File <==== ATTENTION
Task: {D2D3433C-15FE-4682-99BB-EE7D3DFCBD6C} - System32\Tasks\4710 => wscript.exe C:\Users\carol\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {D7563B1D-FBF2-4188-A8A0-D973AC8B018B} - System32\Tasks\ProgramUpdateCheck => C:\Program Files (x86)\File Type Assistant\TSAssist.exe [2014-05-06] (FTA ApS) <==== ATTENTION
Task: {F0DE6428-4D68-4998-ABE0-993C41C3252B} - System32\Tasks\{9D975654-99E6-45D8-866B-2930B9CE8B43} => C:\Windows\system32\pcalua.exe -a "C:\Users\carol\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1ANQQOGL\tinyword[1].exe" -d C:\Users\carol\Desktop
Task: C:\Windows\Tasks\MyTurboPC.com Registration3.job => rundll32.exe C:\Program Files (x86)\Common Files\MyTurboPC.com\UUS3\UUS3.dll RunUns C:\Program Files (x86)\Common Files\MyTurboPC.com
Task: C:\Windows\Tasks\SpeedMaxPc Registration3.job => rundll32.exe C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\UUS3.dll
AlternateDataStreams: C:\Users\carol\Documents\12327922-000006FD.eml:OEStandardProperty [1627]
Emptytemp:
 
*****************
 
Processes closed successfully.
Error: Restore point can only be created in normal mode.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{08E54377-2316-4608-B84B-10891019D759} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\ProgramRefresh-ATFST => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProgramRefresh-ATFST => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0D440409-BB79-4CCC-B2E6-FAF290C9149D} => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0D440409-BB79-4CCC-B2E6-FAF290C9149D} => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RocketTab => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{157D295D-24D2-492B-90F6-621261180871} => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\TweakBit\FixMyPC\Start FixMyPC оn logon => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2070012D-BD95-4065-B0BD-BE3ACD78D4FD} => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2070012D-BD95-4065-B0BD-BE3ACD78D4FD} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\IHUninstallTrackingTASK => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IHUninstallTrackingTASK => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{213F0603-7FA5-4B57-AEBC-DBA8F3D44CE3} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\RunTool => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RunTool => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{25F0D31B-204C-4695-9AAF-53D5D662BEF6} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\SpeedMaxPc Registration3 => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SpeedMaxPc Registration3 => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9025989E-868C-4284-B518-205FB91ED3A5} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\{67A6487D-C69E-4D08-B9AD-7BBDC8DC5D70} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{67A6487D-C69E-4D08-B9AD-7BBDC8DC5D70} => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9E27248D-D93E-47CA-8651-74E13AAFD7F6} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\0 => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0 => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A20E1206-3691-43EB-8F29-6E228A0320C0} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\MyTurboPC.com Registration3 => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MyTurboPC.com Registration3 => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A9DB109B-CD73-49A7-9F0F-9D9EEE4EDB83} => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PCM_carol_PCMedic_RS_WeeklyTask => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AF3252E6-04F4-4E26-B7F1-F06FACB194F3} => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RocketTab Update Task => key removed successfully
ask: {B7B12F05-3C22-4DB6-A155-BB43C9C421ED} - \PCM_carol_PCMedic_LogonTask -> No File <==== ATTENTION => Error: No automatic fix found for this entry.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D2D3433C-15FE-4682-99BB-EE7D3DFCBD6C} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\4710 => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4710 => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D7563B1D-FBF2-4188-A8A0-D973AC8B018B} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\ProgramUpdateCheck => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProgramUpdateCheck => key could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F0DE6428-4D68-4998-ABE0-993C41C3252B} => key could not remove. Access Denied.
C:\Windows\System32\Tasks\{9D975654-99E6-45D8-866B-2930B9CE8B43} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9D975654-99E6-45D8-866B-2930B9CE8B43} => key could not remove. Access Denied.
C:\Windows\Tasks\MyTurboPC.com Registration3.job => moved successfully
C:\Windows\Tasks\SpeedMaxPc Registration3.job => moved successfully
C:\Users\carol\Documents\12327922-000006FD.eml => ":OEStandardProperty" ADS removed successfully.
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 18839587 B
Java, Flash, Steam htmlcache => 578 B
Windows/system/drivers => 157987 B
Edge => 0 B
Chrome => 550428417 B
Firefox => 66285125 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 33058 B
Public => 0 B
ProgramData => 0 B
systemprofile => 66356 B
systemprofile32 => 66356 B
LocalService => 132244 B
NetworkService => 20049489 B
carol => 521825341 B
 
RecycleBin => 15886 B
EmptyTemp: => 1.1 GB temporary data Removed.
 
================================
 
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 08-10-2017 18:09:36)
 
 
Result of scheduled keys to remove after reboot:
 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{08E54377-2316-4608-B84B-10891019D759} => key removed successfully. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProgramRefresh-ATFST => key removed successfully. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0D440409-BB79-4CCC-B2E6-FAF290C9149D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0D440409-BB79-4CCC-B2E6-FAF290C9149D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{157D295D-24D2-492B-90F6-621261180871} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\TweakBit\FixMyPC\Start FixMyPC оn logon => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2070012D-BD95-4065-B0BD-BE3ACD78D4FD} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2070012D-BD95-4065-B0BD-BE3ACD78D4FD} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IHUninstallTrackingTASK => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{213F0603-7FA5-4B57-AEBC-DBA8F3D44CE3} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RunTool => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{25F0D31B-204C-4695-9AAF-53D5D662BEF6} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9025989E-868C-4284-B518-205FB91ED3A5} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{67A6487D-C69E-4D08-B9AD-7BBDC8DC5D70} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9E27248D-D93E-47CA-8651-74E13AAFD7F6} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0 => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A20E1206-3691-43EB-8F29-6E228A0320C0} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MyTurboPC.com Registration3 => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A9DB109B-CD73-49A7-9F0F-9D9EEE4EDB83} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PCM_carol_PCMedic_RS_WeeklyTask => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AF3252E6-04F4-4E26-B7F1-F06FACB194F3} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D2D3433C-15FE-4682-99BB-EE7D3DFCBD6C} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4710 => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D7563B1D-FBF2-4188-A8A0-D973AC8B018B} => key removed successfully. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProgramUpdateCheck => key removed successfully. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F0DE6428-4D68-4998-ABE0-993C41C3252B} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9D975654-99E6-45D8-866B-2930B9CE8B43} => key removed successfully
 
==== End of Fixlog 18:09:37 ====

Attachments:

Post #6
wowssa!
this is a badly infected machine.
 

When you say double click with Administrator privileges I have been right clicking and selecting run as administrator because if I double click there is nothing that indicates an administrator. I hope this is okay?

Before going to safe mode I copied the text you sited into notepad as Unicode since it said ANSI format would lose something.

You were correct and we have another fixlog to create and run.


Start Farbar Recovery Scan Tool with Administrator privileges
or Right click on the FRST icon and select Run as administrator

Highlight the below information then hit the Ctrl + C keys at the same time
or
Right click/highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
IFEO\browsemngr.exe: [Debugger] tasklist.exe
IFEO\browsermngr.exe: [Debugger] tasklist.exe
IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe
IFEO\cltmngsvc.exe: [Debugger] tasklist.exe
IFEO\ContentExplorer.exe: [Debugger] TaskList.exe
IFEO\delta babylon.exe: [Debugger] tasklist.exe
IFEO\delta tb.exe: [Debugger] tasklist.exe
IFEO\delta2.exe: [Debugger] tasklist.exe
IFEO\deltainstaller.exe: [Debugger] tasklist.exe
IFEO\deltasetup.exe: [Debugger] tasklist.exe
IFEO\deltatb.exe: [Debugger] tasklist.exe
IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe
IFEO\iminentsetup.exe: [Debugger] tasklist.exe
IFEO\internetenhancer.exe: [Debugger] TaskList.exe
IFEO\internetenhancerservice.exe: [Debugger] TaskList.exe
IFEO\rjatydimofu.exe: [Debugger] tasklist.exe
IFEO\sweetimsetup.exe: [Debugger] tasklist.exe
IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe
IFEO\wajaminternetenhancer.exe: [Debugger] TaskList.exe
IFEO\WajamInternetEnhancerApp.exe: [Debugger] TaskList.exe
IFEO\WajamInternetEnhancerAppservice.exe: [Debugger] TaskList.exe
IFEO\wajaminternetenhancerservice.exe: [Debugger] TaskList.exe
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://www.yahoo.com/?fr=fp-yie11
HKU\S-1-5-21-3023560301-1441740751-2596322319-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/
URLSearchHook: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 - (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File
SearchScopes: HKLM -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=file0101&cd=2XzuyEtN2Y1L1QzutC0CyCyDzy0DyD0DyCtAzztAyD0B0E0FtN0D0Tzu0SyBtAzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=725369755&ir=
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=file0101&cd=2XzuyEtN2Y1L1QzutC0CyCyDzy0DyD0DyCtAzztAyD0B0E0FtN0D0Tzu0SyBtAzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=725369755&ir=
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2408} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=104&systemid=408&sr=0&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=100&itype=n&ver=11471&tm=307&src=ds&p={searchTerms}
SearchScopes: HKLM -> {CC865B26-C31D-4D23-B17B-96548EEF03F6} URL = hxxp://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_otbrw3_14_35&cd=2XzuyEtN2Y1L1QzutC0CyCyDzy0DyD0DyCtAzztAyD0B0E0FtN0D0Tzu0StCtDyDzztN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1F2Z1S1C2W1O1L1C1B2Z1VtCyE1VtByEtN1L1G1B1V1N2Y1L1Qzu2SyD0F0DyCyBtA0AtAtGyCyB0EzytGyByB0D0BtG0C0Fzy0CtGyDyBtCzz0Azz0EzytD0B0DtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtByBtBtCtDzy0CtGtAzztC0CtGyE0D0DzytG0Bzz0E0DtGtB0EyDyBzy0EzytDzz0CtD0D2Q&cr=1522996234&ir=
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 -> {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm003^S10945^us&si=CPrHhvzChcICFZSMaQodUGAAqA&ptb=7A2D5751-01E5-4E3D-97C0-E630171417B8&ind=2014111820&n=780ce84c&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2408} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=104&systemid=408&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=100&itype=n&ver=11471&tm=307&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm166^YYA^us&si=pd-angels&ptb=D8727034-52B8-446D-9E6D-38CF03F04689&ind=2013091321&n=77fd55f9&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM-x32 -> {cca2e567-1987-4100-a3c6-5b4267084510} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^YK^xdm133^YY^us&ptb=7DF2AC85-8B5D-47F0-B55E-50026C17F7EB&psa=&ind=2013010813&st=sb&n=77fc1b7d&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> DefaultScope {4AECC45C-0A7E-47E9-83A5-3DA7D87AA2C7} URL = hxxp://www.bing.com/search?FORM=U218DF&PC=U218&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> C8BDA62759894C7281A068494BA4E895 URL = hxxps://us.search.yahoo.com/yhs/search?hspart=w3i&hsimp=yhs-defalttabtransfer&p={searchTerms}&type=tb_ie_chr
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> D86F795DBEE943959B435CF6E93D494D URL = hxxp://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_otbrw3_14_35&cd=2XzuyEtN2Y1L1QzutC0CyCyDzy0DyD0DyCtAzztAyD0B0E0FtN0D0Tzu0StCtDyDzztN1L2XzutAtFyCtFyCtFtDtN1L1Czu1N1C2X1V1F2Z1S1C2W1O1L1C1B2Z1VtCyE1VtByEtN1L1G1B1V1N2Y1L1Qzu2SyBtD0BzytC0E0CtAtGzztAtA0DtG0AtD0D0AtG0BtByC0BtGtByC0AyCyBtBtD0A0FtD0CtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtByBtBtCtDzy0CtGtAzztC0CtGyE0D0DzytG0Bzz0E0DtGtB0EyDyBzy0EzytDzz0CtD0D2Q&cr=149670780&ir=
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {4AECC45C-0A7E-47E9-83A5-3DA7D87AA2C7} URL = hxxp://www.bing.com/search?FORM=U218DF&PC=U218&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {52B07EE5-ADA7-4143-9FE8-EA15DC7B8B97} URL = hxxp://isearch.shopathome.com?user_id={45ff279c-c366-4a12-96d1-8c8c65fe3537}&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={2096F605-314E-4E7D-A448-096A03A327B4}&mid=d640a0fbed4a47d0adbcd16f6ba2ac33-beae58571b83549e41848df8bd249de3f20d623b&lang=en&ds=AVG&coid=avgtbavg&cmpid=ZenTest_B_0&pr=fr&d=2016-12-28 18:49:53&v=4.3.6.255&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm003^S10945^us&si=CPrHhvzChcICFZSMaQodUGAAqA&ptb=7A2D5751-01E5-4E3D-97C0-E630171417B8&ind=2014111820&n=780ce84c&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {9B28FB47-8C1D-4445-8A07-9B8CDA1C1490} URL = hxxps://delicious.com/search?p={searchTerms}
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {A0228EB5-5787-496C-9341-9AB230242A61} URL = hxxps://www.flickr.com/search/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxps://nortonsafe.search.ask.com/web?q={searchTerms}&o=APN11913&l=dis&prt=NSBU&chn=1122&geo=US&ver=22.10.1.10&locale=en_US&guid=E86D0BD3-0576-11E0-86A6-00262D4645C0&doi=2016-09-01&gct=sb&qsrc=2869
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {B2F30A8E-911B-4C64-AE1E-EDE94591DBD5} URL = hxxps://search.yahoo.com/search?ei=utf-8&fr=befds&p={searchTerms}&type=ieds-3.16-1410
SearchScopes: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> {CC865B26-C31D-4D23-B17B-96548EEF03F6} URL = hxxp://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_otbrw3_14_35&cd=2XzuyEtN2Y1L1QzutC0CyCyDzy0DyD0DyCtAzztAyD0B0E0FtN0D0Tzu0StCtDyDzztN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1F2Z1S1C2W1O1L1C1B2Z1VtCyE1VtByEtN1L1G1B1V1N2Y1L1Qzu2SyD0F0DyCyBtA0AtAtGyCyB0EzytGyByB0D0BtG0C0Fzy0CtGyDyBtCzz0Azz0EzytD0B0DtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtByBtBtCtDzy0CtGtAzztC0CtGyE0D0DzytG0Bzz0E0DtGtB0EyDyBzy0EzytDzz0CtD0D2Q&cr=1522996234&ir=
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: No Name -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> No File
BHO-x32: WeCareReminder Class -> {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} -> C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll => No File
BHO-x32: No Name -> {FCBCCB87-9224-4B8D-B117-F56D924BEB18} -> No File
Toolbar: HKLM-x32 - No Name - {37a7edb7-afda-4373-9865-02bf8160e677} - No File
Toolbar: HKLM-x32 - No Name - {8660E5B3-6C41-44DE-8503-98D99BBECD41} - No File
Toolbar: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> No Name - {37A7EDB7-AFDA-4373-9865-02BF8160E677} - No File
Toolbar: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> No Name - {8660E5B3-6C41-44DE-8503-98D99BBECD41} - No File
Toolbar: HKU\S-1-5-21-3023560301-1441740751-2596322319-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
FF HKLM\…\Thunderbird\Extensions: [[removed]] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird => not found
FF HKLM-x32\…\Firefox\Extensions: [{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}] - C:\Program Files (x86)\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi => not found
CHR HomePage: Default -> hxxp://groovorio.com/?f=1&a=grv_otbrw3_14_35&cd=2XzuyEtN2Y1L1QzutC0CyCyDzy0DyD0DyCtAzztAyD0B0E0FtN0D0Tzu0StCtDyDzztN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1F2Z1S1C2W1O1L1C1B2Z1VtCyE1VtByEtN1L1G1B1V1N2Y1L1Qzu2SyD0F0DyCyBtA0AtAtGyCyB0EzytGyByB0D0BtG0C0Fzy0CtGyDyBtCzz0Azz0EzytD0B0DtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtByBtBtCtDzy0CtGtAzztC0CtGyE0D0DzytG0Bzz0E0DtGtB0EyDyBzy0EzytDzz0CtD0D2Q&cr=1522996234&ir=
CHR StartupUrls: Default -> "hxxp://yahoo.com/"
CHR HKLM\…\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\carol\AppData\Local\mysearchdial-speeddial.crx
Post #7

I suspected she had some baddies on the PC especially since I found out that she hadn't had an MS updates for years.

 

I did have to run the FRST in safe mode again but was able to run Malwarebytes and Adwcleaner in normal mode.

 

I have attached the logs for Fixlog, Malwarebytes and Adwcleaner [C0] (after clean) as possting was too large again.

 

Adwcleaner: No log appeared briefly when I clicked scan. However it did produce a log after the scan titled AdwCleaner [S0]. I did save that one and attached last in case you wanted to also see that one.

 

Thanks, Denise

Attachments:

Post #8 last edited
OK, one thing I see is maybe the MBAM log posted before you had it delete anything?
 (No Action By User)
If thats the case fine, if not, please run the scan again, checkmark all entries and allow it to quarantine the items found.

****

Emsisoft Emergency Kit

Please download Emsisoft Emergency Kit and save it to your desktop. Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop. Leave all settings as they are and click the Extract button at the bottom. A folder named EEK will be created in the root of the drive (usually c:\).
  • After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
  • The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates. Please click Yes so that it downloads the latest database updates.
  • When update is complete, click Malware Scan. When asked if you want the scanner to scan for Potentially Unwanted Programs, click Yes. Emsisoft Emergency Kit will start scanning.
  • When the scan is completed click Quarantine selected objects. Note, this option is only available if malicious objects were detected during the scan.
  • When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
  • Please save the log in Notepad on your desktop and post the contents in your next reply.
  • When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
Please post this log when finished.

How is the computer now?
Post #10
I think the computer should be doing fine now.

Next step is to remove tools and quarantine folders.

[external image: AFZxnZc.jpg] DelFix
  • Please download DelFix or from Here and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  • Purge system restore
  • Reset system settings
  • Click the Run button.
  • – This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
******
  • Answers to common security questions - Best Practices by quietman7, MVP
  • How Malware Spreads - How did I get infected? by quietman7, MVP
  • Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
  • How to Prevent Malware by miekiemoes, MVP
  • How to backup and restore your data using Cobian Backup by YourHighness
  • Slow Computer/browser? It May Not Be Malware by quietman7, MVP
  • AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
  • [external image: EG85Vjt.png]Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
  • [external image: 6YRrgUC.png]Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
  • [external image: jv4nhMJ.png]NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
  • [external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
  • [external image: DgW1XL2.png]Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
  • [external image: j1OLIec.png]SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
  • [external image: sHjS79L.png]Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs.
Post #11

I'll go ahead and add Adblock,Secunia PSI, Spyware Blaster and unchecky for her. When I bring the PC back to my mom in-law I'll show her the articles in the post. She's a pretty smart 84 yr old gal so I think she'll get the basics of it without overwhelming her. I'll check on her PC health from time to time and she'll know to call me if she gets any wonky errors like the missing DLL.

 

Thank you so, so munch for your time and help. As always all of you at WTT are just the BEST!

 

Again thanks,

 

Denise

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI