What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

malware probably miners

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited

I was infected probably via fake flash Adobe update.I have run every antivirus and anti-spyware programs and they show nothing.Combofix won't run saying it is outdated.it ran once or twice removing hosts/ics file.roguekiller removed different infections everytime it ran.now it shows clean.my current problem is browsers (firefox and chrome) are getting redirected.jrt tool runs and removes some infection in ie folder.frst and jrt logs are enclosed.

Post #3
Open notepad, then click "Format" —>uncheck Word Wrap

~~~~

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
FF Plugin HKU\S-1-5-21-1423075984-1160684440-3601124052-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=3 -> C:\Users\Computer\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-1423075984-1160684440-3601124052-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=9 -> C:\Users\Computer\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-1423075984-1160684440-3601124052-1000: @updates.epicbrowser.com/Epic Privacy Browser Update;version=3 -> C:\Users\Computer\AppData\Local\Epic Privacy Browser\Update\1.3.27.13\npEpicUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-1423075984-1160684440-3601124052-1000: @updates.epicbrowser.com/Epic Privacy Browser Update;version=9 -> C:\Users\Computer\AppData\Local\Epic Privacy Browser\Update\1.3.27.13\npEpicUpdate3.dll [No File]
S3 catchme; \??\C:\Users\Computer\AppData\Local\Temp\catchme.sys [X] <==== ATTENTION
U4 ERSvc; no ImagePath
U2 helpsvc; no ImagePath
U4 RDSessMgr; no ImagePath
U4 TlntSvr; no ImagePath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{4E77131D-3629-431C-9818-C5679DC83E81}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocServer32 -> no filepath
ContextMenuHandlers1: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => -> No File
ContextMenuHandlers2: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => -> No File
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} => -> No File
ContextMenuHandlers6: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => -> No File
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [169]
AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9 [153]
AlternateDataStreams: C:\Users\Computer\Desktop\shutdown.exe:SummaryInformation [43]
AlternateDataStreams: C:\Users\Computer\Desktop\shutdown.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\scrfile: "%1" /S <==== ATTENTION
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\.scr: scrfile => "%1" /S <==== ATTENTION
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\cmdfile: "%1" %* <==== ATTENTION
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\.cmd: cmdfile => "%1" %* <==== ATTENTION
C:\Windows\Temp\*.*
Emptytemp:
End::



Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Instructions on how to backup your Favourites/Bookmarks and other data can be found below.Proceed with the reset once done.
  • Internet Explorer: How to reset Internet Explorer settings
  • Firefox: Reset Firefox
  • Chrome: Chrome - Reset browser settings
Post #5

Fix result of Farbar Recovery Scan Tool (x86) Version: 4-02-2019
Ran by [removed] (06-02-2019 07:41:45) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal

==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
FF Plugin HKU\S-1-5-21-1423075984-1160684440-3601124052-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=3 -> C:\Users\Computer\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-1423075984-1160684440-3601124052-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=9 -> C:\Users\Computer\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-1423075984-1160684440-3601124052-1000: @updates.epicbrowser.com/Epic Privacy Browser Update;version=3 -> C:\Users\Computer\AppData\Local\Epic Privacy Browser\Update\1.3.27.13\npEpicUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-1423075984-1160684440-3601124052-1000: @updates.epicbrowser.com/Epic Privacy Browser Update;version=9 -> C:\Users\Computer\AppData\Local\Epic Privacy Browser\Update\1.3.27.13\npEpicUpdate3.dll [No File]
S3 catchme; \??\C:\Users\Computer\AppData\Local\Temp\catchme.sys [X] <==== ATTENTION
U4 ERSvc; no ImagePath
U2 helpsvc; no ImagePath
U4 RDSessMgr; no ImagePath
U4 TlntSvr; no ImagePath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{4E77131D-3629-431C-9818-C5679DC83E81}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocServer32 -> no filepath
ContextMenuHandlers1: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => -> No File
ContextMenuHandlers2: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => -> No File
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} => -> No File
ContextMenuHandlers6: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => -> No File
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [169]
AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9 [153]
AlternateDataStreams: C:\Users\Computer\Desktop\shutdown.exe:SummaryInformation [43]
AlternateDataStreams: C:\Users\Computer\Desktop\shutdown.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\scrfile: "%1" /S <==== ATTENTION
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\.scr: scrfile => "%1" /S <==== ATTENTION
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\cmdfile: "%1" %* <==== ATTENTION
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\.cmd: cmdfile => "%1" %* <==== ATTENTION
C:\Windows\Temp\*.*
Emptytemp:

*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\SOFTWARE\Policies\Google => removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\MozillaPlugins\@updates.epicbrowser.com/Epic Privacy Browser Installer;version=3 => removed successfully.
"C:\Users\Computer\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll" => not found
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\MozillaPlugins\@updates.epicbrowser.com/Epic Privacy Browser Installer;version=9 => removed successfully.
"C:\Users\Computer\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll" => not found
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\MozillaPlugins\@updates.epicbrowser.com/Epic Privacy Browser Update;version=3 => removed successfully.
"C:\Users\Computer\AppData\Local\Epic Privacy Browser\Update\1.3.27.13\npEpicUpdate3.dll" => not found
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\MozillaPlugins\@updates.epicbrowser.com/Epic Privacy Browser Update;version=9 => removed successfully.
"C:\Users\Computer\AppData\Local\Epic Privacy Browser\Update\1.3.27.13\npEpicUpdate3.dll" => not found
HKLM\System\CurrentControlSet\Services\catchme => removed successfully.
catchme => service removed successfully.
HKLM\System\CurrentControlSet\Services\ERSvc => removed successfully.
ERSvc => service removed successfully.
HKLM\System\CurrentControlSet\Services\helpsvc => removed successfully.
helpsvc => service removed successfully.
HKLM\System\CurrentControlSet\Services\RDSessMgr => removed successfully.
RDSessMgr => service removed successfully.
HKLM\System\CurrentControlSet\Services\TlntSvr => removed successfully.
TlntSvr => service removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D} => removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{4E77131D-3629-431C-9818-C5679DC83E81} => removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} => removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F} => removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000_Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837} => removed successfully.
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\Comodo Antivirus => removed successfully.
HKLM\Software\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD} => removed successfully.
HKLM\Software\Classes\Drive\ShellEx\ContextMenuHandlers\Comodo Antivirus => removed successfully.
HKLM\Software\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD} => not found
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\MSSE => removed successfully.
HKLM\Software\Classes\CLSID\{0365FE2C-F183-4091-AC82-BFC39FB75C49} => not found
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\Comodo Antivirus => removed successfully.
HKLM\Software\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD} => not found
C:\ProgramData\TEMP => ":1CE11B51" ADS removed successfully.
C:\ProgramData\TEMP => ":CB0AACC9" ADS removed successfully.
C:\Users\Computer\Desktop\shutdown.exe => ":SummaryInformation" ADS could not remove.
C:\Users\Computer\Desktop\shutdown.exe => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\scrfile => removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\.scr => removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\cmdfile => removed successfully.
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Classes\.cmd => removed successfully.

=========== "C:\Windows\Temp\*.*" ==========

not found

========= End -> "C:\Windows\Temp\*.*" ========


=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 8064964 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 311670 B
Firefox => 21677589 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 33058 B
Public => 0 B
ProgramData => 0 B
systemprofile => 214317 B
LocalService => 242728 B
NetworkService => 1224 B
Computer => 821777 B
UpdatusUser => 0 B

RecycleBin => 0 B
EmptyTemp: => 37.9 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 07:43:10 ====

Post #6
Seems system is running fast after the fix.I shut down the system awaiting further instructions.after posting first logs and before applying the fix I did some cleanup on my own removing epic browser and comodo folders from directory c.Fyi.
Post #7

Seems system is running fast after the fix.

Good deal


If you already have Malwarebytes Anti-Malware, open the tool and let it update then please run a new scan.

~~
Let's check for remnants

Please download the Malwarebytes Anti-Malware setup file to your Desktop.

OR from this location Here
  • Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
  • Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
  • After the installation IS complete let it update if it asks.
  • Under SETTINGS…..APPLICATIONS leave everything at default
  • Under SETTINGS…..PROTECTION make sure AUTOMATIC QUARANTINE is on.
  • Then go to the Dashboard and click on SCAN NOW
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
    Upon completion of the scan (or after the reboot), click the Reports tab.
    Double-click the Scan Log.
    At the bottom click Export and choose Text file.

    Save the file to your desktop and include its content in your next reply.

    You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here
  • Then click on POST
  • Exit Malwarebytes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.
  • Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
  • Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
  • After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
  • Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
  • If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
  • After the restart, open EEK again (in the C:\EEK folder);
  • This time, click on Logs;
  • From there, go under the Quarantine Log tab, and click on the Export button;
  • Save the log on your desktop, then open it, and copy/paste its content in your next reply;
Please post these 2 logs when finished.

Also, tell me if your still being redirected.
Post #8

Hi,

 both scanners came up clean.no redirects as of now.Thanks a lot for the help.Could you please keep the thread open for 24 hours incase.

Post #9

Seems some remnants in chrome.Browsing with google chrome brings up some files in jrt.exe scan.Firefox browsing doesn't produce anything.

 

JRT found and deleted the following files.

 

File System: 2

Successfully deleted: C:\Users\Computer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YJ1N4QGW (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YJ1N4QGW (Temporary Internet Files Folder)


 

Post #10

Hi,

 The reinfection is most certainly my fault :wall: .I did try to install utorrent and the associated webcompanion from lavasoft got it's hooks.I tried my best to remove both the programs.I am posting frst log , hope I still qualify for help .

Post #11

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 4-02-2019
Ran by [removed] (administrator) on COMPUTER-PC (06-02-2019 19:34:22)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Microsoft Windows 7 Ultimate  (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Mediatek Inc.) C:\Program Files\MediatekWiFi\Common\RaRegistry.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(Realtek) C:\Program Files\Realtek\USB Wireless LAN Utility\RtlService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Windows\runSW.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Realtek) C:\Windows\SwUSB.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7862816 2009-10-28] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\…\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation -> Microsoft Corporation)
HKLM\…\Policies\Explorer: [NoFolderOptions] C:\Windows\0 [115 2009-05-31] ()
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\Policies\system: [DisableCMD] 0
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\Policies\Explorer: [ForceStartMenuLogoff] 0
HKLM\…\Drivers32: [msacm.aacacm] => C:\Windows\system32\AACACM.acm [294912 2012-07-21] (fccHandler)
HKLM\…\Drivers32: [msacm.ac3filter] => C:\Windows\system32\ac3filter.acm [1679360 2013-04-05] ()
HKLM\…\Drivers32: [msacm.l3pacm] => C:\Windows\system32\l3codecp.acm [220672 2009-07-14] (Fraunhofer Institut Integrierte Schaltungen IIS)
HKLM\…\Drivers32: [msacm.lameacm] => C:\Windows\system32\lameACM.acm [756224 2012-02-28] (hxxp://www.mp3dev.org/)
HKLM\…\Drivers32: [msacm.trspch] => C:\Windows\system32\tssoft32.acm [8192 2001-08-23] (DSP GROUP, INC.)
HKLM\…\Drivers32: [VIDC.LAGS] => C:\Windows\system32\lagarith.dll [216064 2011-12-08] ( )
HKLM\…\Drivers32: [VIDC.MLCY] => C:\Windows\system32\mlc.dll [155648 2012-05-22] ()
HKLM\…\Drivers32: [VIDC.X264] => C:\Windows\system32\x264vfw.dll [3649536 2013-03-17] (x264vfw project)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\72.0.3626.81\Installer\chrmstp.exe [2019-02-02] (Google LLC -> Google Inc.)
HKLM\Software\…\Authentication\Credential Provider Filters: [{83885FBB-6E8F-4a02-BF8A-FC96920D58EA}] ->

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{1B389FE6-6044-4E33-A177-FB0303EC4B79}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{2614AF45-10E1-490F-A0AE-CF6906FC75AB}: [DhcpNameServer] 192.168.44.1
Tcpip\..\Interfaces\{315B7037-EFDF-47FA-B28A-8ABF59B5369F}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{315B7037-EFDF-47FA-B28A-8ABF59B5369F}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4E0AFDC5-5793-4434-9B7C-42305B41D94F}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{4E9606FD-1A79-48AC-A882-5B70B4F1FA4E}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{778092C6-3156-41F5-AC28-B64648EF2C71}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{8982DD64-2054-4FA7-A570-E9CAC9BBF524}: [DhcpNameServer] 192.168.44.1
Tcpip\..\Interfaces\{9B396CCF-9913-45D8-9051-1005EC47DD06}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{F1F9672F-0378-4206-B917-ACEC4AB47D94}: [NameServer] 8.8.8.8,8.8.4.4

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com
SearchScopes: HKLM -> DefaultScope value is missing

FireFox:
========
FF DefaultProfile: bd8bcszd.dev-edition-default-1549438613095
FF ProfilePath: C:\Users\Computer\AppData\Roaming\Mozilla\Firefox\Profiles\26t5xzh3.default [2019-02-06]
FF ProfilePath: C:\Users\Computer\AppData\Roaming\Mozilla\Firefox\Profiles\bd8bcszd.dev-edition-default-1549438613095 [2019-02-06]
FF Extension: (uBlock Origin) - C:\Users\Computer\AppData\Roaming\Mozilla\Firefox\Profiles\bd8bcszd.dev-edition-default-1549438613095\Extensions\[removed] [2019-02-06]
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader\plugins\npFoxitReaderPlugin.dll [No File]
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader\plugins\npFoxitReaderPlugin.dll [No File]
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2009-04-05] (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-03-14] (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-03-14] (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-18] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-18] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=3.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-01-10] (VideoLAN)
StartMenuInternet: Firefox-308046B0AF4A39CB - FIREFOX.EXE

Chrome:
=======
CHR Profile: C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default [2019-02-06]
CHR Extension: (Slides) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2019-02-04]
CHR Extension: (Docs) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2019-02-04]
CHR Extension: (Google Drive) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2019-02-04]
CHR Extension: (YouTube) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-02-04]
CHR Extension: (uBlock Origin) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2019-02-06]
CHR Extension: (Sheets) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2019-02-04]
CHR Extension: (Google Docs Offline) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2019-02-04]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-02-04]
CHR Extension: (Gmail) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-02-04]
CHR Extension: (Chrome Media Router) - C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-02-04]
CHR Profile: C:\Users\Computer\AppData\Local\Google\Chrome\User Data\System Profile [2019-02-06]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 DSAService; C:\Program Files\Intel Driver and Support Assistant\DSAService.exe [22304 2018-01-17] (Intel(R) Driver & Support Assistant -> Intel)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [5073376 2018-09-19] (Malwarebytes Corporation -> Malwarebytes)
R2 MediatekRegistryWriter; C:\Program Files\MediatekWiFi\Common\RaRegistry.exe [405136 2014-12-04] (MEDIATEK INC. -> Mediatek Inc.)
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
R2 RealtekWlanU; C:\Program Files\Realtek\USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
S2 RTLDHCPService; C:\Program Files\Realtek\USB Wireless LAN Utility\RTLDHCP.exe [261848 2013-11-12] (Realtek Semiconductor Corp -> Realtek)
R2 RunSwUSB; C:\Windows\runSW.exe [48856 2013-10-18] (Realtek Semiconductor Corp -> )
S2 SetupARService; C:\Program Files\Realtek\Audio\SetupAfterRebootService.exe [24576 2014-08-05] (Realtek Semiconductor.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Windows -> Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2993832 2017-11-12] (Intel(R) Wireless Connectivity Solutions -> Intel® Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 adp94xx; C:\Windows\system32\DRIVERS\adp94xx.sys [422976 2009-07-14] (Microsoft Windows -> Adaptec, Inc.)
S3 adpahci; C:\Windows\system32\DRIVERS\adpahci.sys [297552 2009-07-14] (Microsoft Windows -> Adaptec, Inc.)
S3 adpu320; C:\Windows\system32\DRIVERS\adpu320.sys [146512 2009-07-14] (Microsoft Windows -> Adaptec, Inc.)
S3 aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [70720 2009-07-14] (Microsoft Windows -> Adaptec, Inc.)
S3 aliide; C:\Windows\system32\DRIVERS\aliide.sys [14400 2009-07-14] (Microsoft Windows -> Acer Laboratories Inc.)
S3 amdsata; C:\Windows\system32\DRIVERS\amdsata.sys [79952 2009-07-14] (Microsoft Windows -> Advanced Micro Devices)
S3 amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys [159312 2009-07-14] (Microsoft Windows -> AMD Technologies Inc.)
R0 amdxata; C:\Windows\System32\DRIVERS\amdxata.sys [23616 2009-07-14] (Microsoft Windows -> Advanced Micro Devices)
S3 arc; C:\Windows\system32\DRIVERS\arc.sys [76368 2009-07-14] (Microsoft Windows -> Adaptec, Inc.)
S3 arcsas; C:\Windows\system32\DRIVERS\arcsas.sys [86608 2009-07-14] (Microsoft Windows -> Adaptec, Inc.)
S3 b06bdrv; C:\Windows\system32\DRIVERS\bxvbdx.sys [430080 2009-07-14] (Microsoft Windows -> Broadcom Corporation)
S3 b57nd60x; C:\Windows\System32\DRIVERS\b57nd60x.sys [229888 2009-07-14] (Microsoft Windows -> Broadcom Corporation)
S3 BrFiltLo; C:\Windows\system32\DRIVERS\BrFiltLo.sys [13568 2009-07-14] (Microsoft Windows -> Brother Industries, Ltd.)
S3 BrFiltUp; C:\Windows\system32\DRIVERS\BrFiltUp.sys [5248 2009-07-14] (Microsoft Windows -> Brother Industries, Ltd.)
S3 Brserid; C:\Windows\System32\Drivers\Brserid.sys [272128 2009-07-14] (Microsoft Windows -> Brother Industries Ltd.)
S3 BrSerWdm; C:\Windows\System32\Drivers\BrSerWdm.sys [62336 2009-07-14] (Microsoft Windows -> Brother Industries Ltd.)
S3 BrUsbMdm; C:\Windows\System32\Drivers\BrUsbMdm.sys [12160 2009-07-14] (Microsoft Windows -> Brother Industries Ltd.)
S3 BrUsbSer; C:\Windows\System32\Drivers\BrUsbSer.sys [11904 2009-07-14] (Microsoft Windows -> Brother Industries Ltd.)
S3 cmdide; C:\Windows\system32\DRIVERS\cmdide.sys [15952 2009-07-14] (Microsoft Windows -> CMD Technology, Inc.)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbdx.sys [3100160 2009-07-14] (Microsoft Windows -> Broadcom Corporation)
S3 elxstor; C:\Windows\system32\DRIVERS\elxstor.sys [453712 2009-07-14] (Microsoft Windows -> Emulex)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [685056 2005-07-28] (Microsoft Windows Hardware Compatibility Publisher -> Aladdin Knowledge Systems Ltd.)
R2 Haspnt; C:\Windows\system32\drivers\Haspnt.sys [47616 2010-11-22] (Aladdin Knowledge Systems) [File not signed]
S3 hcw85cir; C:\Windows\system32\drivers\hcw85cir.sys [26624 2009-07-14] (Microsoft Windows -> Hauppauge Computer Works, Inc.)
S3 HpSAMD; C:\Windows\system32\DRIVERS\HpSAMD.sys [67152 2009-07-14] (Microsoft Windows -> Hewlett-Packard Company)
S3 htcnprot; C:\Windows\System32\DRIVERS\htcnprot.sys [23040 2013-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
S3 iaStorV; C:\Windows\system32\DRIVERS\iaStorV.sys [332352 2009-07-14] (Microsoft Windows -> Intel Corporation)
S3 iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [41040 2009-07-14] (Microsoft Windows -> Intel Corp./ICP vortex GmbH)
S3 LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys [95824 2009-07-14] (Microsoft Windows -> LSI Corporation)
S3 LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys [89168 2009-07-14] (Microsoft Windows -> LSI Corporation)
S3 LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [54864 2009-07-14] (Microsoft Windows -> LSI Corporation)
S3 LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys [96848 2009-07-14] (Microsoft Windows -> LSI Corporation)
S3 megasas; C:\Windows\system32\DRIVERS\megasas.sys [30800 2009-07-14] (Microsoft Windows -> LSI Corporation)
S3 MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [235584 2009-07-14] (Microsoft Windows -> LSI Corporation, Inc.)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [1731416 2015-11-19] (MEDIATEK INC. -> MediaTek Inc.)
S3 nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys [44624 2009-07-14] (Microsoft Windows -> IBM Corporation)
S3 nvraid; C:\Windows\system32\DRIVERS\nvraid.sys [117312 2009-07-14] (Microsoft Windows -> NVIDIA Corporation)
S3 nvstor; C:\Windows\system32\DRIVERS\nvstor.sys [142416 2009-07-14] (Microsoft Windows -> NVIDIA Corporation)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [32912 2015-10-14] (NVIDIA Corporation -> NVIDIA Corporation)
U3 Partizan; C:\Windows\System32\drivers\Partizan.sys [40304 2019-02-04] (Greatis Software LLC -> Greatis Software)
S3 pccsmcfd; C:\Windows\System32\DRIVERS\pccsmcfd.sys [19072 2012-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Nokia)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13440 2011-11-25] (June Fabrics Technology Inc. -> June Fabrics Technology Inc.)
S3 ql2300; C:\Windows\system32\DRIVERS\ql2300.sys [1383488 2009-07-14] (Microsoft Windows -> QLogic Corporation)
S3 ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys [106064 2009-07-14] (Microsoft Windows -> QLogic Corporation)
R3 RTL8167; C:\Windows\System32\DRIVERS\Rt86win7.sys [230912 2009-11-05] (Microsoft Windows Hardware Compatibility Publisher -> Realtek )
S3 RTL8169; C:\Windows\System32\DRIVERS\Rtlh86.sys [124928 2008-08-06] (Microsoft Windows Hardware Compatibility Publisher -> Realtek Corporation )
R2 secdrv; C:\Windows\system32\Drivers\secdrv.sys [20480 2009-07-14] (Microsoft Windows -> Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
S3 SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys [77888 2009-07-14] (Microsoft Windows -> Silicon Integrated Systems)
S3 SIVDriver; C:\Windows\system32\Drivers\SIVX32.sys [137744 2016-07-25] (RH Software -> Ray Hinchliffe)
S3 stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [21072 2009-07-14] (Microsoft Windows -> Promise Technology)
S3 vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [141904 2009-07-14] (Microsoft Windows -> VIA Technologies Inc.,Ltd)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-02-06 19:34 - 2019-02-06 19:34 - 000017134 _____ C:\Users\Computer\Desktop\FRST.txt
2019-02-06 19:26 - 2019-02-06 19:26 - 000003136 _____ C:\Users\Computer\Desktop\copyy.txt
2019-02-06 18:00 - 2019-02-06 18:00 - 000000000 ____D C:\ProgramData\Emsisoft
2019-02-06 17:47 - 2019-02-06 19:33 - 000001542 _____ C:\Users\Computer\Desktop\JRT.txt
2019-02-06 17:38 - 2019-02-06 17:38 - 000002810 _____ C:\Users\Computer\Desktop\AdwCleaner[S15].txt
2019-02-06 17:31 - 2019-02-06 17:31 - 000002024 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-02-06 17:31 - 2019-02-06 17:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-02-06 17:31 - 2018-12-04 08:09 - 000129248 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae.sys
2019-02-06 17:30 - 2019-02-06 17:30 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-02-06 17:30 - 2019-02-06 17:30 - 000000000 ____D C:\Program Files\Malwarebytes
2019-02-06 17:22 - 2019-02-06 19:29 - 000002362 _____ C:\Users\Computer\Desktop\Rkill.txt
2019-02-06 17:22 - 2019-02-04 11:07 - 001802704 _____ (Bleeping Computer, LLC) C:\Users\Computer\Desktop\rkill.exe
2019-02-06 17:11 - 2019-02-06 17:11 - 000003330 _____ C:\Users\Computer\Desktop\2jrt.txt
2019-02-06 17:09 - 2019-02-03 16:21 - 001790024 _____ (Malwarebytes) C:\Users\Computer\Desktop\JRT.exe
2019-02-06 15:16 - 2019-02-06 15:16 - 000000000 ____D C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SubtitlesSynch
2019-02-06 15:16 - 2019-02-06 15:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SubtitlesSynch
2019-02-06 15:16 - 2019-02-06 15:16 - 000000000 ____D C:\Program Files\SubtitlesSynch
2019-02-06 12:00 - 2019-02-06 12:38 - 000000000 ____D C:\Users\Computer\AppData\Roaming\uTorrent
2019-02-06 11:49 - 2019-02-06 13:06 - 000000000 ____D C:\Users\Computer\Desktop\Old Firefox Data
2019-02-05 12:39 - 2019-02-06 19:18 - 000000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2019-02-04 21:32 - 2019-02-04 21:32 - 001790976 _____ (Farbar) C:\Users\Computer\Desktop\FRST.exe
2019-02-04 15:45 - 2019-02-04 15:45 - 000000000 ____D C:\Windows\ABR
2019-02-04 14:44 - 2019-02-04 14:44 - 000000000 ____D C:\Program Files\IObit
2019-02-04 14:16 - 2019-02-04 14:26 - 000000000 ____D C:\ProgramData\RegRun
2019-02-04 14:14 - 2019-02-05 09:08 - 000000366 _____ C:\Windows\system32\PARTIZAN.TXT
2019-02-04 14:12 - 2019-02-04 14:12 - 000040304 _____ (Greatis Software) C:\Windows\system32\Drivers\Partizan.sys
2019-02-04 14:12 - 2019-02-04 14:12 - 000001115 _____ C:\Users\Computer\Desktop\Reanimator.lnk
2019-02-04 14:12 - 2019-02-04 14:12 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reanimator
2019-02-04 14:12 - 2019-02-04 14:12 - 000000000 ____D C:\Program Files\Greatis
2019-02-04 14:12 - 2015-12-28 11:32 - 000049968 _____ (Greatis Software) C:\Windows\system32\partizan.exe
2019-02-04 13:15 - 2019-02-04 21:55 - 000000000 ___SD C:\32788R22FWJFW
2019-02-04 11:10 - 2019-02-04 11:10 - 000000000 ____D C:\Users\Computer\AppData\Local\mbamtray
2019-02-04 11:10 - 2019-02-04 11:10 - 000000000 ____D C:\Users\Computer\AppData\Local\mbam
2019-02-04 10:15 - 2019-02-04 10:15 - 129687688 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2019-02-04 06:31 - 2019-02-04 06:31 - 001060864 _____ (Microsoft Corporation) C:\Windows\system32\mfc71.dll
2019-02-04 06:29 - 2018-12-17 10:55 - 000366784 _____ (COMODO) C:\ProgramData\cmdres.dll
2019-02-03 21:14 - 2019-02-06 17:23 - 000000270 _____ C:\Windows\Tasks\RogueKiller Anti-Malware.job
2019-02-03 20:14 - 2019-02-04 11:37 - 000000000 ____D C:\ProgramData\RogueKiller
2019-02-03 20:14 - 2019-02-03 20:14 - 000001005 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2019-02-03 20:14 - 2019-02-03 20:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2019-02-03 20:14 - 2019-02-03 20:14 - 000000000 ____D C:\Program Files\RogueKiller
2019-02-03 19:49 - 2019-02-03 19:49 - 000000000 ____D C:\Program Files\Common Files\AV
2019-02-03 19:30 - 2019-02-03 19:30 - 000000000 ____D C:\Users\Computer\AppData\Roaming\Simply Super Software
2019-02-03 19:22 - 2019-02-03 19:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bazooka Scanner
2019-02-03 18:34 - 2019-02-03 18:34 - 000000000 ____D C:\VTRoot
2019-02-03 18:28 - 2019-02-03 21:44 - 001474832 _____ C:\Windows\system32\Drivers\sfi.dat
2019-02-03 18:26 - 2019-02-04 06:31 - 000000000 ____D C:\Users\Computer\AppData\Local\Comodo
2019-02-03 18:23 - 2019-02-03 18:23 - 000000000 ____D C:\ProgramData\Shared Space
2019-02-03 16:46 - 2019-02-06 19:27 - 007316688 _____ (Malwarebytes) C:\Users\Computer\Desktop\adwcleaner_7.2.7.0.exe
2019-02-03 16:32 - 2019-02-03 16:32 - 000001034 _____ C:\Users\Computer\Desktop\Your Unin-staller!.lnk
2019-02-03 16:32 - 2019-02-03 16:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Your Uninstaller! 7
2019-02-03 16:32 - 2019-02-03 16:32 - 000000000 ____D C:\Program Files\Your Uninstaller! 7
2019-02-03 16:27 - 2019-02-03 16:27 - 000000000 ____D C:\AdwCleaner
2019-02-03 16:08 - 2019-02-03 16:08 - 000000000 ____D C:\Windows\Tasks\ImCleanDisabled
2019-02-03 16:06 - 2019-02-05 13:45 - 000000000 ____D C:\Users\Computer\AppData\LocalLow\IObit
2019-02-03 11:20 - 2019-02-06 19:34 - 000000000 ____D C:\FRST
2019-02-03 10:54 - 2019-02-03 10:55 - 000000000 ____D C:\Rem-VBSqt
2019-02-03 08:20 - 2019-02-03 12:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NoVirusThanks
2019-02-02 22:22 - 2019-02-02 23:29 - 000000000 ____D C:\Windows\CryptoGuard
2019-02-02 22:22 - 2019-02-02 22:22 - 000933056 _____ (SurfRight B.V.) C:\Windows\system32\hmpalert.dll
2019-02-02 17:10 - 2019-02-06 18:07 - 000000000 ____D C:\EEK
2019-02-02 16:39 - 2019-02-02 16:39 - 000001284 _____ C:\Windows\system32\ServiceConfig.xml
2019-02-02 15:57 - 2019-02-04 07:17 - 000123272 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2019-02-02 15:56 - 2019-02-02 15:56 - 000000000 ____D C:\Program Files\Reason
2019-02-02 15:54 - 2019-02-02 15:54 - 000000000 ____D C:\Users\Computer\User_Disabled
2019-02-02 15:54 - 2019-02-02 15:54 - 000000000 ____D C:\ProgramData\All_Disabled
2019-02-02 15:50 - 2000-02-07 11:06 - 000106496 _____ (Marco Bellinaso) C:\Windows\system32\MBTray.ocx
2019-02-02 15:30 - 2019-02-02 15:30 - 000002952 _____ C:\Windows\system32\VipreEdgeProtectionOff.ini
2019-02-02 15:30 - 2018-08-29 04:06 - 000038240 _____ (ThreatTrack Security Inc.) C:\Windows\system32\Drivers\WebExaminer.sys
2019-02-02 15:29 - 2019-02-02 15:29 - 000000000 ____D C:\ProgramData\Downloaded Installations
2019-02-02 15:23 - 2019-02-02 15:23 - 000000106 _____ C:\Windows\system32\sbrc.dat
2019-02-02 14:13 - 2019-02-06 17:13 - 000000294 _____ C:\Windows\Tasks\AdwCleaner_onReboot.job
2019-02-02 07:50 - 2019-02-03 12:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2019-02-02 06:52 - 2019-02-02 08:27 - 000000000 ____D C:\Windows\Minidump
2019-02-02 06:43 - 2019-02-02 06:43 - 000000000 ____D C:\Users\Computer\Documents\Simply Super Software
2019-02-02 05:29 - 2019-02-02 05:33 - 000210118 _____ C:\TDSSKiller.3.1.0.26_02.02.2019_05.29.02_log.txt
2019-02-02 04:25 - 2019-02-02 04:25 - 000002246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-02-02 04:25 - 2019-02-02 04:25 - 000002205 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-02-02 02:56 - 2019-02-02 02:56 - 000000286 _____ C:\Windows\Tasks\User_Feed_Synchronization-{B670FFF4-B0CE-4A26-AEC0-BD8A429FB054}.job
2019-02-02 02:52 - 2019-02-02 02:52 - 000052464 _____ C:\Users\Computer\Desktop\chrmbook.html
2019-02-01 08:37 - 2019-02-01 08:37 - 000001028 _____ C:\Users\Public\Desktop\VLC media player.lnk
2019-02-01 08:37 - 2019-02-01 08:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2019-02-01 08:37 - 2019-02-01 08:37 - 000000000 ____D C:\Program Files\VideoLAN
2019-01-30 10:13 - 2019-02-04 14:13 - 000011906 _____ C:\Windows\ZAM_Guard.krnl.trace
2019-01-30 10:13 - 2019-02-04 14:09 - 000054286 _____ C:\Windows\ZAM.krnl.trace
2019-01-18 16:03 - 2019-02-04 13:24 - 000000000 ____D C:\NPE
2019-01-17 03:15 - 2019-01-16 00:06 - 000000027 _____ C:\Windows\system32\Drivers\etc\hosts.old
2019-01-16 00:20 - 2019-01-16 00:20 - 000222648 _____ (Malwarebytes) C:\Windows\system32\Drivers\145532F7.sys
2019-01-12 05:04 - 2019-01-12 05:04 - 000222648 _____ (Malwarebytes) C:\Windows\system32\Drivers\7C120765.sys

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-02-06 19:30 - 2009-05-23 00:23 - 000000000 ____D C:\ProgramData\TEMP
2019-02-06 19:28 - 2016-11-16 02:18 - 000000000 ____D C:\Users\Computer\AppData\LocalLow\Mozilla
2019-02-06 19:25 - 2008-12-13 05:10 - 000037376 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2019-02-06 19:25 - 2008-12-13 05:10 - 000037376 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2019-02-06 19:18 - 2016-07-25 21:49 - 000000000 ____D C:\ProgramData\NVIDIA
2019-02-06 19:18 - 2010-03-09 07:25 - 008405015 _____ C:\Windows\TempFile
2019-02-06 19:18 - 2009-07-14 10:23 - 000032646 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2019-02-06 19:18 - 2009-07-14 10:23 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-02-06 17:31 - 2009-07-14 08:07 - 000000000 ____D C:\Windows\inf
2019-02-06 17:12 - 2011-05-26 11:54 - 000000000 ____D C:\Users\Computer\AppData\Roaming\vlc
2019-02-06 15:17 - 2009-08-09 05:48 - 000000000 ____D C:\Users\Computer\Desktop\shortcuts
2019-02-06 15:16 - 2016-09-10 22:33 - 000001041 _____ C:\Users\UpdatusUser\Desktop\SubtitlesSynch.lnk
2019-02-06 12:02 - 2011-10-30 17:02 - 000000000 ____D C:\Users\Computer\AppData\LocalLow\Temp
2019-02-06 12:01 - 2016-07-25 22:25 - 000123272 _____ C:\Users\Computer\AppData\Local\GDIPFONTCACHEV1.DAT
2019-02-04 15:52 - 2013-11-04 07:56 - 000000000 ____D C:\Users\Computer\AppData\Local\CrashDumps
2019-02-04 14:45 - 2010-07-16 06:06 - 000000000 ____D C:\ProgramData\NOS
2019-02-04 14:28 - 2009-08-08 18:21 - 000000000 ____D C:\Users\Public\Documents\RegRunInfo
2019-02-04 14:26 - 2014-06-26 19:16 - 000000000 ____D C:\Users\Computer\Documents\RegRun2
2019-02-04 13:51 - 2016-07-25 21:50 - 000000000 ____D C:\Users\Computer
2019-02-04 13:44 - 2010-05-06 19:36 - 000000000 ____D C:\Users\Computer\AppData\Local\NPE
2019-02-04 08:53 - 2009-07-14 07:34 - 000000215 _____ C:\Windows\system.ini
2019-02-03 18:44 - 2009-07-14 08:07 - 000000000 ____D C:\Windows\system32\NDF
2019-02-03 16:10 - 2016-07-25 22:20 - 000787996 _____ C:\Windows\system32\PerfStringBackup.INI
2019-02-03 13:13 - 2016-04-08 17:15 - 000000000 ____D C:\Program Files\VS Revo Group
2019-02-03 07:47 - 2009-07-14 10:03 - 000454992 _____ C:\Windows\system32\FNTCACHE.DAT
2019-02-02 19:35 - 2009-05-30 17:48 - 000000000 ____D C:\Windows\system32\appmgmt
2019-02-02 19:34 - 2017-09-27 21:41 - 000000000 ____D C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xiaomi
2019-02-02 16:37 - 2014-03-27 13:53 - 000000000 ____D C:\ProgramData\Package Cache
2019-02-02 13:40 - 2009-08-07 08:39 - 000000000 ____D C:\Windows\ERDNT
2019-02-02 13:33 - 2018-02-21 18:46 - 000000000 ____D C:\Users\Computer\AppData\Roaming\Panda Security
2019-02-02 06:51 - 2015-04-04 09:11 - 000000000 ____D C:\Program Files\Mozilla Maintenance Service
2019-02-02 04:29 - 2009-02-27 15:58 - 000000000 ____D C:\Users\Computer\AppData\Roaming\Google
2019-02-02 04:25 - 2009-01-07 02:54 - 000000000 ____D C:\Users\Computer\AppData\Local\Google
2019-02-02 04:23 - 2009-02-27 15:57 - 000000000 ____D C:\Program Files\Google
2019-02-01 09:09 - 2016-11-16 02:11 - 000000000 ____D C:\Program Files\Mozilla Firefox
2019-02-01 02:58 - 2018-01-25 20:25 - 000000000 ____D C:\Program Files\Intel Driver and Support Assistant
2019-01-28 22:57 - 2017-02-16 01:18 - 000000969 _____ C:\Users\Public\Desktop\CCleaner.lnk
2019-01-25 01:07 - 2016-01-07 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDiskReport 1.4.1
2019-01-25 00:36 - 2014-11-03 15:48 - 000000000 ____D C:\Users\Computer\AppData\Roaming\Geek Uninstaller

==================== Files in the root of some directories =======

2019-02-04 06:29 - 2018-12-17 10:55 - 000366784 _____ (COMODO) C:\ProgramData\cmdres.dll
2013-03-29 03:54 - 2013-03-29 03:54 - 000000020 _____ () C:\Users\Computer\AppData\Roaming\APP4870.CONFCOLLECTION.del
2010-08-31 19:20 - 2010-08-31 19:21 - 000000049 _____ () C:\Users\Computer\AppData\Roaming\cccalc.txt
2010-05-19 22:45 - 2010-05-20 13:17 - 000028330 _____ () C:\Users\Computer\AppData\Roaming\Comma Separated Values (Windows).ADR
2010-03-23 05:30 - 2010-03-23 05:30 - 000000024 _____ () C:\Users\Computer\AppData\Roaming\samulagi
2014-04-25 09:53 - 2014-04-25 09:54 - 000000144 _____ () C:\Users\Computer\AppData\Roaming\settings.xml
2012-05-08 10:43 - 2012-05-08 10:43 - 000000139 _____ () C:\Users\Computer\AppData\Roaming\srt_maker
2011-08-31 05:37 - 2011-08-31 05:37 - 000000022 _____ () C:\Users\Computer\AppData\Roaming\SYS2662.CONFIG.REPOSITORY.del
2013-09-27 22:48 - 2013-09-27 22:48 - 000000024 ___SH () C:\Users\Computer\AppData\Roaming\System5908ConfigCollection.dat
2013-09-10 18:26 - 2013-09-10 18:26 - 000000022 _____ () C:\Users\Computer\AppData\Roaming\WINDOWS1569_SETTINGSREPOSITORY.del
2018-02-16 16:03 - 2018-02-16 16:03 - 000000017 _____ () C:\Users\Computer\AppData\Local\resmon.resmoncfg

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\dllhost.exe => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-07-25 21:46

==================== End of FRST.txt ============================

Post #12
  • Please download and install Revo Uninstaller.
  • Double-click Revo Uninstaller to run the programme.
  • From the list of programmes, locate the following, or anything similar and carry out the steps below one at a time.
  • utorrent
    webcompanion
  • ?Double-click the programme.
  • When prompted if you want to uninstall click Yes.
  • Ensure the Moderate option is selected and click Next.
  • The programme uninstaller will run. If prompted again click Yes.
  • Work your way through the uninstaller, ensuring you read each page thoroughly.
  • Note: If you are offered the choice to install additional software, ensure you decline.
  • Once the built-in uninstaller is finished click Next.
  • Once the programme has searched for leftovers click Next.
  • Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
  • When prompted click Yes, followed by Next.
  • Click Select all, followed by Delete.
  • When prompted click Yes, followed by Next.
  • Upon completion, click Finish.
  • In your next reply, confirm you were successful in uninstalling all programmes listed above.

For what JRT found

The content.IE5 folders are perfectly normal subfolders in the Temporary Internet Files folder.
https://support.microsoft.com/en-us/help/260897/how-to-delete-the-contents-of-the-temporary-internet-files-folder
scroll down to your version of windows
Post #14
The last FRST log you posted had only one line
C:\Users\Computer\AppData\Roaming\uTorrent

If anything else was attached to it I can't find it, there was no Addition.txt posted.

Whats happening now?
Post #15

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 4-02-2019
Ran by [removed] (06-02-2019 19:35:06)
Running from C:\Users\[removed]\Desktop
Microsoft Windows 7 Ultimate  (X86) (2016-07-25 16:48:15)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1423075984-1160684440-3601124052-500 - Administrator - Disabled)
AlphaUser$ (S-1-5-21-1423075984-1160684440-3601124052-1002 - Limited - Enabled)
Computer (S-1-5-21-1423075984-1160684440-3601124052-1000 - Administrator - Enabled) => C:\Users\Computer
Guest (S-1-5-21-1423075984-1160684440-3601124052-501 - Limited - Enabled)
UpdatusUser (S-1-5-21-1423075984-1160684440-3601124052-1008 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

. . . (HKLM\…\{9F460796-0348-4B11-BCA0-714C4B85E3D7}) (Version: 3.1.2.2 - Intel) Hidden
7-Zip 16.02 (HKLM\…\7-Zip) (Version: 16.02 - Igor Pavlov)
BleachBit (HKLM\…\BleachBit) (Version: 1.12 - BleachBit)
CCleaner (HKLM\…\CCleaner) (Version: 5.52 - Piriform)
Cisco EAP-FAST Module (HKLM\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\…\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\…\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Crystal Reports Basic Runtime for Visual Studio 2008 (HKLM\…\{CE26F10F-C80F-4377-908B-1B7882AE2CE3}) (Version: 10.5.2.0 - Business Objects)
Defraggler (HKLM\…\Defraggler) (Version: 2.19 - Piriform)
Everything 1.2.1.371 (HKLM\…\Everything) (Version:  - )
Feedback Tool (HKLM\…\{90024193-9F13-4877-89D5-A1CDF0CBBF28}) (Version: 1.1.0 - Microsoft Corporation)
Google Chrome (HKLM\…\Google Chrome) (Version: 72.0.3626.81 - Google Inc.)
Google Update Helper (HKLM\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.23 - Google Inc.) Hidden
HASP4 Device Drivers (HKLM\…\HASP4 Device Drivers) (Version:  - )
hppMSRedist (HKLM\…\{58ECE031-9AAD-4011-B34A-BC78E77527E2}) (Version: 1.00.0000 - Hewlett-Packard) Hidden
hppusgP1000 (HKLM\…\{2767DEDE-EA9D-4FCE-A06A-40F4DD293330}) (Version: 000.000.00003 - Hewlett-Packard) Hidden
Icecream Ebook Reader version 5.07 (HKLM\…\{B8C30F0F-1F23-49E1-A3ED-44DE17660EE2}_is1) (Version: 5.07 - Icecream Apps)
ImgBurn (HKLM\…\ImgBurn) (Version: 2.5.1.0 - LIGHTNING UK!)
Intel Android Device USB driver (HKLM\…\Intel Android Device USB driver) (Version: 1.1.5 - Intel)
Intel® Driver & Support Assistant (HKLM\…\{e7adbf16-34ad-490a-a4e8-feb60fb99973}) (Version: 3.1.2.2 - Intel)
Intel® PROSet/Wireless Software (HKLM\…\{55819061-cfae-44c8-8381-d3110e489f3b}) (Version: 20.10.2 - Intel Corporation)
Malwarebytes version 3.6.1.2711 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.6.1.2711 - Malwarebytes)
MarketResearch (HKLM\…\{13F00518-807A-4B3A-83B0-A7CD90F3A398}) (Version: 90.0.142.000 - Hewlett-Packard) Hidden
Mediatek RT2870 Wireless LAN Card (HKLM\…\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.39.173 - MediatekWiFi)
Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\…\ENTERPRISE) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM\…\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\…\{CA8A885F-E95B-3FC6-BB91-F4D9377C7686}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 65.0 (x86 en-US) (HKLM\…\Mozilla Firefox 65.0 (x86 en-US)) (Version: 65.0 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 66.0.0.6970 - Mozilla)
MSVC80_x86_v2 (HKLM\…\{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}) (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (HKLM\…\{AF111648-99A1-453E-81DD-80DBBF6DAD0D}) (Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM\…\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Nokia Connectivity Cable Driver (HKLM\…\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
NVIDIA 3D Vision Controller Driver 314.22 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 314.22 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 314.22 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 314.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 314.22 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 314.22 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.1220 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Update 1.12.12 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.12.12 - NVIDIA Corporation)
PC Connectivity Solution (HKLM\…\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
Qualcomm USB Drivers For Windows (HKLM\…\{D9FB7F91-9687-4B09-894D-072903CADEA4}) (Version: 1.00.25 - QUALCOMM Incorporated)
Realtek 8136 8168 8169 Ethernet Driver (HKLM\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver and Utility (HKLM\…\{9C049509-055C-4CFF-A116-1D12312225EB}) (Version: 1.00.0239 - REALTEK Semiconductor Corp.)
RegRun Reanimator (HKLM\…\UnHackMe Update - Reanimator_is1) (Version:  - Greatis Software, LLC.)
RogueKiller version 13.1.4.0 (HKLM\…\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 13.1.4.0 - Adlice Software)
SDFormatter (HKLM\…\{179324FF-7B16-4BA8-9836-055CAAEE4F08}) (Version: 4.0.0 - SD Association)
SeaTools for Windows 1.4.0.6 (HKLM\…\SeaTools for Windows) (Version: 1.4.0.6 - Seagate Technology)
SubtitlesSynch (HKLM\…\SubtitlesSynch) (Version:  - )
System Requirements Lab (HKLM\…\SystemRequirementsLab) (Version:  - )
Universal Adb Driver (HKLM\…\{D9C4202E-6D51-4B06-A8F1-22316E654BCA}) (Version: 1.0.0 - ClockworkMod)
VLC media player (HKLM\…\VLC media player) (Version: 3.0.6 - VideoLAN)
Windows 7 USB/DVD Download Tool (HKLM\…\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Driver Package - Google, Inc. (WinUSB) AndroidUsbDeviceClass  (01/27/2014 9.0.0000.00000) (HKLM\…\9CA77E2A8332A0824C54DA611BBE4CA24AB1F750) (Version: 01/27/2014 9.0.0000.00000 - Google, Inc.)
Windows Driver Package - Google, Inc. (WinUSB) AndroidUsbDeviceClass  (08/28/2014 11.0.0000.00000) (HKLM\…\092555911492C6959D2596D612F52DCA71881CA2) (Version: 08/28/2014 11.0.0000.00000 - Google, Inc.)
Windows Driver Package - Nokia pccsmcfd “LegacyDriver”  (05/31/2012 7.1.2.0) (HKLM\…\17D063A0A9F5D5A225B76B1D9BCB5ADBE85C8382) (Version: 05/31/2012 7.1.2.0 - Nokia)
Windows Mobile Device Center (HKLM\…\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile Device Center Driver Update (HKLM\…\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation)
Your Uninstaller! 7 (HKLM\…\YU2010_is1) (Version: 7.5.2014.3 - URSoft, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-05-21] (Igor Pavlov)
ContextMenuHandlers1: [SFS_CONTEXT] -> {3DE5DB7C-0EA5-4337-8A5C-D0AC6D154C1B} => C:\Program Files\scar5\Simple File Shredder\sfsshell.dll [2006-02-16] (scar5 Software)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-05-21] (Igor Pavlov)
ContextMenuHandlers4: [SFS_CONTEXT] -> {3DE5DB7C-0EA5-4337-8A5C-D0AC6D154C1B} => C:\Program Files\scar5\Simple File Shredder\sfsshell.dll [2006-02-16] (scar5 Software)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2013-03-15] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-05-21] (Igor Pavlov)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes Corporation -> Malwarebytes)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\AdwCleaner_onReboot.job => C:\Users\Computer\Desktop\adwcleaner_7.2.7.0.exe
Task: C:\Windows\Tasks\RogueKiller Anti-Malware.job => C:\Program Files\RogueKiller\RogueKiller.exe
Task: C:\Windows\Tasks\SidebarExecute.job => C:\Program Files\Windows Sidebar\sidebar.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{B670FFF4-B0CE-4A26-AEC0-BD8A429FB054}.job => C:\Windows\system32\msfeedssync.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Computer\Desktop\shortcuts\rrash - Shortcut.lnk -> D:\Downloads\Road Rash\Road Rash\rrash.bat ()

==================== Loaded Modules (Whitelisted) ==============

2013-07-25 09:36 - 2013-04-15 11:49 - 000176128 _____ () C:\Windows\System32\HP1006LM.DLL
2013-07-25 09:39 - 2013-04-15 11:49 - 000059904 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\HP1006PP.dll
2013-10-17 15:27 - 2013-10-17 15:27 - 000166912 _____ () C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
2018-01-26 09:43 - 2013-10-18 16:42 - 000048856 _____ () C:\Windows\runSW.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [169]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VipreEdgeProtection => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WebExaminer => ""="Driver"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\bbc.co.uk -> hxxp://www.bbc.co.uk
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\bsnl.co.in -> hxxp://selfcare.edc.bsnl.co.in
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\chemsynergy.com -> hxxp://www.chemsynergy.com
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\dow.com -> hxxp://www.dow.com
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\hdfcbank.com -> hxxps://netsafe.hdfcbank.com
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\hdfcsec.com -> hxxps://trade.hdfcsec.com
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\highdesertecigs.com -> hxxp://highdesertecigs.com
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\indiagames.com -> hxxp://bsnl.indiagames.com
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\indochem.in -> hxxp://www.indochem.in
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\ipindiaonline.gov.in -> hxxps://www.ipindiaonline.gov.in
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\irctc.co.in -> hxxp://www.irctc.co.in
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\laghu-udyog.com -> hxxp://www.laghu-udyog.com
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\mumbairaces.com -> hxxp://www.mumbairaces.com
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\nic.in -> hxxp://dgftcom.nic.in
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\nimsme.org -> hxxp://www.nimsme.org
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\nvidia.co.in -> hxxp://www.nvidia.co.in
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\racingpulse.in -> hxxp://racingpulse.in
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\snuff.co.in -> hxxp://www.snuff.co.in
IE trusted site: HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\…\tmc.gov.in -> hxxp://tmc.gov.in

There are 4 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2019-01-31 18:40 - 2019-02-06 17:13 - 000000852 _____ C:\Windows\system32\drivers\etc\hosts


2019-02-05 12:39 - 2019-02-06 19:18 - 000000374 _____ C:\Windows\system32\drivers\etc\hosts.ics


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1423075984-1160684440-3601124052-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8 - 8.8.4.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.

MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
MSCONFIG\startupreg: Everything => "C:\Program Files\Everything\Everything.exe" -startup

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

06-02-2019 12:55:54 Restore Point Created by FRST
06-02-2019 17:09:51 JRT Pre-Junkware Removal
06-02-2019 17:46:17 JRT Pre-Junkware Removal
06-02-2019 18:12:26 JRT Pre-Junkware Removal
06-02-2019 19:32:26 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============

Name: SONY DVD RW DRU-880S ATA Device
Description: CD-ROM Drive
Class Guid: {4d36e965-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard CD-ROM drives)
Service: cdrom
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/06/2019 07:18:45 PM) (Source: SetupARService) (EventID: 0) (User: )
Description: Service cannot be started. System.NullReferenceException: Object reference not set to an instance of an object.
   at SetupAfterRebootService.SetupARService.OnStart(String[] args)
   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (02/06/2019 07:18:30 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Event-ID 0

Error: (02/06/2019 05:38:35 PM) (Source: .NET Runtime) (EventID: 1024) (User: )
Description: Shim database version C:\Windows\Microsoft.NET\Framework\v4.0.30319 doesn't have a matching runtime directory

Error: (02/06/2019 05:38:35 PM) (Source: .NET Runtime) (EventID: 1024) (User: )
Description: Shim database version C:\Windows\Microsoft.NET\Framework\v4.0.30319 doesn't have a matching runtime directory

Error: (02/06/2019 05:22:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program RogueKiller.exe version 13.1.4.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: c78

Start Time: 01d4be1202d0ba6a

Termination Time: 31

Application Path: C:\Program Files\RogueKiller\RogueKiller.exe

Report Id: 9c6d6f52-2a05-11e9-b88b-00e04c1be86a

Error: (02/06/2019 04:56:24 PM) (Source: SetupARService) (EventID: 0) (User: )
Description: Service cannot be started. System.NullReferenceException: Object reference not set to an instance of an object.
   at SetupAfterRebootService.SetupARService.OnStart(String[] args)
   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (02/06/2019 04:56:11 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Event-ID 0


System errors:
=============
Error: (02/06/2019 07:32:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NVIDIA Display Driver Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/06/2019 07:20:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The NVIDIA Update Service Daemon service failed to start due to the following error:
The service did not start due to a logon failure.

Error: (02/06/2019 07:20:46 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:
Logon failure: the specified account password has expired.


To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (02/06/2019 07:18:48 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Realtek DHCP Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/06/2019 07:18:46 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cdrom

Error: (02/06/2019 07:18:31 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Intel(R) Driver & Support Assistant service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (02/06/2019 07:18:31 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Driver & Support Assistant service to connect.

Error: (02/06/2019 07:18:30 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Netlogon service depends on the Workstation service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.


Windows Defender:
===================================
Date: 2019-02-03 15:05:16.717
Description:
Windows Defender scan has been stopped before completion.
Scan ID:{A7FC4C05-DD82-4814-B2C9-BACE45D4CABF}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan

CodeIntegrity:
===================================

Date: 2019-02-04 14:28:09.994
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe because the set of per-page image hashes could not be found on the system.

Date: 2019-02-04 14:28:09.978
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe because the set of per-page image hashes could not be found on the system.

Date: 2019-02-04 14:28:09.947
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe because the set of per-page image hashes could not be found on the system.

Date: 2019-02-04 14:28:09.931
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe because the set of per-page image hashes could not be found on the system.

Date: 2019-02-04 14:27:08.557
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe because the set of per-page image hashes could not be found on the system.

Date: 2019-02-04 14:27:08.557
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe because the set of per-page image hashes could not be found on the system.

Date: 2019-02-04 14:27:08.541
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe because the set of per-page image hashes could not be found on the system.

Date: 2019-02-04 14:27:08.526
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz
Percentage of memory in use: 64%
Total physical RAM: 2046.18 MB
Available physical RAM: 729.07 MB
Total Virtual: 4092.36 MB
Available Virtual: 2809.26 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:27.53 GB) (Free:6.16 GB) NTFS
Drive d: (I) (Fixed) (Total:125.66 GB) (Free:19.01 GB) NTFS

\\?\Volume{5c975244-dbb4-11dd-aa16-806e6f6e6963}\ () (Fixed) (Total:0.2 GB) (Free:0.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 153.4 GB) (Disk ID: E313B4CC)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=27.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=125.7 GB) - (Type=05)

==================== End of Addition.txt ============================

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI