Spyware / Malware / Virus Removal

Slow computer

9 min read

Looking for the outcome? Ask AI

gbsk Topic Starter

Post #1December 16, 2017, 5:11 PM UTC

This is my wife's computer and we are about ready to dump it since it is always slow but now snail slow. It is a laptop using Win 7.1. I told her to upgrade to Win 10 but she would not do it. We mostly use Chrome as the browser. I downloaded MBRasw and the logfile is below. I tried twice downloading Farberware and it would not download. I think because it took too long to download. Thanks for doing this.

Run date: 2017-12-16 05:09:02

—————————–

05:09:02.875 OS Version: Windows x64 6.1.7601 Service Pack 1

05:09:02.876 Number of processors: 2 586 0xF0B

05:09:02.877 ComputerName: USER-PC UserName: USER

05:09:08.255 Initialize success

05:09:08.694 VM: initialized successfully

05:09:08.696 VM: Intel CPU BiosDisabled

05:19:41.248 AVAST engine defs: 17030301

05:20:07.432 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1

05:20:07.435 Disk 0 Vendor: ST980813AS 3.BHD Size: 76319MB BusType: 3

05:20:10.329 Disk 0 MBR read successfully

05:20:10.336 Disk 0 MBR scan

05:20:10.865 Disk 0 Windows 7 default MBR code

05:20:10.956 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76318 MB offset 2048

05:20:11.141 Disk 0 Boot: NTFS code=2

05:20:12.974 Disk 0 scanning C:\Windows\system32\drivers

05:27:38.115 Service scanning

05:31:16.035 Modules scanning

05:31:16.056 Disk 0 trace - called modules:

05:31:16.571 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS intelide.sys

05:31:16.598 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80024de6d0]

05:31:16.605 3 CLASSPNP.SYS[fffff88001ba043f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa8002283680]

05:31:20.376 AVAST engine scan C:\Windows

05:31:24.234 AVAST engine scan C:\Windows\system32

05:52:15.957 AVAST engine scan C:\Windows\system32\drivers

05:53:03.098 AVAST engine scan C:\Users\TEMP.USER-PC.000

05:56:26.967 AVAST engine scan C:\ProgramData

05:58:30.223 Disk 0 statistics 3164377/0/0 @ 1.27 MB/s

05:58:30.279 Scan finished successfully

07:39:41.964 Disk 0 MBR has been saved successfully to "C:\Users\TEMP.USER-PC.000\Desktop\MBR.dat"

07:39:42.122 The log file has been saved successfully to "C:\Users\TEMP.USER-PC.000\Desktop\aswMBR.txt"

gbsk

Post #2December 16, 2017, 5:18 PM UTC

We have Malwarebytes and 360 Total Security on the computer and neither made the computer faster.

Juliet

Post #3December 17, 2017, 1:17 PM UTC

Hi

Can you try to boot into safe mode with networking https://www.bleepingcomputer.com/tutorials/how-to-start-windows-in-safe-mode/
and try to download Farbar Recovery Scan Tool (x64)

Now you can try to run FRST again but let's see if we can temporarily disable 360.
I'm not sure if I have the correct procedure…

Try the following. In an admin account open 360 Total Security settings. Under the General tab uncheck the box next to 360 Self Protection. You will need to scroll to the bottom as it's the last setting. Open Task Manager and under the Processes tab highlight QHSafeTray and end the process.
To restore 360 Total Security you can either reboot or double click the desktop icon.

*******
Follow the instructions in the thread below. Make sure to download the Malwarebytes Anti-Rootkit (MBAR) version linked in it.
Let me know if you're not able to launch it and run a scan.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

If you manage to run a scan, delete everything it finds, and then copy/paste the content of the mbar-log-DATE-(TIME).txt log that is located in the MBAR folder here after.

gbsk

Post #4December 17, 2017, 6:19 PM UTC

Does this reply have a time limit? I pasted most of what you wanted on here and it disappeared. I have to redo everything. I already restarted the computer in safe mode before you told me to. I had to restore the computer to a previous restore point before I could do it. It is much faster now. Here are your scans., I could download Malwarebytes but not install it so no scan there. Thank you.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-12-2017

Ran by [removed] (administrator) on USER-PC (17-12-2017 08:38:04)

Running from C:\Users\[removed]\Desktop

[removed]

Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Opera)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

() C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe

(Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.exe

(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe

(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe

(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\QHAccount.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\…\Run: [QHSafeTray] => C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe [2006112 2017-12-01] (QIHU 360 SOFTWARE CO. LIMITED)

HKLM-x32\…\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)

HKLM-x32\…\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1569642822-292156195-3241122032-1000\…\Run: [Zoom] => [X]

Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"

GroupPolicy: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 127.0.0.1 activation.acronis.com

Tcpip\Parameters: [DhcpNameServer] [removed] [removed] 192.168.1.1

Tcpip\..\Interfaces\{213A2003-036E-4F51-BEE9-BDF911C1E726}: [DhcpNameServer] [removed] [removed] 192.168.1.1

Tcpip\..\Interfaces\{E95A4C0B-80EA-4FBF-849A-C899DCB576D5}: [DhcpNameServer] [removed] [removed] 192.168.1.1

Internet Explorer:

==================

HKU\S-1-5-21-1569642822-292156195-3241122032-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

BHO: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-26] (Intel Security)

BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll [2017-12-01] (Qihu 360 Software Co., Ltd.)

BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-26] (Intel Security)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)

BHO-x32: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon.dll [2017-01-21] (Qihu 360 Software Co., Ltd.)

Toolbar: HKLM - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-26] (Intel Security)

Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-26] (Intel Security)

FireFox:

========

FF DefaultProfile: f6ccu811.default

FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\f6ccu811.default [2017-11-16]

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-20] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-20] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-04] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1569642822-292156195-3241122032-1000: @freescreensharing/detector -> C:\Users\USER\AppData\Local\FreeScreenSharing\npfreesee.dll [2014-06-04] (Free Screen Sharing)

FF Plugin HKU\S-1-5-21-1569642822-292156195-3241122032-1000: @zoom.us/ZoomVideoPlugin -> C:\Users\USER\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2016-04-12] (Zoom Video Communications, Inc.)

Chrome:

=======

CHR HomePage: Default -> hxxp://www.matsu.alaska.edu/

CHR Profile: C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default [2017-12-17]

CHR Extension: (Slides) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13]

CHR Extension: (Flash Video Downloader) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiimdkdngfcipjohbjenkahhlhccpdbc [2017-11-09]

CHR Extension: (Docs) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]

CHR Extension: (Google Drive) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-23]

CHR Extension: (YouTube) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-23]

CHR Extension: (Adblock Plus) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-11-30]

CHR Extension: (Adobe Acrobat) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-05-02]

CHR Extension: (Disable HTML5 Autoplay) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\efdhoaajjjgckpbkoglidkeendpkolai [2016-11-09]

CHR Extension: (Video Downloader professional) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2017-08-04]

CHR Extension: (Sheets) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13]

CHR Extension: (Google Docs Offline) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-24]

CHR Extension: (LastPass: Free Password Manager) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2017-11-18]

CHR Extension: (Chrome Web Store Payments) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-22]

CHR Extension: (Gmail) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-23]

CHR Extension: (Chrome Media Router) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-17]

CHR Profile: C:\Users\USER\AppData\Local\Google\Chrome\User Data\System Profile [2017-10-26]

CHR HKLM-x32\…\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

Opera:

=======

StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]

R2 CLHNServiceForPowerDVD; C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [83240 2011-05-18] ()

S3 CyberLink PowerDVD 11.0 Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [70952 2011-05-11] (CyberLink)

S3 CyberLink PowerDVD 11.0 Service; C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServer.exe [312616 2011-05-11] (CyberLink)

R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6058960 2017-08-07] (Malwarebytes)

S4 mmsminisrv; C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe [4884064 2015-08-11] (Acronis)

R2 QHActiveDefense; C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe [929888 2017-12-01] (QIHU 360 SOFTWARE CO. LIMITED)

R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [1001920 2017-06-26] (McAfee, Inc.)

R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16928 2017-06-26] (McAfee, Inc.)

S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [87760 2017-06-26] (McAfee, Inc.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [183416 2017-12-01] (360.cn)

R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [86248 2017-12-01] (360.cn)

R3 360AvFlt; C:\Windows\SysWOW64\DRIVERS\360AvFlt.sys [86248 2017-12-01] (360.cn)

R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [330472 2017-12-01] (360.cn)

S3 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [49088 2017-04-13] (360.cn)

R1 360FsFlt; C:\Windows\System32\DRIVERS\360FsFlt.sys [433784 2017-12-01] (360.cn)

S3 360netmon; C:\Windows\System32\DRIVERS\360netmon.sys [81344 2017-12-01] (360.cn)

R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [201336 2017-12-01] (360.cn)

R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [323040 2016-03-10] (Acronis International GmbH)

R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [252232 2017-12-17] (Malwarebytes)

R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1057728 2016-03-10] (Acronis International GmbH)

R2 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [206800 2016-03-10] (Acronis International GmbH)

S3 tnd; C:\Windows\System32\DRIVERS\tnd.sys [567888 2016-03-10] (Acronis International GmbH)

R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [148976 2011-04-12] (CyberLink Corp.)

S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]

S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]

S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-17 08:38 - 2017-12-17 08:41 - 000013492 _____ C:\Users\USER\Desktop\FRST.txt

2017-12-17 08:36 - 2017-12-17 08:38 - 000000000 ____D C:\FRST

2017-12-17 08:32 - 2017-12-17 08:32 - 000109296 _____ C:\Users\USER\AppData\Local\GDIPFONTCACHEV1.DAT

2017-12-17 08:26 - 2017-12-17 08:27 - 002392064 _____ (Farbar) C:\Users\USER\Desktop\FRST64.exe

2017-12-15 20:49 - 2017-12-15 22:39 - 000000000 ____D C:\Users\TEMP.USER-PC

2017-12-15 20:24 - 2017-12-15 20:47 - 000000000 ____D C:\Users\TEMP

2017-12-12 16:39 - 2017-12-12 16:39 - 000629726 _____ C:\Users\USER\Desktop\Asserting Yourself Effectively 2.pdf

2017-12-12 16:36 - 2017-12-12 16:36 - 000990589 _____ C:\Users\USER\Desktop\Asserting Yourself Effectively 1.pdf

2017-12-08 04:33 - 2017-12-07 21:43 - 000612056 _____ C:\Users\USER\Documents\District leader nominating form 2017-18.pdf

2017-12-08 04:33 - 2017-12-07 21:43 - 000085090 _____ C:\Users\USER\Documents\Officer Agreement and Release Form 2017-18.pdf

2017-12-07 19:32 - 2017-12-07 19:33 - 000556807 _____ C:\Users\USER\Downloads\archive (9).zip

2017-12-07 13:49 - 2017-12-07 13:51 - 000001348 _____ C:\Users\USER\Downloads\meetup.ics

2017-12-06 23:19 - 2017-12-01 00:28 - 000081344 _____ (360.cn) C:\Windows\system32\Drivers\360netmon.sys

2017-12-06 23:16 - 2017-12-06 23:16 - 000000000 ____D C:\ProgramData\1512634597_00000000_base

2017-12-06 16:49 - 2017-12-06 16:51 - 000556807 _____ C:\Users\USER\Downloads\archive (8).zip

2017-12-05 16:11 - 2017-12-05 16:12 - 000010299 _____ C:\Users\USER\Downloads\Auto ID Card.pdf

2017-12-03 11:42 - 2017-12-03 11:42 - 000074127 _____ C:\Users\USER\Downloads\Alaska Cash Buyers List.pdf

2017-12-01 23:59 - 2017-12-17 04:14 - 000252232 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys

2017-11-27 04:16 - 2017-11-27 04:18 - 036002160 _____ (LastPass) C:\Users\USER\Downloads\lastpass_x64.exe

2017-11-25 22:05 - 2017-11-25 22:06 - 006460851 _____ C:\Users\USER\Downloads\archive (7).zip

2017-11-21 18:09 - 2017-11-21 18:09 - 000027429 _____ C:\Users\USER\Documents\Untitled.wma

2017-11-21 18:04 - 2017-11-21 18:04 - 000444999 _____ C:\Users\USER\Documents\recordingme.wma

2017-11-21 05:26 - 2017-11-21 05:26 - 005195297 _____ C:\Users\USER\Downloads\Success program module brochure for ACG.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-17 08:33 - 2017-05-02 13:05 - 000000528 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1569642822-292156195-3241122032-1000.job

2017-12-17 08:16 - 2017-05-02 13:05 - 000000624 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1569642822-292156195-3241122032-1000.job

2017-12-17 04:38 - 2016-04-17 12:02 - 000000115 __RSH C:\ProgramData\3002.xml

2017-12-17 04:31 - 2009-07-13 19:45 - 000021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2017-12-17 04:31 - 2009-07-13 19:45 - 000021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2017-12-17 04:26 - 2016-03-10 15:54 - 000000000 ____D C:\Users\USER\AppData\LocalLow\360WD

2017-12-17 04:23 - 2017-08-08 03:36 - 000000000 ____D C:\Program Files\Opera

2017-12-17 04:14 - 2016-03-10 14:57 - 000017408 _____ C:\Windows\system32\rpcnetp.exe

2017-12-17 04:13 - 2016-04-17 12:00 - 000078032 _____ (Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.dll

2017-12-17 04:13 - 2016-03-10 14:58 - 000017408 _____ C:\Windows\SysWOW64\rpcnetp.dll

2017-12-17 04:13 - 2009-07-13 20:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2017-12-17 04:12 - 2016-03-10 14:57 - 000017408 _____ C:\Windows\SysWOW64\rpcnetp.exe

2017-12-17 03:11 - 2015-08-12 03:01 - 000000000 ___SD C:\Windows\system32\GWX

2017-12-17 03:11 - 2009-07-13 18:20 - 000000000 ____D C:\Windows\SysWOW64\Setup

2017-12-17 03:11 - 2009-07-13 18:20 - 000000000 ____D C:\Windows\system32\Setup

2017-12-17 03:11 - 2009-07-13 18:20 - 000000000 ____D C:\Windows\servicing

2017-12-17 03:11 - 2009-07-13 18:20 - 000000000 ____D C:\Windows\rescache

2017-12-17 03:11 - 2009-07-13 18:20 - 000000000 ____D C:\Windows\registration

2017-12-17 03:11 - 2009-07-13 18:20 - 000000000 ____D C:\Windows\inf

2017-12-17 03:11 - 2009-07-13 18:20 - 000000000 ____D C:\Program Files\Common Files\Microsoft Shared

2017-12-13 04:25 - 2015-08-11 23:40 - 000000000 ____D C:\Windows\system32\MRT

2017-12-12 03:46 - 2016-03-10 15:54 - 000000000 _RSHD C:\360SANDBOX

2017-12-10 03:38 - 2017-08-08 03:44 - 000003832 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1502196145

2017-12-10 03:38 - 2017-05-02 14:45 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2017-12-07 00:33 - 2017-07-11 11:14 - 000000000 ____D C:\Users\USER\AppData\Local\GoToMeeting

2017-12-07 00:18 - 2017-05-02 13:05 - 000003646 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1569642822-292156195-3241122032-1000

2017-12-07 00:18 - 2017-05-02 13:05 - 000003550 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1569642822-292156195-3241122032-1000

2017-12-06 23:19 - 2017-06-23 04:04 - 000001169 _____ C:\Users\Public\Desktop\360 Total Security.lnk

2017-12-06 23:19 - 2016-03-10 15:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Security Center

2017-12-05 11:56 - 2017-10-04 16:12 - 000000000 ____D C:\Users\USER\Documents\My Kindle Content

2017-12-03 18:24 - 2009-07-13 20:13 - 000785858 _____ C:\Windows\system32\PerfStringBackup.INI

2017-12-02 03:44 - 2017-05-02 14:38 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

2017-12-01 00:28 - 2017-11-07 23:57 - 000086248 _____ (360.cn) C:\Windows\system32\Drivers\360AvFlt.sys

2017-12-01 00:28 - 2016-04-29 16:51 - 000086248 _____ (360.cn) C:\Windows\SysWOW64\Drivers\360AvFlt.sys

2017-12-01 00:28 - 2016-03-10 15:54 - 000433784 _____ (360.cn) C:\Windows\system32\Drivers\360fsflt.sys

2017-12-01 00:28 - 2016-03-10 15:54 - 000330472 _____ (360.cn) C:\Windows\system32\Drivers\360Box64.sys

2017-12-01 00:28 - 2016-03-10 15:54 - 000201336 _____ (360.cn) C:\Windows\system32\Drivers\BAPIDRV64.SYS

2017-12-01 00:28 - 2016-03-10 15:54 - 000183416 _____ (360.cn) C:\Windows\system32\Drivers\360AntiHacker64.sys

2017-11-23 23:07 - 2017-02-10 09:19 - 000004314 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2017-11-23 23:07 - 2017-02-08 00:23 - 000004448 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier

2017-11-23 23:06 - 2017-02-08 00:23 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2017-11-23 23:06 - 2017-02-08 00:23 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2017-11-23 23:06 - 2017-02-08 00:22 - 000000000 ____D C:\Windows\SysWOW64\Macromed

2017-11-23 23:06 - 2017-02-08 00:22 - 000000000 ____D C:\Windows\system32\Macromed

2017-11-23 08:02 - 2017-10-11 02:07 - 127017032 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe

2017-11-23 08:01 - 2015-08-11 23:40 - 127017032 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-12-11 00:08

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-12-2017

Ran by [removed] (17-12-2017 08:43:01)

Running from C:\Users\[removed]\Desktop

Windows 7 Ultimate Service Pack 1 (X64) (2016-03-11 00:10:30)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1569642822-292156195-3241122032-500 - Administrator - Disabled)

Guest (S-1-5-21-1569642822-292156195-3241122032-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1569642822-292156195-3241122032-1003 - Limited - Enabled)

USER (S-1-5-21-1569642822-292156195-3241122032-1000 - Administrator - Enabled) => C:\Users\USER

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: 360 Total Security (Enabled - Up to date) {0371CA44-3F80-A1D3-BECE-910620B58D50}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: 360 Total Security (Enabled - Up to date) {B8102BA0-19BA-AE5D-847E-AA745B32C7ED}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

360 Total Security (HKLM-x32\…\360TotalSecurity) (Version: 9.6.0.1040 - 360 Security Center)

Acronis True Image 2016 (HKLM-x32\…\{986072E2-9A8A-4BE9-896B-18C3219BCE58}) (Version: 19.0.5518 - Acronis) Hidden

Acronis True Image 2016 (HKLM-x32\…\{986072E2-9A8A-4BE9-896B-18C3219BCE58}Visible) (Version: 19.0.5518 - Acronis)

Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.009.20050 - Adobe Systems Incorporated)

Adobe Flash Player 27 PPAPI (HKLM-x32\…\Adobe Flash Player PPAPI) (Version: 27.0.0.187 - Adobe Systems Incorporated)

Amazon Kindle (HKU\S-1-5-21-1569642822-292156195-3241122032-1000\…\Amazon Kindle) (Version: 1.20.1.47037 - Amazon)

Ashampoo Burning Studio 11 v.11.0.2 (HKLM-x32\…\Ashampoo Burning Studio 11_is1) (Version: 11.0.2 - Ashampoo GmbH & Co. KG)

Brother MFL-Pro Suite MFC-J825DW (HKLM-x32\…\{A1B36B88-AF90-43A3-8906-6DBEE89B4FBD}) (Version: 1.1.6.0 - Brother Industries, Ltd.)

BS.Player PRO (HKLM-x32\…\BSPlayerp) (Version: 2.69.1078 - AB Team, d.o.o.)

CAM UnZip 5.2.0.0 (HKLM-x32\…\CUZ5_is1) (Version: - CAM Development)

CyberLink PowerDVD 11 (HKLM-x32\…\InstallShield_{F232C87C-6E92-4775-8210-DFE90B7777D9}) (Version: 11.0.1719.51 - CyberLink Corp.)

FreeScreenSharing (HKU\S-1-5-21-1569642822-292156195-3241122032-1000\…\FreeScreenSharing) (Version: 0.58.75.0 - Free Conferencing Corporation)

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)

Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.3 - Google Inc.) Hidden

GoTo Opener (HKLM-x32\…\{8B2D47CC-1558-4939-B27F-41E30530072A}) (Version: 1.0.467 - LogMeIn, Inc.)

GoToMeeting 8.18.0.8034 (HKU\S-1-5-21-1569642822-292156195-3241122032-1000\…\GoToMeeting) (Version: 8.18.0.8034 - LogMeIn, Inc.)

Intel Security True Key (HKLM\…\TrueKey) (Version: 4.19.108.1 - Intel Security)

Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: 8.15.10.1930 - Intel Corporation)

KeePass Password Safe 1.33 (HKLM-x32\…\KeePass Password Safe_is1) (Version: 1.33 - Dominik Reichl)

LG AirDrive (HKLM-x32\…\{101E5DB3-07FA-4E52-8923-05068C94CF43}) (Version: 1.2.60617.11 - LG Electronics)

LG Bridge (HKLM-x32\…\LG Bridge) (Version: 1.2.18 - LG Electronics)

LG Mobile Driver (HKLM-x32\…\{3F490D0E-3131-438C-BCF9-7549CB88DF41}) (Version: 4.2.0 - LG Electronics)

Linksys Connect (HKLM-x32\…\Linksys Connect) (Version: 1.5.15287.0 - Linksys LLC)

Malwarebytes version 3.2.2.2029 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2029 - Malwarebytes)

Microsoft .NET Framework 4.5.2 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (HKLM-x32\…\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

Opera Stable 48.0.2685.39 (HKLM-x32\…\Opera 48.0.2685.39) (Version: 48.0.2685.39 - Opera Software)

The Unzip Wizard (HKLM-x32\…\The Unzip Wizard) (Version: - )

VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.1 - VideoLAN)

Zoom (HKU\S-1-5-21-1569642822-292156195-3241122032-1000\…\ZoomUMX) (Version: 3.5 - Zoom Video Communications, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1569642822-292156195-3241122032-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\USER\AppData\Local\GoToMeeting\7297\G2MOutlookAddin64.dll => No File

ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-07-23] (Acronis)

ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-07-23] (Acronis)

ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-07-23] (Acronis)

ContextMenuHandlers1: [SD360] -> {086F171D-5ED1-4ED2-B736-CFF3AD6A128E} => C:\Program Files (x86)\360\Total Security\MenuEx64.dll [2017-12-01] ()

ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)

ContextMenuHandlers4: [SD360] -> {086F171D-5ED1-4ED2-B736-CFF3AD6A128E} => C:\Program Files (x86)\360\Total Security\MenuEx64.dll [2017-12-01] ()

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2009-09-23] (Intel Corporation)

ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)

ContextMenuHandlers6: [SD360] -> {086F171D-5ED1-4ED2-B736-CFF3AD6A128E} => C:\Program Files (x86)\360\Total Security\MenuEx64.dll [2017-12-01] ()

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B7B9022-9008-42C1-BE30-84619AB03DE0} - System32\Tasks\G2MUploadTask-S-1-5-21-1569642822-292156195-3241122032-1000 => C:\Users\USER\AppData\Local\GoToMeeting\8034\g2mupload.exe [2017-12-07] (LogMeIn, Inc.)

Task: {1BB02931-32AA-4A3C-8F0A-5A139FA98780} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)

Task: {2916A4A7-C92E-4076-A297-49C27C725C1B} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfigAndContent

Task: {2916A4A7-C92E-4076-A297-49C27C725C1B} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2015-07-04] (Microsoft Corporation)

Task: {342F5140-BD40-424E-ABF0-027AC665E8B7} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig

Task: {342F5140-BD40-424E-ABF0-027AC665E8B7} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2015-07-04] (Microsoft Corporation)

Task: {50D25BB3-976D-4D60-B23A-CD590BE0398F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-11-23] (Adobe Systems Incorporated)

Task: {568DC1ED-810D-49B7-AA2F-CB8E4A37C9A8} - System32\Tasks\Opera scheduled Autoupdate 1502196145 => C:\Program Files\Opera\launcher.exe [2017-10-09] (Opera Software)

Task: {57B3EB6C-B3F9-4126-A9CC-4CFA4C879745} - System32\Tasks\G2MUpdateTask-S-1-5-21-1569642822-292156195-3241122032-1000 => C:\Users\USER\AppData\Local\GoToMeeting\8034\g2mupdate.exe [2017-12-07] (LogMeIn, Inc.)

Task: {5ACBC616-0A12-410B-AEC4-31898DD4E2D2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-23] (Google Inc.)

Task: {9679BE3B-1702-4A4C-8B47-E180AFF9A66E} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_27_0_0_187_pepper.exe [2017-11-23] (Adobe Systems Incorporated)

Task: {B7EC7288-73CF-4093-970D-F5B32EF9D0EB} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe [2016-12-15] (McAfee, Inc.)

Task: {EBC54FB9-9FA0-4BAC-9398-6CAC31CC3190} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig

Task: {EBC54FB9-9FA0-4BAC-9398-6CAC31CC3190} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(2): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshContent

Task: {EBC54FB9-9FA0-4BAC-9398-6CAC31CC3190} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(3): C:\Windows\system32\GWX\GWXDetector.exe [2015-07-04] (Microsoft Corporation)

Task: {EF03D0EA-E8EF-4A0F-A45F-7BA3ACB28357} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-23] (Google Inc.)

Task: {FCB202BD-083B-45F6-99C2-933FA8943C84} - System32\Tasks\{2D2EC208-BE45-4E45-B192-781DF9CA4591} => C:\Program Files (x86)\LG Electronics\LG Bridge\LGBridge.exe [2016-07-20] (LG Electronics)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1569642822-292156195-3241122032-1000.job => C:\Users\USER\AppData\Local\GoToMeeting\8034\g2mupdate.exe

Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1569642822-292156195-3241122032-1000.job => C:\Users\USER\AppData\Local\GoToMeeting\8034\g2mupload.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-03-10 15:30 - 2011-05-18 18:00 - 000083240 _____ () C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe

2017-10-30 01:57 - 2017-10-04 12:15 - 002289096 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll

2016-03-10 15:54 - 2017-12-01 00:28 - 000099240 _____ () C:\Program Files (x86)\360\Total Security\deepscan\qutmload.dll

2016-03-10 15:54 - 2017-12-01 00:28 - 000499296 _____ () C:\Program Files (x86)\360\Total Security\safemon\wdui2.dll

2016-10-11 22:29 - 2009-02-27 15:38 - 000139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll

2015-08-16 22:44 - 2015-08-16 22:44 - 000036160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll

2015-08-16 22:44 - 2015-08-16 22:44 - 000446272 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll

2015-08-16 22:44 - 2015-08-16 22:44 - 000116032 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\EXPAT.dll

2016-10-21 20:19 - 2016-09-06 11:00 - 005197312 _____ () C:\Users\USER\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libglesv2.dll

2016-10-21 20:19 - 2016-09-06 11:00 - 000147456 _____ () C:\Users\USER\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 17:34 - 2017-05-21 00:21 - 000000838 _____ C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 activation.acronis.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1569642822-292156195-3241122032-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\USER\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: [removed] - [removed]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\startupreg: Acronis Scheduler2 Service => "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"

MSCONFIG\startupreg: AcronisTibMounterMonitor => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe

MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN

MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun

MSCONFIG\startupreg: FreeScreenSharing => C:\Users\USER\AppData\Local\FreeScreenSharing\FreeScreenSharing.exe

MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

MSCONFIG\startupreg: RemoteControl11 => "C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe"

MSCONFIG\startupreg: TrueImageMonitor.exe => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{A0027C7A-1E63-444E-9EAD-79441C14E670}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD11\PowerDVD11.exe

FirewallRules: [{8302C41C-A07B-4DC3-9126-F58EB97D5F36}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe

FirewallRules: [{8FB9F484-95CB-4F34-8C15-9EADBFE59A29}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServer.exe

FirewallRules: [{A7E582B0-57A2-47D4-B474-76510248E652}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD11\Movie\MovieModule.exe

FirewallRules: [{EE6C942E-C218-4866-9199-5573BF7C7149}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD11\Movie\PowerDVD Cinema\PowerDVDCinema11.exe

FirewallRules: [{032826FE-5294-4D2F-8951-42E30D4805E8}] => (Allow) C:\Users\USER\AppData\Local\Temp\chrome.exe

FirewallRules: [{15DE69DA-1D77-443F-BE73-0650689DF99F}] => (Allow) C:\Users\USER\AppData\Local\Temp\chrome.exe

FirewallRules: [{09BDB1A6-8431-4A94-8EB3-D0E760732B96}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe

FirewallRules: [{13AC9174-F59F-4ABA-B8B3-6BC6AE7A71C7}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe

FirewallRules: [{4331D2E6-448F-4E9A-A98F-B1975F750C16}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe

FirewallRules: [{E2E3669C-53C0-44A0-BA9F-3F8636A60D53}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe

FirewallRules: [{1A24B702-8747-45EF-84C7-85625073225C}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe

FirewallRules: [{9BE300FC-1325-4BB8-8C3E-B22F92C4673B}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe

FirewallRules: [{9F12E978-B2ED-40D8-9CEE-D6C7C4788E7C}] => (Allow) C:\Program Files (x86)\360\Total Security\softmgr\InstantSetup.exe

FirewallRules: [{28F87125-FEB2-44AF-BC64-62555D52A346}] => (Allow) C:\Program Files (x86)\360\Total Security\softmgr\InstantSetup.exe

FirewallRules: [{DAA0E368-95E7-4156-ACD3-F84921F762FD}] => (Allow) C:\Program Files (x86)\360\Total Security\softmgr\360InstantSetup.exe

FirewallRules: [{25B65283-8BB4-4EC3-BB60-7995C30437E3}] => (Allow) C:\Program Files (x86)\360\Total Security\softmgr\360InstantSetup.exe

FirewallRules: [TCP Query User{A710672D-1E30-46A8-B6DB-50972914BF30}C:\users\user\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\user\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe

FirewallRules: [UDP Query User{87DC36E8-D25D-4D39-B141-958ACEE4B229}C:\users\user\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\user\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe

FirewallRules: [TCP Query User{2CF87008-053D-4D99-839D-075BF440EFB3}C:\users\user\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe] => (Allow) C:\users\user\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe

FirewallRules: [UDP Query User{85E9F466-B495-4241-8AE7-F1C7C4C8F4E4}C:\users\user\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe] => (Allow) C:\users\user\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe

FirewallRules: [{62026277-0E71-4CD5-B0CC-F8950BDD1B33}] => (Allow) C:\Program Files (x86)\360\Total Security\softmgr\360InstantSetup.exe

FirewallRules: [{89ADA82F-3DE2-4247-807D-33539B90C16C}] => (Allow) C:\Program Files (x86)\360\Total Security\softmgr\360InstantSetup.exe

FirewallRules: [{055A4135-5F81-4411-BA8E-776E3AABCBA3}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{CC52AF18-9255-4617-841E-6D992FAD8F47}] => (Allow) C:\Program Files\Opera\48.0.2685.35\opera.exe

FirewallRules: [{76DD1CF3-8C7F-414B-A346-27EEF4A39585}] => (Allow) C:\Program Files\Opera\48.0.2685.39\opera.exe

FirewallRules: [{65AF51F5-3396-4E24-905A-60DE4AF14529}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

FirewallRules: [{08BC01C4-DE25-41F4-B701-73E80174638D}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

FirewallRules: [{0147F571-FE68-4683-9061-2FD9C2AF9653}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

FirewallRules: [{2C3850B8-8A69-453E-80D6-6FDD4DA6D603}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

==================== Restore Points =========================

13-12-2017 04:15:59 Windows Update

17-12-2017 04:30:41 Windows Update

==================== Faulty Device Manager Devices =============

Name: Mobile Intel(R) 965 Express Chipset Family

Description: Mobile Intel(R) 965 Express Chipset Family

Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}

Manufacturer: Intel Corporation

Service: igfx

Problem: : Windows cannot initialize the device driver for this hardware. (Code 37)

Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.

Name: PS/2 Compatible Mouse

Description: PS/2 Compatible Mouse

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: LDDM Graphics Subsystem

Description: LDDM Graphics Subsystem

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer:

Service: DXGKrnl

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:

==================

Error: (12/17/2017 04:15:47 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/17/2017 04:14:13 AM) (Source: Windows Search Service) (EventID: 7010) (User: )

Description: The index cannot be initialized.

Details:

The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/17/2017 04:14:13 AM) (Source: Windows Search Service) (EventID: 3058) (User: )

Description: The application cannot be initialized.

Context: Windows Application

Details:

The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/17/2017 04:14:13 AM) (Source: Windows Search Service) (EventID: 3028) (User: )

Description: The gatherer object cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:

The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/17/2017 04:14:13 AM) (Source: Windows Search Service) (EventID: 3029) (User: )

Description: The plug-in in cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:

Element not found. (HRESULT : 0x80070490) (0x80070490)

Error: (12/17/2017 04:14:12 AM) (Source: Windows Search Service) (EventID: 3029) (User: )

Description: The plug-in in cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:

The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/17/2017 04:14:12 AM) (Source: Windows Search Service) (EventID: 9002) (User: )

Description: The Windows Search Service cannot load the property store information.

Context: Windows Application, SystemIndex Catalog

Details:

The content index database is corrupt. (HRESULT : 0xc0041800) (0xc0041800)

Error: (12/17/2017 04:14:12 AM) (Source: Windows Search Service) (EventID: 7042) (User: )

Description: The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.

Details:

The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/17/2017 04:14:12 AM) (Source: Windows Search Service) (EventID: 7040) (User: )

Description: The search service has detected corrupted data files in the index {id=4700}. The service will attempt to automatically correct this problem by rebuilding the index.

Details:

The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/17/2017 04:14:12 AM) (Source: Windows Search Service) (EventID: 9000) (User: )

Description: The Windows Search Service cannot open the Jet property store.

Details:

0x%08x (0xc0041800 - The content index database is corrupt. (HRESULT : 0xc0041800))

System errors:

=============

Error: (12/17/2017 04:14:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (12/17/2017 04:14:14 AM) (Source: Service Control Manager) (EventID: 7024) (User: )

Description: The Windows Search service terminated with service-specific error %%-1073473535.

Error: (12/17/2017 04:13:11 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Service Installer TrueKey service failed to start due to the following error:

The system cannot find the file specified.

Error: (12/17/2017 04:12:59 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT AUTHORITY)

Description: 0x8000002a28\??\C:\Users\USER\ntuser.dat

Error: (12/17/2017 03:53:51 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (12/17/2017 03:53:47 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (12/17/2017 03:53:44 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (12/17/2017 03:53:40 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (12/17/2017 03:53:37 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (12/17/2017 03:53:33 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 Duo CPU T7500 @ 2.20GHz

Percentage of memory in use: 93%

Total physical RAM: 2037.97 MB

Available physical RAM: 137.86 MB

Total Virtual: 4075.94 MB

Available Virtual: 950.81 MB

==================== Drives ================================

Drive c: (New Volume) (Fixed) (Total:74.53 GB) (Free:29.4 GB) NTFS ==>[drive with boot components (obtained from BCD)]

Drive d: (CHARADE_SCN) (CDROM) (Total:7.61 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 74.5 GB) (Disk ID: A0C27A56)

Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Run date: 2017-12-17 08:55:48

—————————–

08:55:48.033 OS Version: Windows x64 6.1.7601 Service Pack 1

08:55:48.033 Number of processors: 2 586 0xF0B

08:55:48.033 ComputerName: USER-PC UserName: USER

08:55:50.970 Initialize success

08:55:51.719 VM: initialized successfully

08:55:51.719 VM: Intel CPU BiosDisabled

09:02:25.136 AVAST engine defs: 17030301

09:15:59.018 The log file has been saved successfully to "C:\Users\USER\Desktop\aswMBR.txt"

Juliet

Post #5December 17, 2017, 7:50 PM UTC

When you ran the Malwarebytes Anti-Rootkit (MBAR) scan, can you recall if it had found anything?

***

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:

Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

[external image: 15wKX7o.jpg]

start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-1569642822-292156195-3241122032-1000\…\Run: [Zoom] => [X]
GroupPolicy: Restriction <==== ATTENTION
S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]
S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]
S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
CustomCLSID: HKU\S-1-5-21-1569642822-292156195-3241122032-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\USER\AppData\Local\GoToMeeting\7297\G2MOutlookAddin64.dll => No File
EmptyTemp:
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

[external image: RQKuhw1.png]RogueKiller

Download the right version of RogueKiller for your Windows version (32 or 64-bit)
Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
Wait for the scan to complete
On completion, the results will be displayed
Check every single entry (threat found), and click on the Remove Selected button
On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
This will open the report in Notepad. Copy/paste its content in your next reply

***

[external image: zcMPezJ.png]AdwCleaner - Fix Mode

Download AdwCleaner and move it to your Desktop
Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Accept the EULA (I accept), then click on Scan
Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
🖼Click to load external image (V7SD4El.png)
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

created by Aura

Your next reply(ies) should therefore contain:

fixlist.txt
Copy/pasted RogueKiller clean log
Copy/pasted AdwCleaner clean log

~~

Also indicated in your previous logs, this might be a sign of a hard drive problem.
Description: The device, \Device\Harddisk0\DR0, has a bad block
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

gbsk

Post #6December 19, 2017, 2:56 AM UTC

_{I had Chrome installed and it corrupted so now I have to use IE. I tried to download Rogue Killer with your link. It took me to this link and this link says something else so I did not run it. I will send this now and then do AdwClaner.}

_{http://www.winzipsystemtools.com/mp/prodpagemp.htm?gclid=EAIaIQobChMIvMDC1IaV2AIV1BZiCh3ksAXREAEYASAAEgLZs_D_BwE}

_{Here is results of FRST.}

_{Fix result of Farbar Recovery Scan Tool (x64) Version: 17-12-2017

Ran by [removed] (18-12-2017 11:34:00) Run:1

Running from C:\Users\[removed]\Desktop

[removed]
Boot Mode: Normal

==============================================}

_{fixlist content:

*****************

start

CreateRestorePoint:

CloseProcesses:

HKU\S-1-5-21-1569642822-292156195-3241122032-1000\…\Run: [Zoom] => [X]

GroupPolicy: Restriction <==== ATTENTION

S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]

S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]

S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

CustomCLSID: HKU\S-1-5-21-1569642822-292156195-3241122032-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\USER\AppData\Local\GoToMeeting\7297\G2MOutlookAddin64.dll => No File

EmptyTemp:

End

*****************}

_{Restore point was successfully created.

Processes closed successfully.

HKU\S-1-5-21-1569642822-292156195-3241122032-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Zoom => value removed successfully}

_{"C:\Windows\system32\GroupPolicy\Machine" folder move:}

_{Could not move "C:\Windows\system32\GroupPolicy\Machine" => Scheduled to move on reboot.}

_{"HKLM\System\CurrentControlSet\Services\usbbus" => removed successfully

usbbus => service removed successfully

"HKLM\System\CurrentControlSet\Services\UsbDiag" => removed successfully

UsbDiag => service removed successfully

"HKLM\System\CurrentControlSet\Services\USBModem" => removed successfully

USBModem => service removed successfully

"HKLM\System\CurrentControlSet\Services\VGPU" => removed successfully

VGPU => service removed successfully

"HKU\S-1-5-21-1569642822-292156195-3241122032-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}" => removed successfully}

_{=========== EmptyTemp: ==========}

_{BITS transfer queue => 8388608 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 2113439 B

Java, Flash, Steam htmlcache => 0 B

Windows/system/drivers => 11619851 B

Edge => 0 B

Chrome => 468957627 B

Firefox => 164078138 B

Opera => 46649200 B}

_{Temp, IE cache, history, cookies, recent:

Users => 0 B

Default => 0 B

Public => 0 B

ProgramData => 0 B

systemprofile => 128 B

systemprofile32 => 10903 B

LocalService => 0 B

NetworkService => 64366 B

USER => 202930062 B}

gbsk

Post #7December 19, 2017, 3:26 AM UTC

Thank you.

# AdwCleaner 7.0.5.0 - Logfile created on Tue Dec 19 03:17:15 2017
# Updated on 2017/29/11 by Malwarebytes
# Running on Windows 7 Ultimate (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Key] - HKU\S-1-5-21-1569642822-292156195-3241122032-1000\Software\Conduit
Deleted: [Key] - HKCU\Software\Conduit

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [1063 B] - [2017/12/19 3:0:16]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Juliet

Post #8December 19, 2017, 11:29 AM UTC

Try this download link for RogueKiller
https://www.bleepingcomputer.com/download/roguekiller/

Try resetting Chrome
[external image: U5NwUGc.png]Backup Chrome Bookmarks
Proceed with the reset once done.
[external image: U5NwUGc.png]Chrome: Chrome - Reset browser settings

gbsk

Post #9December 19, 2017, 9:31 PM UTC

Juliet,

Here is the Rogue Killer scan. You noticed that Chrome got corrupted. I am using IE because of that. I will have to switch to Chrome to do the things you said. Thanks for helping.

RogueKiller V12.11.29.0 (x64) [Dec 18 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : USER [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete – Date : 12/19/2017 10:44:56 (Duration : 01:02:52)
Switches : -refid

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 9 ¤¤¤
[Suspicious.Path] (X64) HKEY_CLASSES_ROOT\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309} (C:\Users\USER\AppData\Local\GoToMeeting\7297\G2MOutlookAddin64.dll) -> Deleted
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : [removed] [removed] 192.168.1.1 ([-][United States][-]) -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : [removed] [removed] 192.168.1.1 ([-][United States][-]) -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{E95A4C0B-80EA-4FBF-849A-C899DCB576D5} | DhcpNameServer : [removed] [removed] 192.168.1.1 ([-][United States][-]) -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{E95A4C0B-80EA-4FBF-849A-C899DCB576D5} | DhcpNameServer : [removed] [removed] 192.168.1.1 ([-][United States][-]) -> Replaced ()
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {032826FE-5294-4D2F-8951-42E30D4805E8} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\USER\AppData\Local\Temp\chrome.exe|Name=chrome.exe| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {15DE69DA-1D77-443F-BE73-0650689DF99F} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\USER\AppData\Local\Temp\chrome.exe|Name=chrome.exe| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {032826FE-5294-4D2F-8951-42E30D4805E8} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\USER\AppData\Local\Temp\chrome.exe|Name=chrome.exe| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {15DE69DA-1D77-443F-BE73-0650689DF99F} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\USER\AppData\Local\Temp\chrome.exe|Name=chrome.exe| [x] -> Deleted

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0x10000]) ¤¤¤

¤¤¤ Web browsers : 2 ¤¤¤
[PUP.Gen0][Chrome:Addon] Default : Video Downloader professional [elicpjhcidhpjomhibiffojpinpmmpil] -> Deleted
[PUM.HomePage][Chrome:Config] Default [SecurePrefs] : homepage [http://www.matsu.alaska.edu/]-> Deleted

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST980813AS ATA Device +++++
— User —
[MBR] 046969326db4503704fb249c126444f1
[BSP] 92b45f6da2ad172045d2b2665f1b1824 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 76318 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 … OK
User = LL2 … OK

Juliet

Post #10December 19, 2017, 10:21 PM UTC

The last scan kinda focused on Chrome, any improvements?

gbsk

Post #11December 19, 2017, 10:50 PM UTC

Juliet,

Chrome would not open. I tried to uninstall it and it said it was already uninstalled so I removed the shortcut and downloaded and reinstalled Chrome. I am using IE now. It is slow. I noticed that there is a small dot in the upper right hand corner of the browser that comes on once in awhile and moved and then shuts off. All this takes probably less than a second. I think it happened in Chrome too, only it was in the lower left hand corner. Chrome is still downloading so I will try it. Chrome works but it is slow. I pull the scroll bar down but it takes a few seconds to actually go down. You said something about a corrupted HD. Do we need to get a new computer?

Thanks

Juliet

Post #12December 20, 2017, 1:10 AM UTC last edited December 20, 2017, 1:11 AM UTC

Sorry your having these issues with Chrome.
What we might can do is to use a tool to completely remove it with all files and registry entries and attempt to download and do a fresh install.

Let me know if you think we can do that and also, Have you ever tried Firefox for a browser?

360 Total Security could be at fault here for having lags/bogging down in the system.

~~~

Since you already have Malwarebytes Anti-Malware on the computer
Let's open Malwarebytes, click on the little arrow by Scan Status in the middle right pane for it to do so

Once the database update is complete, click on the Scan tab, then select the Threat Scan button and click on Start Scan
[external image: Tu39lqJ.png]
Let the scan run, the time required to complete the scan depends of your system and computer specs
[external image: Qqbh4g8.png]
Once the scan is complete, make sure that the first checkbox at the top is checked (which will automatically check every detected item), then click on the Quarantine Selected button
If it asks you to restart your computer to complete the removal, do so
Click on Export Summary after the deletion (in the bottom-left corner) and select Copy to Clipboard.
🖼Click to load external image (1CtdZ26.png)
Paste the content in your next reply

~~~~~~~~~~~~~~~~~~~~~~
indicated in your previous logs, this might be a sign of a hard drive problem.
Description: The device, \Device\Harddisk0\DR0, has a bad block
The below link describes how to run chkdsk to check for bad sectors.
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

gbsk

Post #13December 22, 2017, 3:00 AM UTC

Juliet,

I ran Malwarebytes. It found nothing to quarantine. I ran chkdsk and it took awhile to run. It said that it could not fix some corrupted files. Thanks for helping. I was thinking of running a scan disk.

gbsk

Post #14December 22, 2017, 3:20 AM UTC

Another thing, we have had 360 Total Security for over a year and it seems to work well. I think it works much better than Malwarebytes. Why would that be a problem now?

Thanks,

Juliet

Post #15December 22, 2017, 10:59 AM UTC

Another thing, we have had 360 Total Security for over a year and it seems to work well. I think it works much better than Malwarebytes. Why would that be a problem now?

Thanks,
GB

It might not be the problem. At times it can be a resources hog and bog down the machine or it was having a problem updating.

Problem could be windows is trying to update,
You can open task manager and try to locate an exe to see what is using the most CPU?

When I'm not seeing anything being brought up on scans related to malware I have to suspect items/tools/programs already on the machine that are possibly updating or corrupt.

Let's try running this tool below.

System File Checker
sfc/scannow
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Slow computer

✨ Ask AI

Ask AI