Spyware / Malware / Virus Removal

JS:Agent-EDB infection [Solved]

20 min read

Looking for the outcome? Ask AI

terryfelter

Post #31January 11, 2018, 5:56 PM UTC

Major issue with the pc you helped me with today, the attempt to restore TradeStation failed, so uninstalled and on reboot the system failed to start. Attempting to do a StartUp Repair currently. Hope for it to recover.

Satchfan

Post #32January 11, 2018, 9:12 PM UTC

Nothing that was deleted regarding TradeStation should have caused this. Did you uninstall Spybot?

terryfelter

Post #33January 11, 2018, 9:23 PM UTC last edited January 11, 2018, 9:49 PM UTC

Everything reverted so back to square one.

# AdwCleaner 7.0.6.0 - Logfile created on Thu Jan 11 19:49:57 2018
# Updated on 2017/21/12 by Malwarebytes
# Running on Windows 7 Home Premium (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

Deleted: ByteFenceService
Deleted: rtop

***** [ Folders ] *****

Deleted: C:\ProgramData\ByteFence
Deleted: C:\ProgramData\Application Data\ByteFence
Deleted: C:\Program Files\ByteFence
Deleted: C:\Users\All Users\ByteFence
Deleted: C:\Users\Terry Felter\AppData\Roaming\Microsoft\Windows\Start Menu\ByteFence

***** [ Files ] *****

Deleted: C:\Users\Terry Felter\Documents\uninstaller.exe
Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

Deleted: ByteFence Scan
Deleted: ByteFence

***** [ Registry ] *****

Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\APN PIP
Deleted: [Key] - HKCU\Software\APN PIP
Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\darwendlm
Deleted: [Key] - HKCU\Software\darwendlm
Deleted: [Key] - HKLM\SOFTWARE\Classes\*\shell\ByteFence File Scan
Deleted: [Key] - HKLM\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan
Deleted: [Key] - HKLM\SOFTWARE\ByteFence
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence
Deleted: [Key] - HKU\.DEFAULT\Software\ByteFence
Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\ByteFence
Deleted: [Key] - HKU\S-1-5-18\Software\ByteFence
Deleted: [Key] - HKCU\Software\ByteFence
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|ByteFence.exe
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Reason\ReasonByteFence
Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\csastats
Deleted: [Key] - HKCU\Software\csastats
Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\PRODUCTSETUP
Deleted: [Key] - HKCU\Software\PRODUCTSETUP

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[C1].txt - [3219 B] - [2016/7/15 2:37:17]
C:/AdwCleaner/AdwCleaner[S1].txt - [3270 B] - [2016/7/15 2:33:17]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt ##########

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/11/18
Scan Time: 2:28 PM
Log File: 05fb8eeb-f70e-11e7-8d2c-f01faf01a6d9.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3676
License: Free

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TerryFelter-PC\Terry Felter

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 268912
Threats Detected: 10
Threats Quarantined: 8
Time Elapsed: 12 min, 51 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 3
PUP.Optional.WinYahoo, HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [53], [182758],1.0.3676
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [53], [182758],1.0.3676
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Quarantined, [53], [182758],1.0.3676

Registry Value: 3
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, Quarantined, [53], [182758],1.0.3676
PUP.Optional.NotChromeRun, HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|CHROMIUM, Quarantined, [1283], [391151],1.0.3676
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, Quarantined, [53], [182758],1.0.3676

Registry Data: 2
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replaced, [53], [293461],1.0.3676
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replaced, [53], [293461],1.0.3676

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 2
PUP.Optional.OpenCandy, C:\USERS\TERRY FELTER\DOCUMENTS\CHEATENGINE63.EXE, No Action By User, [457], [101648],1.0.3676
PUP.Optional.OpenCandy, C:\USERS\TERRY FELTER\DOWNLOADS\CHEATENGINE63.EXE, No Action By User, [457], [101648],1.0.3676

Physical Sector: 0
(No malicious items detected)

(end)

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/11/18
Scan Time: 2:28 PM
Log File: 05fb8eeb-f70e-11e7-8d2c-f01faf01a6d9.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3676
License: Free

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TerryFelter-PC\Terry Felter

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 268912
Threats Detected: 10
Threats Quarantined: 8
Time Elapsed: 12 min, 51 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

(end)

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02.01.2018
Ran by [removed] (administrator) on TERRYFELTER-PC (11-01-2018 15:06:52)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe
(Broadcom Corporation) C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe
(Storage Appliance Corp.) C:\ProgramData\OfficeGuardianV2\UACProxy.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(SAC) C:\ProgramData\OfficeGuardianV2\reminder\SacReminder.exe
() C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
() C:\Program Files (x86)\Real\RealDownloader\downloader2.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealDownloader\realdownloader264.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealDownloader\recordingmanager.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_28_0_0_137_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [736552 2015-05-29] (Alps Electric Co., Ltd.)
HKLM\…\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (IDT, Inc.)
HKLM-x32\…\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-11-13] (Intel Corporation)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-22] (Intel Corporation)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [221184 2006-10-27] (Sonic Solutions)
HKLM-x32\…\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2006-08-25] (Macrovision Corporation)
HKLM-x32\…\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2006-08-25] (Macrovision Corporation)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\…\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\…\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [353104 2017-09-18] (RealNetworks, Inc.)
HKLM-x32\…\Run: [RealDownloader] => C:\program files (x86)\real\RealDownloader\downloader2.exe [1259704 2017-08-17] ()
HKLM-x32\…\Winlogon: [Userinit] <$SYSDIR>\userinit.exe,
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [DellSystemDetect] => C:\Users\Terry Felter\AppData\Local\Apps\2.0\0R4EQAGX.Z5E\4QXKKBOM.0ZB\dell..tion_6d0a76327dca4869_0007.000b_df227eeaae3cac0d\DellSystemDetect.exe [310728 2016-12-29] (Dell)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [SacReminderHDDV2] => C:\ProgramData\OfficeGuardianV2\reminder\SacReminder.exe [464752 2012-06-28] (SAC)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} - E:\win\setup.exe -phs
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} - E:\StartClickFreeBackup.exe
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-13] (Microsoft Corporation)
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2016-11-25] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk [2016-11-24]
ShortcutTarget: Microsoft Find Fast.lnk -> C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealTimes.lnk [2017-09-18]
ShortcutTarget: RealTimes.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
BootExecute: autocheck autochk *

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{40C3FB48-7144-4278-80E9-D08F9B0A32E7}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{45F66900-7B34-48B9-B4B7-659E8804DBA8}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{73DDFA2D-603C-4D3B-BBB8-E3ADCBB82CC8}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\program files (x86)\real\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2017-08-17] (RealDownloader)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\program files (x86)\real\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2017-08-17] (RealDownloader)
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://tradestation.webex.com/client/T31L/support/ieatgpc1.cab
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE -

FireFox:
========
FF DefaultProfile: po0agpgk.default
FF ProfilePath: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default [2018-01-11]
FF Homepage: Mozilla\Firefox\Profiles\po0agpgk.default -> www.msn.com
FF NewTab: Mozilla\Firefox\Profiles\po0agpgk.default -> about:newtab
FF Extension: (Bing Search) - C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\Extensions\[removed] [2016-11-25] [Legacy]
FF Extension: (Disable JavaScript Shared Memory) - C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\features\{1fd245ec-2c2b-4ac1-96f0-7c54a4c4c515}\[removed] [2018-01-09] [Legacy]
FF SearchPlugin: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\searchplugins\bing-.xml [2016-11-25]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-11-13] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-11-13] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=18.1.9.106 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2017-09-18] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=18.1.9.106 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2017-09-18] (RealPlayer)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: @zoom.us/ZoomVideoPlugin -> C:\Users\Terry Felter\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2017-09-09] (Zoom Video Communications, Inc.)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: jpl.nasa.gov/NASAEyes -> C:\Users\Terry Felter\AppData\Roaming\JPL-NASA-Caltech\NASA's Eyes\npNASAEyes.dll [2017-12-13] (Jet Propulsion Laboratory)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: tdameritrade.com/thinkorswim -> C:\Program Files\thinkorswim\npthinkorswim.dll [2017-07-14] (TD Ameritrade)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: tdameritrade.com/tossc -> C:\Program Files\thinkorswim\nptossc.dll [2017-07-14] (TD Ameritrade)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 ApHidMonitorService; C:\Program Files\DellTPad\HidMonitorSvc.exe [96000 2015-09-25] (Alps Electric Co., Ltd.)
R2 BrcmMgmtAgent; C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe [163840 2011-11-30] (Broadcom Corporation) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S4 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319096 2016-06-15] (Intel Corporation)
S4 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S4 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S4 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-11-13] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
S4 RealPlayerUpdateSvc; C:\program files (x86)\real\UpdateService\RealPlayerUpdateSvc.exe [37104 2017-08-17] (RealNetworks, Inc.)
R2 RealTimes Desktop Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [989912 2017-09-18] (RealNetworks, Inc.)
S3 Roxio UPnP Renderer 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe [57344 2006-10-26] (Sonic Solutions) [File not signed]
S2 Roxio Upnp Server 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe [294912 2006-10-26] (Sonic Solutions) [File not signed]
S2 RoxLiveShare9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe [303104 2006-10-27] (Sonic Solutions) [File not signed]
S3 RoxMediaDB9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [880640 2006-10-27] (Sonic Solutions) [File not signed]
S2 RoxWatch9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [159744 2006-10-27] (Sonic Solutions) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.) [File not signed]
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S4 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6177280 2014-01-14] (Dell Inc.) [File not signed]
R2 CFUACProxy_officeguardianv2; "C:\ProgramData\OfficeGuardianV2\UACProxy.exe" -s "-pC:\ProgramData\OfficeGuardianV2"

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2016-11-27] (Glarysoft Ltd)
R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2018-01-11] (Malwarebytes)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-11-13] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S1 RxFilter; C:\Windows\System32\DRIVERS\RxFilter.sys [58880 2006-10-27] (Sonic Solutions) [File not signed]
S1 RxFilter; C:\Windows\SysWOW64\DRIVERS\RxFilter.sys [58880 2006-10-27] (Sonic Solutions) [File not signed]
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_Accel.sys [89312 2013-03-27] (STMicroelectronics)
S3 swHSnet00; C:\Windows\System32\DRIVERS\swHSnet00.sys [376264 2012-12-19] (Sierra Wireless Incorporated)
S3 swHSser00; C:\Windows\System32\DRIVERS\swHSser00.sys [269512 2012-12-19] (Sierra Wireless Incorporated)
S3 swiwdmbx; C:\Windows\System32\DRIVERS\swiwdmbx.sys [114424 2012-12-19] (Sierra Wireless Inc.)
S3 swiwdmbxhs; C:\Windows\System32\DRIVERS\swiwdmbxhs.sys [114424 2012-12-19] (Sierra Wireless Inc.)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\EX64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-11 15:05 - 2018-01-11 15:05 - 002393088 _____ (Farbar) C:\Users\Terry Felter\Desktop\FRST64.exe
2018-01-11 14:28 - 2018-01-11 14:28 - 000253880 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-01-11 14:27 - 2018-01-11 14:27 - 000001873 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-01-11 14:27 - 2018-01-11 14:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-01-11 14:27 - 2018-01-11 14:27 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-01-11 14:27 - 2017-11-29 09:11 - 000077432 _____ C:\Windows\system32\Drivers\mbae64.sys
2018-01-11 14:13 - 2018-01-11 14:14 - 083316440 _____ (Malwarebytes ) C:\Users\Terry Felter\Downloads\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3374.exe
2018-01-11 13:46 - 2018-01-11 13:46 - 000002033 _____ C:\Users\Public\Desktop\TradeStation 9.5.lnk
2018-01-11 13:46 - 2018-01-11 13:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TradeStation 9.5
2018-01-11 13:45 - 2018-01-11 13:46 - 000000000 ____D C:\Program Files (x86)\TradeStation 9.5
2018-01-11 13:41 - 2018-01-11 13:42 - 008198432 _____ (Malwarebytes) C:\Users\Terry Felter\Desktop\adwcleaner_7.0.6.0.exe
2018-01-11 09:25 - 2018-01-11 09:27 - 000010364 _____ C:\Users\Terry Felter\Desktop\Fixlog.txt
2018-01-11 06:51 - 2018-01-11 06:51 - 000000000 ____D C:\Program Files\Malwarebytes
2018-01-10 17:29 - 2018-01-11 07:20 - 000054074 _____ C:\Users\Terry Felter\Desktop\Addition.txt
2018-01-10 17:26 - 2018-01-11 15:07 - 000018348 _____ C:\Users\Terry Felter\Desktop\FRST.txt
2018-01-10 17:25 - 2018-01-11 15:06 - 000000000 ____D C:\FRST
2018-01-08 05:26 - 2018-01-08 05:26 - 000003338 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
2018-01-07 07:23 - 2018-01-07 07:23 - 000644236 _____ C:\Users\Terry Felter\Downloads\weekly-thoughs-1-8-2018.pdf
2017-12-21 06:54 - 2017-11-14 19:27 - 000395968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-12-21 06:54 - 2017-11-14 18:36 - 000347336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-12-21 06:54 - 2017-11-13 21:43 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-12-21 06:54 - 2017-11-13 21:32 - 002903552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-12-21 06:54 - 2017-11-13 21:31 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-12-21 06:54 - 2017-11-13 21:31 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-12-21 06:54 - 2017-11-13 21:24 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-12-21 06:54 - 2017-11-13 21:20 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-12-21 06:54 - 2017-11-13 21:15 - 000968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-12-21 06:54 - 2017-11-13 21:06 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-12-21 06:54 - 2017-11-13 21:05 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-12-21 06:54 - 2017-11-13 21:00 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-12-21 06:54 - 2017-11-13 20:59 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-12-21 06:54 - 2017-11-13 20:48 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-12-21 06:54 - 2017-11-13 20:48 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-12-21 06:54 - 2017-11-13 20:46 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-12-21 06:54 - 2017-11-13 20:27 - 001544192 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-12-21 06:54 - 2017-11-13 20:16 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-12-21 06:54 - 2017-11-13 19:37 - 013679616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-12-21 06:54 - 2017-11-13 19:15 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-12-21 06:54 - 2017-11-13 19:15 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-12-21 06:54 - 2017-11-13 19:15 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-12-21 06:54 - 2017-11-13 19:10 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-12-21 06:54 - 2017-11-13 18:32 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-12-21 06:54 - 2017-11-13 18:31 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-12-21 06:54 - 2017-11-07 14:46 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-12-21 06:54 - 2017-11-07 14:44 - 002293760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-12-21 06:54 - 2017-11-07 14:41 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-12-21 06:54 - 2017-11-07 14:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-12-21 06:54 - 2017-11-07 14:40 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-12-21 06:54 - 2017-11-07 14:39 - 000662016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-12-21 06:54 - 2017-11-07 14:38 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-12-21 06:54 - 2017-11-07 14:38 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-12-21 06:54 - 2017-11-07 14:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-12-21 06:54 - 2017-11-07 14:28 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-12-21 06:54 - 2017-11-07 14:28 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-12-21 06:54 - 2017-11-07 14:24 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-12-21 06:54 - 2017-11-07 14:18 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-12-21 06:54 - 2017-11-07 14:17 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-12-21 06:54 - 2017-11-07 14:17 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-12-21 06:54 - 2017-11-07 14:01 - 001313280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-12-21 06:54 - 2017-11-07 13:58 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-12-21 06:53 - 2017-11-16 22:23 - 003222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-12-21 06:53 - 2017-11-13 21:57 - 025731072 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-12-21 06:53 - 2017-11-13 21:43 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-12-21 06:53 - 2017-11-13 21:30 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-12-21 06:53 - 2017-11-13 21:30 - 000417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-12-21 06:53 - 2017-11-13 21:30 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-12-21 06:53 - 2017-11-13 21:25 - 005925888 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-12-21 06:53 - 2017-11-13 21:24 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-12-21 06:53 - 2017-11-13 21:21 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-12-21 06:53 - 2017-11-13 21:20 - 000817152 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-12-21 06:53 - 2017-11-13 21:20 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-12-21 06:53 - 2017-11-13 21:20 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-12-21 06:53 - 2017-11-13 21:12 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-12-21 06:53 - 2017-11-13 21:06 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-12-21 06:53 - 2017-11-13 21:03 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-12-21 06:53 - 2017-11-13 21:02 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-12-21 06:53 - 2017-11-13 20:51 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-12-21 06:53 - 2017-11-13 20:48 - 015267328 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-12-21 06:53 - 2017-11-13 20:47 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-12-21 06:53 - 2017-11-13 20:39 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-12-21 06:53 - 2017-11-07 14:56 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-12-21 06:53 - 2017-11-07 14:46 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-12-21 06:53 - 2017-11-07 14:46 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-12-21 06:53 - 2017-11-07 14:27 - 004509696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-12-21 06:53 - 2017-11-07 14:26 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-12-21 06:53 - 2017-11-07 14:19 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-12-21 06:53 - 2017-11-07 14:04 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-12-21 06:53 - 2017-11-07 10:31 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-12-21 06:53 - 2017-11-07 10:13 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-12-21 06:53 - 2017-11-04 09:31 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2017-12-21 06:53 - 2017-11-04 09:31 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
2017-12-21 06:53 - 2017-11-04 09:10 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2017-12-21 06:53 - 2017-11-04 09:10 - 000142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000281600 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000138240 _____ (Microsoft Corporation) C:\Windows\system32\rtm.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000097792 _____ (Microsoft Corporation) C:\Windows\system32\mprdim.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\iprtprio.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtrmgr.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000115200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtm.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000075264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprdim.dll
2017-12-21 06:53 - 2017-11-02 08:56 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtprio.dll
2017-12-21 06:53 - 2017-10-17 20:06 - 000344064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000056320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2017-12-21 06:53 - 2017-10-16 17:07 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-12-21 06:53 - 2017-10-16 17:04 - 001001984 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2017-12-21 06:53 - 2017-10-16 16:46 - 000953344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2017-12-21 06:53 - 2017-10-16 15:55 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-12-21 06:53 - 2017-10-11 18:58 - 000382696 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 014635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2017-12-21 06:53 - 2017-10-11 18:55 - 002319872 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 002222080 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 002058240 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000778240 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000151552 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2017-12-21 06:53 - 2017-10-11 18:55 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2017-12-21 06:53 - 2017-10-11 18:40 - 000308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2017-12-21 06:53 - 2017-10-11 18:39 - 000591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-12-21 06:53 - 2017-10-11 18:38 - 000249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-12-21 06:53 - 2017-10-11 18:38 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-12-21 06:53 - 2017-10-11 18:37 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2017-12-21 06:53 - 2017-10-11 18:37 - 011410944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001549824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2017-12-21 06:53 - 2017-10-11 18:26 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-12-21 06:53 - 2017-10-11 18:26 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-12-21 06:53 - 2017-10-11 18:25 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-12-21 06:53 - 2017-10-11 18:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-12-21 06:53 - 2017-10-11 18:24 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2017-12-21 06:53 - 2017-10-11 18:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2017-12-21 06:53 - 2017-10-11 18:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2017-12-21 06:53 - 2017-10-11 18:20 - 000317440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2017-12-21 06:53 - 2017-10-11 18:20 - 000113152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\luafv.sys
2017-12-21 06:53 - 2017-10-11 18:16 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-11 14:52 - 2009-07-13 23:13 - 000740242 _____ C:\Windows\system32\PerfStringBackup.INI
2018-01-11 14:52 - 2009-07-13 22:45 - 000019968 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-01-11 14:52 - 2009-07-13 22:45 - 000019968 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-01-11 14:52 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\inf
2018-01-11 14:47 - 2016-11-27 16:54 - 000000000 ____D C:\Program Files (x86)\Glary Utilities 5
2018-01-11 14:44 - 2009-07-13 23:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-01-11 14:35 - 2016-11-30 11:37 - 000000576 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job
2018-01-11 14:28 - 2016-12-01 07:36 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\CrashDumps
2018-01-11 14:14 - 2016-11-30 11:37 - 000000672 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job
2018-01-11 14:06 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\rescache
2018-01-11 14:02 - 2017-03-07 12:10 - 000000000 ____D C:\Users\Terry Felter\AppData\LocalLow\Temp
2018-01-11 14:02 - 2016-12-04 11:32 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}
2018-01-11 13:59 - 2017-08-23 10:18 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\GoTo Opener
2018-01-11 13:59 - 2009-07-13 21:20 - 000000000 ____D C:\Program Files\Common Files\Microsoft Shared
2018-01-11 13:58 - 2016-11-24 22:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-01-11 13:58 - 2016-11-24 22:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-11 13:54 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\registration
2018-01-11 13:48 - 2016-11-24 22:13 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\Mozilla
2018-01-11 13:46 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\Cursors
2018-01-11 13:45 - 2016-12-04 07:22 - 000000000 ____D C:\ProgramData\Real
2018-01-11 13:43 - 2016-01-09 19:48 - 000000000 __RHD C:\MSOCache
2018-01-11 13:42 - 2016-07-14 20:32 - 000000000 ____D C:\AdwCleaner
2018-01-11 13:13 - 2016-12-03 20:53 - 000000000 ____D C:\Users\Terry Felter\AppData\Roaming\Simple Sudoku
2018-01-11 12:53 - 2017-07-12 15:35 - 000000000 ____D C:\ProgramData\boost_interprocess
2018-01-11 12:45 - 2017-07-28 16:51 - 248012408 _____ (TradeStation Technologies) C:\Users\Terry Felter\Downloads\TradeStation 9.5 Setup.exe
2018-01-11 12:38 - 2017-03-17 04:16 - 000004324 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-01-11 12:38 - 2016-11-25 07:57 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-01-11 12:38 - 2016-11-25 07:57 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-11 12:38 - 2016-11-25 07:57 - 000000000 ____D C:\Windows\system32\Macromed
2018-01-11 12:38 - 2016-11-25 07:56 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-01-11 12:30 - 2016-11-24 16:22 - 000000000 ____D C:\Users\Terry Felter
2018-01-11 10:41 - 2016-11-25 15:54 - 000000000 ____D C:\Program Files (x86)\TradeStation Archives
2018-01-10 06:45 - 2016-11-27 16:36 - 000004364 _____ C:\ProgramData\keystore.xml
2018-01-09 21:44 - 2017-01-10 12:35 - 000000000 ____D C:\Users\Terry Felter\AppData\LocalLow\Mozilla
2018-01-08 05:27 - 2016-11-27 16:54 - 000002998 _____ C:\Windows\System32\Tasks\GU5SkipUAC
2018-01-08 05:27 - 2016-11-27 16:54 - 000001102 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2018-01-08 05:27 - 2016-11-27 16:54 - 000001090 _____ C:\Users\Public\Desktop\Glary Utilities 5.lnk
2018-01-06 09:37 - 2016-11-24 17:48 - 000000000 ____D C:\Users\Terry Felter\Documents\Stock Info
2018-01-04 14:35 - 2017-07-08 17:01 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\GoToMeeting
2018-01-02 13:17 - 2016-11-24 17:27 - 000005325 _____ C:\Users\Terry Felter\Documents\Finder.txt
2017-12-22 07:20 - 2016-12-02 08:22 - 000000843 _____ C:\Users\Public\Desktop\Medved Trader.lnk
2017-12-22 07:20 - 2016-12-02 08:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Medved Trader
2017-12-22 07:20 - 2016-12-02 08:21 - 000000000 ____D C:\Program Files\Medved Trader
2017-12-21 12:28 - 2016-11-30 11:37 - 000003724 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000
2017-12-21 12:28 - 2016-11-30 11:37 - 000003628 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000
2017-12-21 09:29 - 2016-11-24 17:39 - 000000000 ____D C:\Users\Terry Felter\Documents\Snagit
2017-12-21 08:07 - 2009-07-13 22:45 - 000464896 _____ C:\Windows\system32\FNTCACHE.DAT
2017-12-21 08:01 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\SysWOW64\Setup
2017-12-21 08:00 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\system32\Setup
2017-12-21 07:47 - 2016-11-24 20:24 - 000000000 ____D C:\Windows\system32\MRT
2017-12-21 07:40 - 2017-10-12 04:40 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2017-12-21 07:39 - 2016-11-24 20:24 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-12-20 22:12 - 2016-11-24 17:19 - 000000000 ____D C:\Users\Terry Felter\AppData\Roaming\Mozilla
2017-12-18 12:10 - 2016-11-24 17:28 - 000089088 _____ C:\Users\Terry Felter\Documents\Glucose.xls
2017-12-17 14:58 - 2016-11-25 07:26 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-12-17 14:53 - 2016-11-25 07:25 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

==================== Files in the root of some directories =======

2017-08-11 11:48 - 2017-08-11 11:48 - 000000320 _____ () C:\Users\Terry Felter\AppData\Roaming\SEC629985.trad
2016-11-25 07:20 - 1997-07-11 00:00 - 000000002 _____ () C:\Users\Terry Felter\AppData\Roaming\Microsoft\ArtGalry.cag
2017-07-12 16:34 - 2017-09-14 12:05 - 000007598 _____ () C:\Users\Terry Felter\AppData\Local\Resmon.ResmonCfg

Some files in TEMP:
====================
2017-09-22 06:45 - 2017-09-22 06:45 - 000012800 _____ () C:\Users\Terry Felter\AppData\Local\Temp\15ybke51.dll
2017-09-07 06:42 - 2017-09-07 06:42 - 000014848 _____ () C:\Users\Terry Felter\AppData\Local\Temp\4dwh3xyj.dll
2013-01-08 20:18 - 2013-01-08 20:18 - 001052192 _____ () C:\Users\Terry Felter\AppData\Local\Temp\AC770S_ATT_BUILD3695.EXE
2017-01-04 08:14 - 2017-09-20 10:18 - 000223064 _____ () C:\Users\Terry Felter\AppData\Local\Temp\EyesLauncher.exe
2017-07-14 07:01 - 2017-07-14 07:01 - 000009216 _____ () C:\Users\Terry Felter\AppData\Local\Temp\ezqhttj1.dll
2017-03-17 20:28 - 2017-09-05 13:52 - 000186224 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\lowproc.exe
2018-01-11 14:25 - 2018-01-11 14:14 - 083316440 _____ (Malwarebytes ) C:\Users\Terry Felter\AppData\Local\Temp\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3374.exe
2017-10-17 05:45 - 2017-10-17 05:45 - 000016896 _____ () C:\Users\Terry Felter\AppData\Local\Temp\omkqhr3s.dll
2017-03-27 03:49 - 2017-03-27 03:49 - 001190832 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup0.exe
2017-06-15 04:42 - 2017-06-15 04:42 - 001019312 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup1.exe
2017-09-18 20:00 - 2017-09-18 20:00 - 001019312 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup2.exe
2017-03-17 20:28 - 2017-09-05 13:52 - 000096440 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\stubhelper.dll
2017-08-29 11:03 - 2017-12-20 06:38 - 036925048 _____ () C:\Users\Terry Felter\AppData\Local\Temp\temp-installer.exe
2017-02-02 07:53 - 2017-02-02 07:53 - 000009728 _____ () C:\Users\Terry Felter\AppData\Local\Temp\v0jthfi1.dll
2017-08-07 04:27 - 2017-08-07 04:27 - 000003584 _____ () C:\Users\Terry Felter\AppData\Local\Temp\yubm6-s-.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-08 15:30

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02.01.2018
Ran by [removed] (11-01-2018 15:17:27)
Running from C:\Users\[removed]\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2016-11-24 22:22:42)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2367635994-1441107805-3879806124-500 - Administrator - Disabled)
Guest (S-1-5-21-2367635994-1441107805-3879806124-501 - Limited - Disabled)
Terry Felter (S-1-5-21-2367635994-1441107805-3879806124-1000 - Administrator - Enabled) => C:\Users\Terry Felter

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Spybot - Search and Destroy (Disabled - Out of date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0015-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0016-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0018-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0019-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001A-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001B-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001F-0409-0000-0000000FF1CE}_PROR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001F-040C-0000-0000000FF1CE}_PROR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-002A-0000-1000-0000000FF1CE}_PROR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-002A-0409-1000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-006E-0409-0000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0115-0409-0000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0116-0409-1000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0117-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.009.20050 - Adobe Systems Incorporated)
Adobe Flash Player 28 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 28.0.0.137 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\…\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
AutoUpdate (HKLM-x32\…\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
Broadcom NetXtreme-I Netlink Driver and Management Installer (HKLM\…\{9B34CC4C-E7FF-4AC8-B771-1D09612D6430}) (Version: 15.0.8.5 - Broadcom Corporation)
CCleaner (HKLM\…\CCleaner) (Version: 4.16 - Piriform)
Cheat Engine 6.3 (HKLM-x32\…\Cheat Engine 6.3_is1) (Version: - Cheat Engine)
Cheat Engine 6.6 (HKLM-x32\…\Cheat Engine 6.6_is1) (Version: - Cheat Engine)
Chromium (HKLM-x32\…\{1C97F457-4C17-25D7-FD97-55572D1786D7}) (Version: - )
Cisco EAP-FAST Module (HKLM-x32\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (HKLM-x32\…\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (HKLM-x32\…\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.) Hidden
Cisco WebEx Meetings (HKLM-x32\…\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
Dell System Detect (HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\58d94f3ce2c27db0) (Version: 7.11.0.6 - Dell)
Dell Touchpad (HKLM\…\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 10.1207.101.109 - ALPS ELECTRIC CO., LTD.)
DivX (HKLM-x32\…\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.0 - DivXNetworks, Inc.)
DW WLAN Card Utility (HKLM\…\DW WLAN Card Utility) (Version: 6.30.223.215 - Dell Inc.)
eSignal (HKLM-x32\…\{988ACB3F-EF50-43B9-97A4-90E816660122}) (Version: 10.6.4063.1258 - eSignal) Hidden
eSignal 10.6 (HKLM-x32\…\eSignal) (Version: 10.6.4063.1258 - eSignal)
Frhed 1.7.1 (HKLM-x32\…\Frhed) (Version: 1.7.1 - Raihan Kibria)
Glary Utilities 5.91 (HKLM-x32\…\Glary Utilities 5) (Version: 5.91.0.112 - Glarysoft Ltd)
GOM Player (HKLM-x32\…\GOM Player) (Version: 2.1.40.5106 - Gretech Corporation)
GoTo Opener (HKLM-x32\…\{8B2D47CC-1558-4939-B27F-41E30530072A}) (Version: 1.0.467 - LogMeIn, Inc.)
GoToMeeting 8.19.0.8126 (HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\GoToMeeting) (Version: 8.19.0.8126 - LogMeIn, Inc.)
Heroes of Might and Magic V - Tribes of the East (HKLM-x32\…\{66FF4C48-0083-4E60-8556-B883AB200092}) (Version: - )
Heroes of Might and Magic® III (HKLM-x32\…\Heroes of Might and Magic® III) (Version: - )
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6491.0 - IDT)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4425 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\…\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.8.251 - Intel Corporation)
IZArc 4.2 (HKLM-x32\…\{97C82B44-D408-4F14-9252-47FC1636D23E}_is1) (Version: 4.2 - Ivan Zahariev)
Malwarebytes version 3.3.1.2183 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Medved Trader version 1.1.7000.2033 (HKLM\…\{528BD475-95CE-47B6-B40A-1136FED0D462}_is1) (Version: 1.1.7000.2033 - 2GK, Inc.)
Microsoft .NET Framework 4.7 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Professional 2007 (HKLM-x32\…\PROR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219.473 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219.473 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219.473 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219.473 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61135 (HKLM\…\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61135 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61135 (HKLM\…\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61135 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61135 (HKLM-x32\…\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61135 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61135 (HKLM-x32\…\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61135 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40660 (HKLM\…\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}) (Version: 12.0.40660 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40660 (HKLM\…\{CB0836EC-B072-368D-82B2-D3470BF95707}) (Version: 12.0.40660 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 (HKLM-x32\…\{7DAD0258-515C-3DD4-8964-BD714199E0F7}) (Version: 12.0.40660 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 (HKLM-x32\…\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}) (Version: 12.0.40660 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\…\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\…\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 x64 Additional Runtime - 14.11.25325 (HKLM\…\{B13B3E11-1555-353F-A63A-8933EE104FBD}) (Version: 14.11.25325 - Microsoft Corporation)
Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.11.25325 (HKLM\…\{B0037450-526D-3448-A370-CACBD87769A0}) (Version: 14.11.25325 - Microsoft Corporation)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.11.25325 (HKLM-x32\…\{568CD07E-0824-3EEB-AEC1-8FD51F3C85CF}) (Version: 14.11.25325 - Microsoft Corporation)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.11.25325 (HKLM-x32\…\{029DA848-1A80-34D3-BFC1-A6447BFC8E7F}) (Version: 14.11.25325 - Microsoft Corporation)
Mozilla Firefox 57.0.3 (x64 en-US) (HKLM\…\Mozilla Firefox 57.0.3 (x64 en-US)) (Version: 57.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 57.0.3.6569 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PhotoRazor (HKLM-x32\…\PhotoRazor) (Version: - )
QuickTime 7 (HKLM-x32\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
RealDownloader (HKLM-x32\…\{2275115D-1431-4A62-A98F-2F0393815327}) (Version: 18.1.9.106 - RealNetworks, Inc.) Hidden
RealDownloader (HKLM-x32\…\{45bcec97-14a2-4e10-a129-58d2d0b34398}) (Version: 18.1.9.106 - RealNetworks) Hidden
RealDownloader (HKLM-x32\…\{85584A8B-8989-42AA-81A0-80ABF61EFAF1}) (Version: 18.1.9.106 - RealNetworks) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (HKLM-x32\…\{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}) (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (HKLM-x32\…\{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}) (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (RealTimes) (HKLM-x32\…\RealPlayer 18.1) (Version: 18.1.9 - RealNetworks)
RealUpgrade 1.1 (HKLM-x32\…\{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}) (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Roxio Easy Media Creator 9 Suite (HKLM-x32\…\{70272964-C468-4C5F-8246-AA2CABA75941}) (Version: 9.0.136 - Roxio, Inc.)
ScottradeELITE v5 (HKLM-x32\…\{7E94DCE4-F1F3-47AF-A2D4-8A81008D9B1F}) (Version: 5.3.0.0 - Scottrade Inc.)
Simple Sudoku 4.2 (HKLM-x32\…\Simple Sudoku_is1) (Version: - )
Snagit 11 (HKLM-x32\…\{90D0FC4B-D653-4F49-BB97-A48C74A52E71}) (Version: 11.4.3 - TechSmith Corporation)
Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\…\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.10.0046 - ST Microelectronics)
TeamViewer 9 (HKLM-x32\…\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
TeleChart 2007 (HKLM-x32\…\{8F899627-1EA1-484D-91EA-7B22C05358DB}) (Version: 6.00.0000 - Worden Brothers Inc)
TextPad 4 (HKLM-x32\…\TextPad 4) (Version: - )
thinkorswim (HKLM\…\9968-4488-2169-7623) (Version: desktop - thinkorswim, Inc)
TradeStation 9.5 (HKLM-x32\…\{E02A3EE0-1193-454C-8E59-BDFCE6EC7B22}) (Version: 9.05.01.3239 - TradeStation Technologies)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
UpdateService (HKLM-x32\…\{E3AE96D6-E196-45B4-AF62-2B41998B9E37}) (Version: 1.0.0 - RealNetworks, Inc.) Hidden
vc2012_redist (HKLM-x32\…\{9402AEF2-5981-4097-8BE2-6501DAC4DBFD}) (Version: 1.0.0.0 - Realnetworks) Hidden
VD64Inst (HKLM\…\{22ABA92B-6C1B-46D8-AC2B-C48EEAE172A9}) (Version: 1.00.0000 - Roxio, Inc.) Hidden
Video Downloader (HKLM-x32\…\{4C68AE5C-915A-492A-AFCD-B630ECB9522D}) (Version: 18.1.9 - RealNetworks) Hidden
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.4 - VideoLAN)
vs2015_redist x86 (HKLM-x32\…\{BD46163A-0331-4A61-B65A-7B66D7C93F8E}) (Version: 1.0.0.0 - Realnetworks) Hidden
WinHex (HKLM-x32\…\WinHex) (Version: - )
Wizardry 8 (HKLM-x32\…\Wizardry 8) (Version: - )
Zoom (HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\ZoomUMX) (Version: 4.0 - Zoom Video Communications, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Terry Felter\AppData\Local\GoToMeeting\7495\G2MOutlookAddin64.dll => No File
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2016-06-22] (Glarysoft Ltd)
ContextMenuHandlers1: [RXDCExtSvr] -> {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C} => C:\Program Files\Roxio\Easy CD creator 8\Virtual Drive\DC_ShellExt64.dll [2006-10-26] (Sonic Solutions)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers1: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 11\DLLx64\SnagitShellExt64.dll [2014-04-18] (TechSmith Corporation)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers2: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2016-06-22] (Glarysoft Ltd)
ContextMenuHandlers2: [RXDCExtSvr] -> {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C} => C:\Program Files\Roxio\Easy CD creator 8\Virtual Drive\DC_ShellExt64.dll [2006-10-26] (Sonic Solutions)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => c:\program files (x86)\real\realplayer\RPDS\Bin64\rpcontextmenu.dll [2017-09-18] (RealNetworks, Inc.)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 11\DLLx64\SnagitShellExt64.dll [2014-04-18] (TechSmith Corporation)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2016-06-15] (Intel Corporation)
ContextMenuHandlers6: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2016-06-22] (Glarysoft Ltd)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers6: [RXDCExtSvr] -> {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C} => C:\Program Files\Roxio\Easy CD creator 8\Virtual Drive\DC_ShellExt64.dll [2006-10-26] (Sonic Solutions)
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {075A5949-CAFD-4660-A639-723DF4845B4F} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2367635994-1441107805-3879806124-1000 => C:\program files (x86)\real\RealDownloader\RealUpgrade.exe [2017-08-17] (RealNetworks, Inc.)
Task: {3ABFC59F-03AE-4F5A-803D-FC97102B6779} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2367635994-1441107805-3879806124-1000
Task: {3DC45861-BD38-4286-A655-F19E22D24959} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {5F57B0C4-EA21-49DC-ADE9-12ADC9DEA4F2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
Task: {6091D538-8881-47FE-8E22-F442FD763B4D} - System32\Tasks\{EF8C83D9-3C53-473E-813C-98689ED9E038} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Microsoft Office\Office97\Office\Setup\Acme.exe" -c /w Off97Pro.STF
Task: {6C10B7BE-DF79-4710-A875-ECC355B4383E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {8B8AB466-C86B-4F0A-8A22-01E961DC5D63} - System32\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000 => C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\g2mupdate.exe [2017-12-21] (LogMeIn, Inc.)
Task: {90AAE941-F55F-40E8-B0F7-598D6624BBC2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {917A7F84-EB13-4448-AA42-13817A4F0060} - System32\Tasks\{91783E60-1194-4502-9BAA-133A86C52494} => C:\Windows\system32\pcalua.exe -a E:\EliteInstallerBeta.exe -d E:\
Task: {9876D896-4F92-4051-B6D2-6C767D96B736} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
Task: {B1CE90FE-B942-418D-A5FA-272138690016} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2367635994-1441107805-3879806124-1000 => C:\program files (x86)\real\RealDownloader\RealUpgrade.exe [2017-08-17] (RealNetworks, Inc.)
Task: {BE7A1227-B861-4AF4-8DE5-0CD732E95226} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {BFAAFAC3-A956-4D4A-8A8E-BFEF387347FC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-01-11] (Adobe Systems Incorporated)
Task: {C13DF9E2-CA9C-47DA-81BA-73F58F0EDF75} - System32\Tasks\RealDownloader Update Check => C:\program files (x86)\real\realplayer\RealDownloader\downloader2.exe
Task: {C391A76D-EFC1-4280-B119-7627629FD0D8} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
Task: {C6DA39C6-AB3C-4FEE-BB51-25942B1F6C0E} - System32\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000 => C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\g2mupload.exe [2017-12-21] (LogMeIn, Inc.)
Task: {DD7FF47B-06B9-453C-A6C3-BF2BE72E5488} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {E8B3BC43-C96F-4C64-A658-27AC7E5E638C} - System32\Tasks\TechSmith Updater => C:\Program Files (x86)\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [2013-10-04] (TechSmith Corporation)
Task: {F1E0327C-FF69-4D7B-90F8-D9288AA0ED35} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job => C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job => C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\g2mupload.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2018-01-11 14:27 - 2017-11-29 09:11 - 002301384 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
1997-07-11 00:00 - 1997-07-11 00:00 - 000122880 _____ () C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE
2017-08-17 14:21 - 2017-08-17 14:21 - 001259704 _____ () C:\Program Files (x86)\Real\RealDownloader\downloader2.exe
2016-12-11 09:48 - 2014-05-13 12:04 - 000109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-12-11 09:48 - 2014-05-13 12:04 - 000416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-12-11 09:48 - 2014-05-13 12:04 - 000167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-12-11 09:48 - 2012-08-23 10:38 - 000574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-12-11 09:48 - 2012-04-03 17:06 - 000565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
1998-06-01 00:00 - 1998-06-01 00:00 - 003792896 _____ () C:\Program Files (x86)\Microsoft Office\Office97\Office\MSO97.DLL
2006-10-27 08:17 - 2006-10-27 08:17 - 000516096 _____ () C:\Program Files (x86)\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
2006-10-27 08:13 - 2006-10-27 08:13 - 004587520 ____R () C:\Program Files (x86)\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
2018-01-07 20:15 - 2018-01-07 20:15 - 000087024 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
1997-07-11 00:00 - 1997-07-11 00:00 - 000036864 _____ () C:\Windows\SysWow64\docobj.dll
1997-07-11 00:00 - 1997-07-11 00:00 - 000032768 _____ () C:\Windows\SysWow64\hlinkprx.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Terry Felter\Documents\080105House.JPG:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Flappi~1.gif:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Image.jpg:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Image1.jpg:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\remotecontrol.jpg:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\SANDWICH.PNG:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Ugly Blue Pants.bmp:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Work.jpg:Roxio EMC Stream [38]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\asstr.org -> hxxp://assm1.asstr.org
IE trusted site: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\dell.com -> dell.com

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:34 - 2018-01-11 12:37 - 000002024 _____ C:\Windows\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Terry Felter\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: ApHidMonitorService => 2
MSCONFIG\Services: cphs => 3
MSCONFIG\Services: ICCS => 3
MSCONFIG\Services: igfxCUIService1.0.0.0 => 2
MSCONFIG\Services: Intel(R) Capability Licensing Service Interface => 2
MSCONFIG\Services: Intel(R) Capability Licensing Service TCP IP Interface => 3
MSCONFIG\Services: jhi_service => 2
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: RealPlayerUpdateSvc => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: wltrysvc => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snagit 11.lnk => C:\Windows\pss\Snagit 11.lnk.CommonStartup
MSCONFIG\startupreg: Broadcom Wireless Manager UI => C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{C9709DAF-1E8C-4055-BC02-87C77A1C0656}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EE36DD2A-0741-44B7-B1C6-2E2A6B71DDF8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{9C8B4D1F-FA10-4FBB-8DB1-F42B65E8D2CA}C:\program files (x86)\esignal\winros.exe] => (Allow) C:\program files (x86)\esignal\winros.exe
FirewallRules: [UDP Query User{A270DBC1-095D-415E-8C03-557AE874F14E}C:\program files (x86)\esignal\winros.exe] => (Allow) C:\program files (x86)\esignal\winros.exe
FirewallRules: [{334EDA36-233E-414B-ABA7-4B7610D17FEF}] => (Allow) LPort=8298
FirewallRules: [{3365DD31-9AB4-4707-977A-F62DDC25675E}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{155D4B1D-92F2-40C7-85AE-F888C2B486E3}] => (Allow) C:\Users\Terry Felter\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{3F4704C4-7161-4F1F-8ADC-02907F064308}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{E1E4F2E6-720F-4F92-B4F7-60664CE9A0B2}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6DB04191-9661-4B16-A335-0E333434DC62}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{96B6C630-76BB-432B-A8D9-19AC830DDC1C}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{3C685D88-5D1D-44FF-B1D2-959D857439C4}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCAL.exe
FirewallRules: [{FFBD1CAD-903B-4D84-BACA-2FAB57A83271}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCAL.exe
FirewallRules: [{B26F8249-D450-4919-8193-90170BA19071}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCAL.exe
FirewallRules: [{8F861C9A-9715-4D04-9E19-F8D9A52715C0}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCAL.exe
FirewallRules: [{BACB0AFB-87DA-4176-B343-9905E359749D}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\orchart.exe
FirewallRules: [{3A52071E-BA73-4B10-A3B6-A4F777CFEA39}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\orchart.exe
FirewallRules: [{DA246B85-DAFC-4614-90FE-CC13856E57AB}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\orchart.exe
FirewallRules: [{82275915-B817-407C-97FC-BDADF6DADE84}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\orchart.exe
FirewallRules: [{A332A558-7071-46AD-B6A9-6EA30CFEDFDB}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCLPrxy.exe
FirewallRules: [{AFECF886-576F-444F-A716-0FA3119C2FAE}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCLPrxy.exe
FirewallRules: [{65658C21-F4BB-4535-B5E6-116474DCF529}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCLPrxy.exe
FirewallRules: [{FBA327B9-0FCB-4C51-A80A-344104FE4871}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCLPrxy.exe
FirewallRules: [{973DC363-4029-49DA-ABCD-1D60E256F944}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORDllHst.exe
FirewallRules: [{8B52DCE6-39E7-47AA-BA3C-2C210641E8A8}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORDllHst.exe
FirewallRules: [{51DE9854-6B23-4D7E-A183-CDF74A87699D}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORDllHst.exe
FirewallRules: [{C0572C51-6833-4456-B9B2-50BDA44A4509}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORDllHst.exe
FirewallRules: [{FF07DE1E-8176-405A-BB53-E3B8F9DC9393}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORPlat.exe
FirewallRules: [{8F05E034-1550-4F91-A243-062F3E6D4943}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORPlat.exe
FirewallRules: [{4D82D3DA-0C80-4DCF-BA07-A7724DEAC9CF}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORPlat.exe
FirewallRules: [{FC4A087B-3401-4DE8-B134-AD041A6E3C9D}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORPlat.exe
FirewallRules: [{D82A36E4-955B-41FA-97E6-BE15C9F89204}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchDownloader.exe
FirewallRules: [{26F911BD-27E0-4843-8E63-9BB2A2139E34}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchDownloader.exe
FirewallRules: [{4465B587-505B-40A3-ABCB-EBD924E5E563}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchDownloader.exe
FirewallRules: [{029D83F7-ED7F-4C6D-8BEA-D216EC6B2780}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchDownloader.exe
FirewallRules: [{192AEAC7-3F7F-4E4F-89FD-3DA1DD4FA986}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchInstaller.exe
FirewallRules: [{0167EC42-B0C5-4F45-BF68-89C1AE13A2C7}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchInstaller.exe
FirewallRules: [{2B74ACC1-73B4-4F0B-AB8C-08428F392404}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchInstaller.exe
FirewallRules: [{CF43A87B-3FA4-4913-B003-FF4AED510D07}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchInstaller.exe
FirewallRules: [{5111A6C3-3E60-460E-AD8B-8436CD5822C3}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
FirewallRules: [{85B16C5E-469C-4405-B600-4B1D16AAD13A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
FirewallRules: [{1DA49D94-D9A3-413B-9175-685A4A515B52}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
FirewallRules: [{DB00E3DA-72E2-4FA3-9710-34BD1C2F4933}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
FirewallRules: [{5D67326C-33C1-4990-A78A-2E66763131A8}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe
FirewallRules: [{3C242750-CE6C-47B5-A738-F51AE5DE631F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe
FirewallRules: [{100A7D8F-BBDD-464D-9152-BF30F0D8105A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe
FirewallRules: [{A4EEBD36-BFB5-4934-80DC-F740972A4D02}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe
FirewallRules: [{88C31A58-CA32-4ECE-B105-54116A76501A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBrowse.exe
FirewallRules: [{83375C26-1C82-4C95-9860-722711B6CB6A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBrowse.exe
FirewallRules: [{6FAC8B1C-A1FD-4DCE-9C7B-BC8486CD6059}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBrowse.exe
FirewallRules: [{E1F84374-E971-4607-B585-9B63E5111BF2}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBrowse.exe
FirewallRules: [{83FBDB5F-C20E-4255-AB15-E96D3BAC8D7A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSDev.exe
FirewallRules: [{9E97DB24-3046-4525-9BEE-064624E24420}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSDev.exe
FirewallRules: [{3ACD2065-397D-4BD8-86B8-F4258F4DFD1F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSDev.exe
FirewallRules: [{83392770-3C81-4FCD-A71B-598A4C2585B1}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSDev.exe
FirewallRules: [{26D8B27F-8D4A-4EA9-85FF-379C13F9B1A2}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\tsospro.EXE
FirewallRules: [{1627FE6B-C90B-43B7-9A56-F61BB1FF0B9D}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\tsospro.EXE
FirewallRules: [{2BC588A3-58B7-484B-AADF-4B7E6DF89AA3}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\tsospro.EXE
FirewallRules: [{A5F7D647-C415-4BC4-AE72-380FC35D977F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\tsospro.EXE
FirewallRules: [{63173D05-97D7-46C6-AE40-D6D28376FECE}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSQuote.exe
FirewallRules: [{FBD6C314-7001-4ACD-85A7-E4D392CBD897}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSQuote.exe
FirewallRules: [{93EC28A9-AF08-43E8-A955-EFFF25B64579}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSQuote.exe
FirewallRules: [{60A0C751-D92B-4727-9FA2-2BBEF4722294}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSQuote.exe
FirewallRules: [{4CD10C82-3BC9-4730-81A4-064ECA21C509}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSRPTS.exe
FirewallRules: [{A1A24D1E-D2A7-47BD-866B-119B9B522C63}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSRPTS.exe
FirewallRules: [{16FF3A9D-4F54-44E5-A8DE-A3D907A1D959}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSRPTS.exe
FirewallRules: [{1D7E59C3-C96C-4D9F-BF51-451533E4B93C}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSRPTS.exe
FirewallRules: [{DB2A5382-AD54-496F-A2DC-E74F0AB94B20}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSScanner.exe
FirewallRules: [{5DD0D51D-C22F-4625-A4B5-1E9708929A5C}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSScanner.exe
FirewallRules: [{FB9D9512-F47C-4F05-A0A6-B46F94920BA3}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSScanner.exe
FirewallRules: [{D7A59B4A-8E54-460A-9138-46E04FF95025}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSScanner.exe
FirewallRules: [{8A0D6C82-BC47-4F59-9F2E-5E2CF9D256AF}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSSupp.exe
FirewallRules: [{D17DC4B6-E981-411A-A134-656DDB580418}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSSupp.exe
FirewallRules: [{25DE5CE2-EFB1-4CB7-9E00-565D50B94428}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSSupp.exe
FirewallRules: [{6114042D-7393-465A-B0AB-F75304814FB6}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSSupp.exe
FirewallRules: [{F52CF7DA-7226-4DA9-B424-9FECA2A1C38F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WFO.exe
FirewallRules: [{14E861B9-5D9F-46CD-9F83-4AFB65B415B8}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WFO.exe
FirewallRules: [{1C78C9D3-979C-4AF1-BCC8-0B5F9D30F56B}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WFO.exe
FirewallRules: [{6385F76B-B9A7-4C0C-A9C3-FF257E34EAE4}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WFO.exe
FirewallRules: [{EAE07467-B4E4-4817-A110-F89BE7D46E12}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
FirewallRules: [{16478E35-E855-47FD-B65A-11FB87CB048F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
FirewallRules: [{10EAA9DE-CB78-4107-A0F3-AF87704CFFEA}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
FirewallRules: [{D542CBF2-A03C-4F69-B272-0CA097A5C7DE}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
FirewallRules: [{5FA0D6FA-4C25-4806-BC1F-5A733E70F083}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
FirewallRules: [TCP Query User{055B33F6-E336-4A84-8D07-B28858060C5C}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{56424532-0EB5-4D9A-8C40-E2206B9E28C0}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service

==================== Restore Points =========================

11-01-2018 11:12:57 Removed TradeStation 9.5
11-01-2018 12:46:05 Windows Update
11-01-2018 13:38:37 Removed TradeStation 9.5
11-01-2018 13:45:01 Installed TradeStation 9.5

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (01/11/2018 02:45:31 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Could not get performance counter registry info for WSearchIdxPi for instance due to the following error: The operation completed successfully. 0x0.

Error: (01/11/2018 02:45:04 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Context: Application, SystemIndex Catalog

Error: (01/11/2018 02:45:03 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Error: (01/11/2018 02:28:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamtray.exe, version: 3.0.0.1284, time stamp: 0x5a15a98e
Faulting module name: Qt5Core.dll, version: 5.6.2.0, time stamp: 0x59a63e00
Exception code: 0xc0000005
Fault offset: 0x001aa3b6
Faulting process id: 0x1fc
Faulting application start time: 0x01d38b1ab98977c0
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll
Report Id: fd733df9-f70d-11e7-8c21-f01faf01a6d9

Error: (01/11/2018 02:28:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamservice.exe, version: 3.1.0.595, time stamp: 0x59f745cb
Faulting module name: ScanControllerImpl.dll, version: 3.0.0.777, time stamp: 0x5a0c6f34
Exception code: 0xc0000005
Fault offset: 0x00000000000068e4
Faulting process id: 0xfa4
Faulting application start time: 0x01d38b1ab3e9573b
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Faulting module path: C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dll
Report Id: f87c1f26-f70d-11e7-8c21-f01faf01a6d9

Error: (01/11/2018 02:21:27 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Could not get performance counter registry info for WSearchIdxPi for instance due to the following error: The operation completed successfully. 0x0.

Error: (01/11/2018 02:21:04 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Context: Application, SystemIndex Catalog

Error: (01/11/2018 02:21:03 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Error: (01/11/2018 01:53:08 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Could not get performance counter registry info for WSearchIdxPi for instance due to the following error: The operation completed successfully. 0x0.

Error: (01/11/2018 01:52:50 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Context: Application, SystemIndex Catalog

System errors:
=============
Error: (01/11/2018 02:45:00 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
RxFilter

Error: (01/11/2018 02:28:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Malwarebytes Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Error: (01/11/2018 02:21:02 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
RxFilter

Error: (01/11/2018 01:52:50 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
RxFilter

Error: (01/11/2018 01:50:26 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\bcmihvsrv64.dll

Error: (01/11/2018 01:50:26 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\bcmihvsrv64.dll

Error: (01/11/2018 01:50:20 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\bcmihvsrv64.dll

Error: (01/11/2018 01:49:56 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 70.

Error: (01/11/2018 01:47:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

CodeIntegrity:
===================================
Date: 2018-01-11 14:44:05.326
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 14:44:05.170
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 14:20:13.967
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 14:20:13.811
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 13:51:50.811
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 13:51:50.670
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 12:26:36.504
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 12:26:36.364
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 09:30:14.778
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 09:30:14.638
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-3540M CPU @ 3.00GHz
Percentage of memory in use: 26%
Total physical RAM: 8096.88 MB
Available physical RAM: 5945.85 MB
Total Virtual: 16191.93 MB
Available Virtual: 14000.16 MB

==================== Drives ================================

Drive c: (OSDisk) (Fixed) (Total:284.42 GB) (Free:104.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 6A243D62)
Partition 1: (Not Active) - (Size=284.4 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=13.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

It appears all that was accomplished was retained, no? It appears that perhaps one or both still reside and possibly active. Downloading takes forever a typical behavior for ByteFence I can't tell if Glary is running or not. Neither is listed in the processes of Task Manager though.

Satchfan

Post #34January 11, 2018, 11:00 PM UTC

Please download SystemLook from one of the links below and save it to your Desktop.

SystemLook (32-bit)
SystemLook (64-bit)

double-click SystemLook.exe to run it.
copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning:
```
:reg
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon
```

click the Look button to start the scan.
when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

terryfelter

Post #35January 11, 2018, 11:37 PM UTC

SystemLook 04.09.10 by jpshortstuff
Log created at 17:36 on 11/01/2018 by Terry Felter
Administrator - Elevation successful

========== reg ==========

[HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon]
(Unable to open key - key not found)

-= EOF =-

Satchfan

Post #36January 12, 2018, 9:36 AM UTC

Apologies, I made a mistake with the instruction. Let’s try again.

double-click SystemLook.exe to run it.
copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning:
```
:reg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
```
click the Look button to start the scan.
when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Satchfan

terryfelter

Post #37January 12, 2018, 1:16 PM UTC

SystemLook 04.09.10 by jpshortstuff
Log created at 07:15 on 12/01/2018 by Terry Felter
Administrator - Elevation successful

========== reg ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon]
"ReportBootOk"="1"
"Shell"="explorer.exe"
"PreCreateKnownFolders"="{A520A1A4-1780-4FF6-BD18-167343C5AF16}"
"Userinit"="C:\Windows\system32\userinit.exe,"
"VMApplet"="SystemPropertiesPerformance.exe /pagefile"
"AutoRestartShell"= 0x0000000001 (1)
"Background"="0 0 0"
"CachedLogonsCount"="10"
"DebugServerCommand"="no"
"ForceUnlockLogon"= 0x0000000000 (0)
"LegalNoticeCaption"=""
"LegalNoticeText"=""
"PasswordExpiryWarning"= 0x0000000005 (5)
"PowerdownAfterShutdown"="0"
"ShutdownWithoutLogon"="0"
"WinStationsDisabled"="0"
"DisableCAD"= 0x0000000001 (1)
"scremoveoption"="0"
"ShutdownFlags"= 0x0000000027 (39)
"AutoAdminLogon"="0"
"DefaultUserName"="Terry Felter"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\AutoLogonChecked]

-= EOF =-

Satchfan

Post #38January 12, 2018, 3:09 PM UTC

OK let's do the fix again but leave out TradeStation temp files, (even though that could not have caused a problem, it will put your mind at ease ).

Run Farbar Recovery Scan Tool

right-click FRST/FRST64 and select ‘Run as administrator’
highlight the contents of the code box below, then press Ctrl+c):

Start::
CloseProcesses:
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} - E:\win\setup.exe -phs
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} - E:\StartClickFreeBackup.exe
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2016-11-27] (Glarysoft Ltd)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\EX64.SYS [X]
2018-01-08 05:26 - 2018-01-08 05:26 - 000003338 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
Task: {917A7F84-EB13-4448-AA42-13817A4F0060} - System32\Tasks\{91783E60-1194-4502-9BAA-133A86C52494} => C:\Windows\system32\pcalua.exe -a E:\EliteInstallerBeta.exe -d E:\
Task: {9876D896-4F92-4051-B6D2-6C767D96B736} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
Task: {C391A76D-EFC1-4280-B119-7627629FD0D8} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-01-11] (Adobe Systems Incorporated)
Task: {C13DF9E2-CA9C-47DA-81BA-73F58F0EDF75} - System32\Tasks\RealDownloader Update Check => C:\program files
EmptyTemp:
End::

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

in the FRST window, press the ‘Fix’ button once and wait
please reboot the computer if requested
it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

I see no sign of Bytefence but we can do a search for it to be sure.

Please delete the other SystemLook.txt files from yor desktop.

Run SystemLook

double-click SystemLook.exe to run it.
copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning.:
```
:filefind
*ByteFence*

:folderfind
*ByteFence*

:regfind
ByteFence
```
click the Look button to start the scan.
when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Logs to include with next post:

Fixlog.txt
SystemLook.txt

Thanks

Satchfan

terryfelter

Post #39January 12, 2018, 3:52 PM UTC

Fix result of Farbar Recovery Scan Tool (x64) Version: 02.01.2018
Ran by [removed] (12-01-2018 09:19:49) Run:2
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} - E:\win\setup.exe -phs
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} - E:\StartClickFreeBackup.exe
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2016-11-27] (Glarysoft Ltd)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\EX64.SYS [X]
2018-01-08 05:26 - 2018-01-08 05:26 - 000003338 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Task: {917A7F84-EB13-4448-AA42-13817A4F0060} - System32\Tasks\{91783E60-1194-4502-9BAA-133A86C52494} => C:\Windows\system32\pcalua.exe -a E:\EliteInstallerBeta.exe -d E:\
Task: {9876D896-4F92-4051-B6D2-6C767D96B736} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
Task: {C391A76D-EFC1-4280-B119-7627629FD0D8} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-01-11] (Adobe Systems Incorporated)
Task: {C13DF9E2-CA9C-47DA-81BA-73F58F0EDF75} - System32\Tasks\RealDownloader Update Check => C:\program files
EmptyTemp:

*****************

Processes closed successfully.
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon" => removed successfully
"HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\Microsoft\Windows\CurrentVersion\Run\\GUDelayStartup" => removed successfully
"HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7b3f3c3d-fce9-11e6-992e-f01faf01a6d9}" => removed successfully
HKLM\Software\Classes\CLSID\{7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} => key not found
"HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9}" => removed successfully
HKLM\Software\Classes\CLSID\{ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} => key not found
"HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SPReview" => removed successfully
GUBootStartup => Service stopped successfully.
"HKLM\System\CurrentControlSet\Services\GUBootStartup" => removed successfully
GUBootStartup => service removed successfully
"HKLM\System\CurrentControlSet\Services\NAVENG" => removed successfully
NAVENG => service removed successfully
"HKLM\System\CurrentControlSet\Services\NAVEX15" => removed successfully
NAVEX15 => service removed successfully
C:\Windows\System32\Tasks\GlaryInitialize 5 => moved successfully
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui" => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => key not found
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{917A7F84-EB13-4448-AA42-13817A4F0060} => could not remove key. ErrorCode1: 0x00000002
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{917A7F84-EB13-4448-AA42-13817A4F0060}" => removed successfully
C:\Windows\System32\Tasks\{91783E60-1194-4502-9BAA-133A86C52494} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{91783E60-1194-4502-9BAA-133A86C52494}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{9876D896-4F92-4051-B6D2-6C767D96B736}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9876D896-4F92-4051-B6D2-6C767D96B736}" => removed successfully
"C:\Windows\System32\Tasks\GlaryInitialize 5" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GlaryInitialize 5" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C391A76D-EFC1-4280-B119-7627629FD0D8}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C391A76D-EFC1-4280-B119-7627629FD0D8}" => removed successfully
C:\Windows\System32\Tasks\GU5SkipUAC => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GU5SkipUAC" => removed successfully
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-01-11] (Adobe Systems Incorporated)" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C13DF9E2-CA9C-47DA-81BA-73F58F0EDF75}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C13DF9E2-CA9C-47DA-81BA-73F58F0EDF75}" => removed successfully
C:\Windows\System32\Tasks\RealDownloader Update Check => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RealDownloader Update Check" => removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 5423298 B
Java, Flash, Steam htmlcache => 3855 B
Windows/system/drivers => 273232936 B
Edge => 0 B
Chrome => 0 B
Firefox => 3312 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 128 B
systemprofile32 => 66788 B
LocalService => 0 B
NetworkService => 17992 B
Terry Felter => 583347476 B

RecycleBin => 173594609 B
EmptyTemp: => 995.7 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 09:20:57 ====

SystemLook 04.09.10 by jpshortstuff
Log created at 09:46 on 12/01/2018 by Terry Felter
Administrator - Elevation successful

========== filefind ==========

Searching for "*ByteFence*"
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFence.exe –a—- 3669984 bytes [19:47 11/01/2018] [02:04 20/07/2017] 61330D8ACBB7800E49E63BD411EF20AB
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFence.exe.config –a—- 380 bytes [19:47 11/01/2018] [22:51 04/02/2017] 7EA1152404B6E432AC15878EE08A4AB4
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFenceGUI.dll –a—- 859104 bytes [19:47 11/01/2018] [02:04 20/07/2017] EB3D3459FB5083298CAD1A650ECF0080
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFenceScan.exe –a—- 197600 bytes [19:47 11/01/2018] [02:04 20/07/2017] E43B3F3AC556C4BA91990F6438491587
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFenceScan.exe.config –a—- 380 bytes [19:47 11/01/2018] [22:51 04/02/2017] 7EA1152404B6E432AC15878EE08A4AB4
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFenceService.exe –a—- 145888 bytes [19:47 11/01/2018] [02:03 20/07/2017] 624E2BAB14C48D0C84EE265125811169
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFenceService.exe.config –a—- 383 bytes [19:47 11/01/2018] [17:25 02/11/2016] E3D5F62B7B28176A510484E465FA0F18
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFenceService.InstallLog –a—- 675 bytes [12:35 11/01/2018] [17:33 04/12/2016] F0207914E2F93B54B037E8FF463E79E4
C:\AdwCleaner\Quarantine\1xVPfvJcrg\ByteFenceService.InstallState –a—- 5012 bytes [12:35 11/01/2018] [17:33 04/12/2016] 4F130E22D88664A9FC01D4E1350EF1B5
C:\AdwCleaner\Quarantine\RYwTiizs2t\ByteFence Anti-Malware.lnk –a—- 1063 bytes [19:49 11/01/2018] [15:11 05/12/2016] DCB7A4F56F34E7CF0C852236D4F2DADB
C:\Windows\Prefetch\BYTEFENCE.EXE-2DF51D43.pf –a—- 12590 bytes [12:02 11/01/2018] [18:34 11/01/2018] BC1B153F038F3E6E213ECDD1EC09FFB0
C:\Windows\Prefetch\BYTEFENCESCAN.EXE-210ADD1C.pf –a—- 40590 bytes [01:20 31/12/2017] [19:41 11/01/2018] DEE65F413F18756E0476FEEBFCC62ABF

========== folderfind ==========

Searching for "*ByteFence*"
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_08ec8f95 d—-c- [13:09 25/07/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_110b7ad3 d—-c- [18:21 02/09/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_11d9a942 d—-c- [17:50 19/07/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_12c761df d—-c- [16:33 03/07/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_178baeb9 d—-c- [13:04 28/07/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_9c43fdfab946a2173c6ef84f99a63ebb7f2e_06f002bf d—-c- [19:25 11/08/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_b6b17b5853c3936372a7dfc6fdc92baa317fb5_181a12a8 d—-c- [12:33 05/08/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_b6b17b5853c3936372a7dfc6fdc92baa317fb5_1e195bd9 d—-c- [13:37 07/08/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_c3a5fb76137fa07f6dd38d73b5593db1380f93b_09b770ff d—-c- [13:57 31/12/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_d1f0da7b6c5ec5b3aedb306653292872de94d8ef_0ac51843 d—-c- [11:52 21/07/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_d65b780c6470f930850734e5e52e6388e33a_1dd34e78 d—-c- [19:40 20/09/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_d739d61586c5bd36ef5f6accc02ece4251d671_1a40ca85 d—-c- [18:39 29/09/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_d8a52dcec21c38cee11bdeefdf31d28bc3d43412_1304d4be d—-c- [12:18 04/09/2017]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Critical_ByteFence.exe_978d85bf1ef8fab9a8b840d0cf176c1328398b3c_06b358c8 d—-c- [03:20 06/04/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_08ec8f95 d—-c- [13:09 25/07/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_110b7ad3 d—-c- [18:21 02/09/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_11d9a942 d—-c- [17:50 19/07/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_12c761df d—-c- [16:33 03/07/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_584d3fb9f11495b38abe966eef1dcf3942e663_178baeb9 d—-c- [13:04 28/07/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_9c43fdfab946a2173c6ef84f99a63ebb7f2e_06f002bf d—-c- [19:25 11/08/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_b6b17b5853c3936372a7dfc6fdc92baa317fb5_181a12a8 d—-c- [12:33 05/08/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_b6b17b5853c3936372a7dfc6fdc92baa317fb5_1e195bd9 d—-c- [13:37 07/08/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_c3a5fb76137fa07f6dd38d73b5593db1380f93b_09b770ff d—-c- [13:57 31/12/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_d1f0da7b6c5ec5b3aedb306653292872de94d8ef_0ac51843 d—-c- [11:52 21/07/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_d65b780c6470f930850734e5e52e6388e33a_1dd34e78 d—-c- [19:40 20/09/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_d739d61586c5bd36ef5f6accc02ece4251d671_1a40ca85 d—-c- [18:39 29/09/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_ByteFence.exe_d8a52dcec21c38cee11bdeefdf31d28bc3d43412_1304d4be d—-c- [12:18 04/09/2017]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\Critical_ByteFence.exe_978d85bf1ef8fab9a8b840d0cf176c1328398b3c_06b358c8 d—-c- [03:20 06/04/2017]

========== regfind ==========

Searching for "ByteFence"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
"url4"="javascript:/*https://get.adobe.com/reader/                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               */window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var b="Warning from ByteFence:\nBy accepting this, you may install a
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
"url7"="javascript:/*https://get.adobe.com/flashplayer/completion/adm/?exitcode=0&type=install&re=0&preinstalled=1                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               */window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
"url8"="javascript:/*https://get.adobe.com/flashplayer/                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               */window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var b="Warning from ByteFence:\nBy accepting this, you may inst
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
"url25"="javascript:                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var b="Warning from ByteFence:\nBy accepting this, you may install a program you didn't intend",c=["
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
"url32"="javascript:window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var b="Warning from ByteFence:\nBy accepting this, you may install a program you didn't intend",c=["input[type=checkbox][id^=offerCheckbox]"];if(document.querySelectorAll)var e=setInterval(function(){var a,b,f,g;for(a=0;a,g.checked&&g.click(),g.addEventListener?g.addEventListener("click",d,!1):g.attachEvent?g.attachEvent("onclick",d):g.onclick=d;f.length>0&&clearInterval(e)}},200)}}();void(0)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\ByteFence.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ByteFence_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ByteFence_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ByteFence]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ByteFence\RTOP]
"Path"="C:\Program Files\ByteFence\rtop"
[HKEY_USERS\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\Microsoft\Internet Explorer\TypedURLs]
"url4"="javascript:/*https://get.adobe.com/reader/                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               */window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var b="Warning from ByteFenc
[HKEY_USERS\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\Microsoft\Internet Explorer\TypedURLs]
"url7"="javascript:/*https://get.adobe.com/flashplayer/completion/adm/?exitcode=0&type=install&re=0&preinstalled=1                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               */window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===uncheck
[HKEY_USERS\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\Microsoft\Internet Explorer\TypedURLs]
"url8"="javascript:/*https://get.adobe.com/flashplayer/                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               */window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var b="Warning from Byt
[HKEY_USERS\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\Microsoft\Internet Explorer\TypedURLs]
"url25"="javascript:                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var b="Warning from ByteFence:\nBy accepting this, you may i
[HKEY_USERS\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\Microsoft\Internet Explorer\TypedURLs]
"url32"="javascript:window.history&&window.history.replaceState&&history.replaceState(history.state,"",window.location.href);var unchecky=window.unchecky||{};!function(){"use strict";function d(a){var c=a.target||a.srcElement;c.checked&&!confirm(b)&&setTimeout(function(){c.click()},1)}var a=void 0===unchecky.isFirst;if(unchecky.isFirst=!0,a){var b="Warning from ByteFence:\nBy accepting this, you may install a program you didn't intend",c=["input[type=checkbox][id^=offerCheckbox]"];if(document.querySelectorAll)var e=setInterval(function(){var a,b,f,g;for(a=0;a,g.checked&&g.click(),g.addEventListener?g.addEventListener("click",d,!1):g.attachEvent?g.attachEvent("onclick",d):g.onclick=d;f.length>0&&clearInterval(e)}},200)}}();void(0)"

-= EOF =-

terryfelter

Post #40January 12, 2018, 4:03 PM UTC

Since it looks like ByteFence has been just quarantined, would it cause problems in AdAware to just delete it?

Satchfan

Post #41January 12, 2018, 4:17 PM UTC

We'll deal with that when we clean up.

I'm busy for a while but will get back as soon as I can.

Meanwhile, apart from the slowness, are there any other problems?

Satchfan

Post #42January 12, 2018, 9:07 PM UTC last edited January 12, 2018, 9:19 PM UTC

My mistake - edited as to the wrong person.

Satchfan

Post #43January 12, 2018, 11:01 PM UTC

You need to clear your browsing history in Internet Explorer.

Let’s try resetting it:

press “Windows key + R”, type “inetcpl.cpl” and press Enter
in the “Internet properties” window click the “Advanced” tab and click Reset to reset Internet Explorer settings to default.

Please let me know how things are now and if there are any remaining problems.

Satchfan

Satchfan

Post #44January 15, 2018, 11:02 PM UTC last edited January 15, 2018, 11:03 PM UTC

It has been several days since I last got in touch.

Please let me know if you still need help. If I do not hear from you within 24 hours I'll assume that all is now OK and close this topic.

Satchfan

terryfelter

Post #45January 16, 2018, 3:29 AM UTC

Everything seems to be working fine, thanks again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

JS:Agent-EDB infection [Solved]

✨ Ask AI

Ask AI