17 min read
Thanks for the update.
You have been very enterprising in your attempts to run the programmes and glad you succeeded with Panda. When you're up and running, you should notice an improvement in performance.
I'll wait to hear from you.
Satchfan
Hi Satshfan
Unable to update Emsisoft (I believe updates no longer supported for XP) But ran scan and attached is the following log.
Computer is just as slow as at the start of posts.
Emsisoft Anti-Malware - Version 10.0.0.5735
Last update: N/A
Initiated by: SNNECCI\Susan Bailey
Scan settings:
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
Detect PUPs: On
Scan archives: Off
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off
Scan start: 01/04/2020 01:47:11
C:\Documents and Settings\Susan Bailey\Start Menu\Programs\free registry cleaner Application.AdStart (A)
C:\Program Files\eusing free registry cleaner Application.AppInstall (A)
C:\Documents and Settings\Susan Bailey\Favorites\entertainment\music.url Adware.Win32.Gipho (A)
Scanned 73969
Found 3
Scan end: 01/04/2020 02:21:46
Scan time: 0:34:35
Regards Christopher.
Hi Christopher.
You did not choose Quarantine selected objects. You'll need to run it again and allow it to quarantine what it found.
As for the slowness, this is not to do with malware. You need more memory and, of what little you have, there is 74% of it in use.
That said, I noticed a couple of entries in your logs that I could have included in the 'fix'. Could you please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.
Logs to include with next post:
New Emsisoft log
New Frst.txt
New Addition.txt
Thanks
Hi Satchfan
Here are your logs with a screen shot as well. Emsisoft Anti-Malware - Version 10.0.0.5735
Last update: N/A
Initiated by: SNNECCI\Susan Bailey
Scan settings:
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
Detect PUPs: On
Scan archives: Off
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off
Scan start: 02/04/2020 01:16:55
C:\Documents and Settings\Susan Bailey\Start Menu\Programs\free registry cleaner Application.AdStart (A)
C:\Documents and Settings\Susan Bailey\Application Data\drivercure Application.AppInstall (A)
C:\Program Files\eusing free registry cleaner Application.AppInstall (A)
Scanned 74527
Found 3
Scan end: 02/04/2020 01:45:13
Scan time: 0:28:18
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-03-2020
Ran by [removed] (administrator) on SNNECCI (NEC Computers International PB EASYNOTE) (03-04-2020 01:03:00)
Running from C:\Documents and Settings\[removed]\Desktop
[removed]
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
() [File not signed] C:\Program Files\NETGEAR\WNDA3200\WifiDevChkSvc.exe
(BillP Studios -> BillP Studios) C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
(Microsoft Corporation -> Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Windows Component Publisher -> Microsoft Corporation) C:\WINDOWS\system32\alg.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(NETGEAR) [File not signed] C:\Program Files\NETGEAR\WNDA3200\WNDA3200WPSMgr.exe
(Panda Security S.L. -> Panda Security, S.L.) C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security S.L. -> Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe
(Panda Security S.L. -> Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe
(Panda Security S.L. -> Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe
(Silicon Integrated Systems Corporation) [File not signed] C:\WINDOWS\system32\sistray.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [230976 2006-06-28] (BillP Studios -> BillP Studios)
HKLM\…\Run: [PSUAMain] => C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe [165120 2019-10-16] (Panda Security S.L. -> Panda Security, S.L.)
HKLM\…\Run: [emsisoft anti-malware] => c:\program files\emsisoft anti-malware\a2guard.exe [5836888 2015-09-30] (Emsisoft Ltd -> Emsisoft Ltd)
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2009-09-03] (SUPERAntiSpyware.com)
HKLM\…\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKLM\…\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKLM\Software\Microsoft\Active Setup\Installed Components: [<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] -> C:\WINDOWS\system32\ieudinit.exe [2009-03-08] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] -> C:\WINDOWS\inf\unregmp2.exe [2007-06-26] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] -> C:\WINDOWS\system32\shmgrate.exe [2008-04-14] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] ->
HKLM\Software\Microsoft\Active Setup\Installed Components: [{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] ->
HKLM\Software\Microsoft\Active Setup\Installed Components: [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] -> C:\Program Files\Outlook Express\setup50.exe [2008-04-14] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] -> C:\WINDOWS\system32\advpack.dll [2009-03-08] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{5945c046-1e7d-11d1-bc44-00c04fd912be}] -> C:\WINDOWS\system32\advpack.dll [2009-03-08] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] -> C:\WINDOWS\system32\advpack.dll [2009-03-08] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{7790769C-0471-11d2-AF11-00C04FA35D02}] -> C:\Program Files\Outlook Express\setup50.exe [2008-04-14] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\Software\…\Winlogon\GPExtensions: [{C631DF4C-088F-4156-B058-4375F0853CD8}] -> C:\WINDOWS\System32\cscui.dll [2008-04-14] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\Software\…\Winlogon\GPExtensions: [{c6dc5466-785a-11d2-84d0-00c04fb169f7}] -> appmgmts.dll
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WNDA3200 Smart Wizard.lnk [2020-03-28]
ShortcutTarget: NETGEAR WNDA3200 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WNDA3200\WNDA3200WPSMgr.exe (NETGEAR) [File not signed]
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk [2010-03-27]
ShortcutTarget: Utility Tray.lnk -> C:\WINDOWS\system32\sistray.exe (Silicon Integrated Systems Corporation) [File not signed]
==================== Scheduled Tasks=============================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Low Battery Alarm Program.job => Fv Susan Bailey
Task: C:\WINDOWS\Tasks\Registration reminder 2.job => C:\WINDOWS\System32\OOBE\oobebaln.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{2C701731-EB7A-4A7B-9340-49C9500B2197}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{9B28CDC3-FD26-469C-BF68-25E03755861C}: [DhcpNameServer] [removed] [removed]
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
SearchScopes: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.co.uk/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7&rlz;=1I7GGLL_en
SearchScopes: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.co.uk/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7&rlz;=1I7GGLL_en
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2020-03-18] (Google Inc -> Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2020-03-18] (Google Inc -> Google Inc.)
Toolbar: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2020-03-18] (Google Inc -> Google Inc.)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1198058148886
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} hxxp://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll [2004-01-29] (Microsoft Corporation) [File not signed]
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll [2004-01-29] (Microsoft Corporation) [File not signed]
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll [2004-01-29] (Microsoft Corporation) [File not signed]
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll [2004-01-29] (Microsoft Corporation) [File not signed]
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll [2004-01-29] (Microsoft Corporation) [File not signed]
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL [2000-04-19] (Microsoft Corporation) [File not signed]
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll [2004-01-29] (Microsoft Corporation) [File not signed]
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll [2004-01-29] (Microsoft Corporation) [File not signed]
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2011-11-03] (Skype Technologies SA -> Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Documents and Settings\Susan Bailey\Application Data\Mozilla\Firefox\Profiles\81603wpo.default [2020-04-02]
FF Extension: (Microsoft .NET Framework Assistant) - C:\Documents and Settings\Susan Bailey\Application Data\Mozilla\Firefox\Profiles\81603wpo.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2020-03-19] [Legacy] [not signed]
FF Extension: (Java Console) - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009-06-11] [Legacy] [not signed]
FF HKLM\…\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-03] [Legacy] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_32_0_0_344.dll [2020-03-19] (Adobe Inc. -> ) [File not signed]
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
FF Plugin: [removed]/YahooActiveXPluginBridge;version=1.0.0.1 -> C:\Program Files\Yahoo!\Common\npyaxmpb.dll [No File]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox-branding.js [2012-11-06]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox-l10n.js [2012-11-06]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox.js [2012-11-06]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\reporter.js [2012-11-06]
Chrome:
=======
CHR HKLM\…\Chrome\Extension: [fcbhdhpamoencpdogjnmnbjddipfkpad]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [7084784 2015-09-30] (Emsisoft Ltd -> Emsisoft Ltd)
S3 AdobeFlashPlayerUpdateSvc; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2020-03-19] (Adobe Inc. -> Adobe) [File not signed]
S3 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [67360 2010-01-25] (Adobe Systems Incorporated -> NOS Microsystems Ltd.)
S3 jswpsapi; C:\Program Files\NETGEAR\WNDA3200\jswpsapi.exe [360529 2009-11-05] (Atheros Communications, Inc.) [File not signed]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4753104 2018-05-09] (Malwarebytes Corporation -> Malwarebytes)
R2 NanoServiceMain; C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe [109536 2019-10-16] (Panda Security S.L. -> Panda Security, S.L.)
R2 PandaAgent; C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe [84176 2019-02-19] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSUAService; C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe [48784 2019-10-16] (Panda Security S.L. -> Panda Security, S.L.)
S3 ServiceLayer; C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe [637952 2009-06-02] (Nokia.) [File not signed]
S3 SwPrv; C:\WINDOWS\System32\dllhost.exe /Processid:{6B1C53D3-3752-41EB-8F0A-7DB80BFD7AA4} [5120 2008-04-14] (Microsoft Windows Component Publisher -> Microsoft Corporation)
R2 WDCS_WNDA3200; C:\Program Files\NETGEAR\WNDA3200\WifiDevChkSvc.exe [167936 2010-06-23] () [File not signed]
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 abp480n5; C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS [23552 2001-08-17] (Microsoft Windows Component Publisher -> Microsoft Corporation)
R0 AliIde; C:\WINDOWS\System32\DRIVERS\aliide.sys [5248 2001-08-17] (Microsoft Windows Component Publisher -> Acer Laboratories Inc.)
R0 amdagp; C:\WINDOWS\System32\DRIVERS\amdagp.sys [43008 2008-04-13] (Microsoft Windows Component Publisher -> Advanced Micro Devices, Inc.)
R1 Asapi; C:\Windows\System32\Drivers\Asapi.sys [11264 2002-08-06] (VOB Computersysteme GmbH) [File not signed]
R0 asc; C:\WINDOWS\System32\DRIVERS\asc.sys [26496 2001-08-17] (Microsoft Windows Component Publisher -> Advanced System Products, Inc.)
R0 asc3550; C:\WINDOWS\System32\DRIVERS\asc3550.sys [14848 2001-08-17] (Microsoft Windows Component Publisher -> Advanced System Products, Inc.)
R2 ASCTRM; C:\Windows\System32\Drivers\ASCTRM.sys [8552 2004-07-10] (Windows (R) 2000 DDK provider) [File not signed]
R0 CmdIde; C:\WINDOWS\System32\DRIVERS\cmdide.sys [6656 2001-08-17] (Microsoft Windows Component Publisher -> CMD Technology, Inc.)
R0 dac2w2k; C:\WINDOWS\System32\DRIVERS\dac2w2k.sys [179584 2001-08-17] (Microsoft Windows Component Publisher -> Mylex Corporation)
R1 epp32; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp32.sys [114200 2015-09-30] (Emsisoft Ltd -> Emsisoft GmbH)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae.sys [128736 2018-04-26] (Malwarebytes Corporation -> Malwarebytes)
S3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2008-04-13] (Microsoft Windows Component Publisher -> Microsoft Corporation)
S3 INQ1usbser; C:\WINDOWS\System32\DRIVERS\INQ1usbser.sys [103680 2008-03-20] (Microsoft Windows Hardware Compatibility Publisher -> AMOI Incorporated)
R3 JSWSCIMD; C:\WINDOWS\System32\DRIVERS\jswscimd.sys [57440 2008-09-25] (Microsoft Windows Hardware Compatibility Publisher -> Atheros Communications, Inc.)
R2 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [148600 2020-03-21] (Malwarebytes Corporation -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [40160 2020-03-31] (Malwarebytes Corporation -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [220896 2020-03-31] (Malwarebytes Corporation -> Malwarebytes)
R1 moufiltr; C:\Windows\System32\Drivers\moufiltr.sys [9548 2003-01-23] (Windows (R) 2000 DDK provider) [File not signed]
R0 mraid35x; C:\WINDOWS\System32\DRIVERS\mraid35x.sys [17280 2001-08-17] (Microsoft Windows Component Publisher -> American Megatrends Inc.)
S3 ms_mpu401; C:\WINDOWS\System32\drivers\msmpu401.sys [2944 2001-08-17] (Microsoft Windows Component Publisher -> Microsoft Corporation)
R3 Mtlmnt5; C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys [226288 2003-10-29] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 Mtlstrm; C:\WINDOWS\System32\DRIVERS\Mtlstrm.sys [1299976 2003-11-04] (Microsoft Windows Hardware Compatibility Publisher -> )
R1 NNSALPC; C:\WINDOWS\System32\DRIVERS\NNSAlpc.sys [103840 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSDNS; C:\WINDOWS\System32\DRIVERS\NNSDns.sys [105656 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSHTTP; C:\WINDOWS\System32\DRIVERS\NNSHttp.sys [212776 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSHTTPS; C:\WINDOWS\System32\DRIVERS\NNSHttps.sys [125104 2019-03-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSIDS; C:\WINDOWS\System32\DRIVERS\NNSIds.sys [141712 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R3 NNSNAHS; C:\WINDOWS\System32\DRIVERS\NNSNAHS.sys [64656 2017-10-10] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPICC; C:\WINDOWS\System32\DRIVERS\NNSPicc.sys [143888 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPIHS; C:\WINDOWS\System32\DRIVERS\NNSPihs.sys [64840 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPOP3; C:\WINDOWS\System32\DRIVERS\NNSPop3.sys [130888 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPROT; C:\WINDOWS\System32\DRIVERS\NNSProt.sys [326576 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPRV; C:\WINDOWS\System32\DRIVERS\NNSPrv.sys [242384 2019-05-30] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSSMTP; C:\WINDOWS\System32\DRIVERS\NNSSmtp.sys [118016 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSSTRM; C:\WINDOWS\System32\DRIVERS\NNSStrm.sys [276368 2019-05-30] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSTLSC; C:\WINDOWS\System32\DRIVERS\NNSTlsc.sys [116992 2019-03-05] (Panda Security S.L. -> Panda Security, S.L.)
S3 NtMtlFax; C:\WINDOWS\System32\DRIVERS\NtMtlFax.sys [180368 2003-10-29] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [1897408 2004-08-04] (Microsoft Windows Component Publisher -> NVIDIA Corporation)
U5 P3; C:\Windows\System32\Drivers\P3.sys [42752 2008-04-13] (Microsoft Windows Component Publisher -> Microsoft Corporation)
R2 PSINAflt; C:\WINDOWS\System32\DRIVERS\PSINAflt.sys [251096 2019-06-06] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINFile; C:\WINDOWS\System32\DRIVERS\PSINFile.sys [133848 2019-06-04] (Panda Security S.L. -> Panda Security, S.L.)
R1 PSINKNC; C:\WINDOWS\System32\DRIVERS\psinknc.sys [188504 2019-03-04] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINProc; C:\WINDOWS\System32\DRIVERS\PSINProc.sys [133848 2019-06-04] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINProt; C:\WINDOWS\System32\DRIVERS\PSINProt.sys [145496 2019-06-06] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINReg; C:\WINDOWS\System32\DRIVERS\PSINReg.sys [119000 2019-06-04] (Panda Security S.L. -> Panda Security, S.L.)
R3 PSKMAD; C:\WINDOWS\System32\DRIVERS\PSKMAD.sys [60592 2017-05-22] (Panda Security S.L. -> Panda Security, S.L.)
R3 Ptilink; C:\WINDOWS\System32\DRIVERS\ptilink.sys [17792 2002-08-29] (Microsoft Windows Component Publisher -> Parallel Technologies, Inc.)
R0 PxHelp20; C:\WINDOWS\System32\DRIVERS\PxHelp20.sys [17232 2003-08-27] (Sonic Solutions) [File not signed]
R0 ql1080; C:\WINDOWS\System32\DRIVERS\ql1080.sys [40320 2001-08-17] (Microsoft Windows Component Publisher -> QLogic Corporation)
R0 ql12160; C:\WINDOWS\System32\DRIVERS\ql12160.sys [45312 2001-08-17] (Microsoft Windows Component Publisher -> QLogic Corporation)
R0 ql1280; C:\WINDOWS\System32\DRIVERS\ql1280.sys [49024 2001-08-17] (Microsoft Windows Component Publisher -> QLogic Corporation)
R0 RecAgent; C:\WINDOWS\System32\DRIVERS\RecAgent.sys [14160 2003-10-29] (Microsoft Windows Hardware Compatibility Publisher -> )
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com -> SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com -> SUPERAdBlocker.com and SUPERAntiSpyware.com)
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Windows Component Publisher -> Microsoft Corporation)
S3 Secdrv; C:\WINDOWS\System32\DRIVERS\secdrv.sys [20480 2007-11-13] (Microsoft Windows Component Publisher -> Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
R3 SiS315; C:\WINDOWS\System32\DRIVERS\sisgrp.sys [436608 2004-02-27] (Microsoft Windows Hardware Compatibility Publisher -> Silicon Integrated Systems Corporation)
R0 sisagp; C:\WINDOWS\System32\DRIVERS\SISAGPX.sys [36992 2003-07-18] (Microsoft Windows Hardware Compatibility Publisher -> Silicon Integrated Systems Corporation)
R1 SiSkp; C:\WINDOWS\System32\drivers\srvkp.sys [11648 2004-02-27] (Microsoft Windows Hardware Compatibility Publisher -> Silicon Integrated Systems Corporation)
R3 SISNIC; C:\WINDOWS\System32\DRIVERS\sisnic.sys [32256 2002-07-11] (Microsoft Windows Hardware Compatibility Publisher -> SiS Corporation)
R3 Slntamr; C:\WINDOWS\System32\DRIVERS\slntamr.sys [566256 2003-11-09] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 SlNtHal; C:\WINDOWS\System32\DRIVERS\Slnthal.sys [87656 2003-10-29] (Microsoft Windows Hardware Compatibility Publisher -> )
R3 SlWdmSup; C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys [15712 2003-10-29] (Microsoft Windows Hardware Compatibility Publisher -> )
R0 Sparrow; C:\WINDOWS\System32\DRIVERS\sparrow.sys [19072 2001-08-17] (Microsoft Windows Component Publisher -> Adaptec, Inc.)
R0 symc810; C:\WINDOWS\System32\DRIVERS\symc810.sys [16256 2001-08-17] (Microsoft Windows Component Publisher -> Symbios Logic Inc.)
R0 symc8xx; C:\WINDOWS\System32\DRIVERS\symc8xx.sys [32640 2001-08-17] (Microsoft Windows Component Publisher -> LSI Logic)
R0 sym_hi; C:\WINDOWS\System32\DRIVERS\sym_hi.sys [28384 2001-08-17] (Microsoft Windows Component Publisher -> LSI Logic)
R0 sym_u3; C:\WINDOWS\System32\DRIVERS\sym_u3.sys [30688 2001-08-17] (Microsoft Windows Component Publisher -> LSI Logic)
R3 SynTP; C:\WINDOWS\System32\DRIVERS\SynTP.sys [180064 2004-03-05] (Microsoft Windows Hardware Compatibility Publisher -> Synaptics, Inc.)
U5 Tcpip6; C:\Windows\System32\Drivers\Tcpip6.sys [226880 2010-02-11] (Microsoft Windows Component Publisher -> Microsoft Corporation)
R0 ultra; C:\WINDOWS\System32\DRIVERS\ultra.sys [36736 2001-08-17] (Microsoft Windows Component Publisher -> Promise Technology, Inc.)
R1 UsbFltr; C:\Windows\System32\Drivers\UsbFltr.sys [6144 2003-02-19] (Waytech Development, Inc.) [File not signed]
R3 VIAudio; C:\WINDOWS\System32\drivers\viaudios.sys [115840 2004-02-11] (Microsoft Windows Hardware Compatibility Publisher -> VIA Technologies, Inc.)
R3 wanatw; C:\WINDOWS\System32\DRIVERS\wanatw4.sys [33588 2003-01-10] (Microsoft Windows Hardware Compatibility Publisher -> America Online, Inc.)
S1 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [31744 2008-04-13] (Microsoft Windows Component Publisher -> Microsoft Corporation)
S3 ZDPSp50; C:\WINDOWS\System32\Drivers\ZDPSp50.sys [17664 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 AR9271; system32\DRIVERS\athuw.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) ===================
(If an entry is included in the fixlist, the file/folder will be moved.)
2020-04-03 01:03 - 2020-04-03 01:24 - 000025337 _____ C:\Documents and Settings\Susan Bailey\Desktop\FRST.txt
2020-04-01 02:21 - 2020-04-01 02:21 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\Emsisoft
2020-03-31 22:43 - 2020-03-31 22:43 - 000040160 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2020-03-28 12:41 - 2020-03-28 12:41 - 000000769 _____ C:\Documents and Settings\All Users\Desktop\Emsisoft Anti-Malware.lnk
2020-03-28 12:41 - 2020-03-28 12:41 - 000000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Emsisoft Anti-Malware
2020-03-28 12:39 - 2020-04-03 00:58 - 000000000 ____D C:\Program Files\Emsisoft Anti-Malware
2020-03-28 12:36 - 2020-03-30 02:29 - 178422448 _____ (Emsisoft Ltd. ) C:\Documents and Settings\Susan Bailey\Desktop\emsisoft-anti-malware-10-0-0-5735-multi-win.exe
2020-03-28 01:27 - 2020-03-29 00:00 - 000256354 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
2020-03-28 01:27 - 2020-03-28 01:27 - 000256354 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1391219076-2454486130-4279418029-1006-0.dat
2020-03-28 00:31 - 2020-03-28 00:31 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Application Data\Panda Security
2020-03-28 00:28 - 2017-05-22 11:29 - 000060592 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2020-03-28 00:27 - 2020-03-31 22:27 - 000065536 _____ C:\WINDOWS\system32\config\Nano.evt
2020-03-28 00:26 - 2020-03-28 11:16 - 000002012 _____ C:\Documents and Settings\All Users\Desktop\Panda Dome.lnk
2020-03-28 00:26 - 2020-03-28 00:26 - 000000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Panda Dome
2020-03-28 00:25 - 2020-03-28 00:33 - 000000000 ____D C:\Program Files\Panda Security
2020-03-27 23:42 - 2020-03-30 00:31 - 002261616 _____ (Panda Security, S.L.) C:\Documents and Settings\Susan Bailey\Desktop\PANDAFREEAV.exe
2020-03-27 23:42 - 2020-03-28 00:33 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\Panda Security
2020-03-27 15:17 - 2020-03-31 22:35 - 000220896 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2020-03-27 00:21 - 2020-03-27 00:21 - 000002012 _____ C:\Documents and Settings\Susan Bailey\Desktop\a2settings.ini
2020-03-27 00:21 - 2020-03-27 00:21 - 000000064 _____ C:\Documents and Settings\Susan Bailey\Desktop\a2whitelist.ini
2020-03-27 00:11 - 2020-03-28 03:03 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Desktop\bin64
2020-03-27 00:11 - 2020-03-28 03:03 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Desktop\bin32
2020-03-26 18:45 - 2020-03-28 01:25 - 000000000 ____D C:\EEK
2020-03-24 19:04 - 2020-03-24 19:23 - 028853240 _____ (Adlice Software ) C:\Documents and Settings\Susan Bailey\Desktop\RogueKiller.exe
2020-03-23 22:32 - 2020-03-23 22:32 - 000000000 ____D C:\Documents and Settings\Default User\Local Settings\Application Data\CEF
2020-03-23 22:32 - 2020-03-23 22:32 - 000000000 ____D C:\Documents and Settings\Default User\Application Data\AVG
2020-03-23 22:21 - 2020-03-23 22:22 - 000000000 ____D C:\Documents and Settings\Default User\Local Settings\Application Data\AVG
2020-03-22 14:15 - 2020-03-22 14:15 - 000000058 _____ C:\Documents and Settings\Susan Bailey\Desktop\New Wave Sound.wav
2020-03-21 21:48 - 2020-04-03 01:06 - 000000000 ____D C:\FRST
2020-03-21 21:46 - 2020-03-21 21:46 - 002008064 _____ (Farbar) C:\Documents and Settings\Susan Bailey\Desktop\FRST.exe
2020-03-21 18:38 - 2020-03-21 18:38 - 000009618 _____ C:\Documents and Settings\Susan Bailey\Desktop\malwarebytesScan.txt
2020-03-21 16:54 - 2020-03-21 16:54 - 000148600 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2020-03-21 16:52 - 2020-03-21 16:52 - 000001718 _____ C:\Documents and Settings\All Users\Desktop\Malwarebytes.lnk
2020-03-21 16:52 - 2020-03-21 16:52 - 000000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes
2020-03-21 16:52 - 2018-04-26 06:36 - 000128736 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae.sys
2020-03-21 16:51 - 2020-03-21 16:51 - 000000000 ____D C:\Program Files\Malwarebytes
2020-03-21 16:51 - 2020-03-21 16:51 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2020-03-21 16:45 - 2020-03-21 16:47 - 076534856 _____ (Malwarebytes ) C:\Documents and Settings\Susan Bailey\Desktop\mb3-setup-legacywos-3.5.1.2522-1.0.365-1.0.5292.exe
2020-03-21 03:36 - 2020-03-21 03:36 - 000008658 _____ C:\Documents and Settings\Susan Bailey\Desktop\AdwCleaner[C0].txt
2020-03-21 03:07 - 2020-03-21 03:27 - 000000000 ____D C:\AdwCleaner
2020-03-21 03:03 - 2020-03-21 03:03 - 004110280 _____ C:\Documents and Settings\Susan Bailey\Desktop\adwcleaner_6.047.exe
2020-03-19 20:54 - 2020-03-19 20:54 - 000000000 ____D C:\Documents and Settings\LocalService\Application Data\Macromedia
2020-03-19 01:12 - 2020-03-19 01:12 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Application Data\Apple Computer
2020-03-19 00:23 - 2020-03-19 00:23 - 000000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\AVG
2020-03-18 21:40 - 2020-03-18 21:40 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Application Data\AVG
2020-03-18 21:27 - 2020-03-18 21:27 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Application Data\TuneUp Software
2020-03-18 21:26 - 2020-03-18 21:26 - 000001457 _____ C:\Documents and Settings\All Users\Desktop\eBay Turbo Lister 2.lnk
2020-03-18 21:05 - 2020-03-27 16:41 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData
2020-03-18 21:05 - 2020-03-18 21:05 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\MFAData
2020-03-18 20:42 - 2020-03-27 17:45 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\AvgSetupLog
2020-03-18 18:55 - 2020-03-27 16:41 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\Avg
2020-03-18 18:55 - 2020-03-18 18:55 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\CEF
2020-03-18 18:49 - 2020-03-27 18:27 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\Avg
2020-03-18 15:33 - 2013-07-03 03:12 - 000025088 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hidparse.sys
2020-03-18 15:31 - 2013-07-17 01:58 - 000123008 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbvideo.sys
2020-03-18 15:30 - 2014-02-26 02:59 - 000013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\xp_eos.exe
2020-03-18 15:30 - 2014-02-26 02:59 - 000013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xp_eos.exe
2020-03-18 15:30 - 2013-08-09 01:55 - 000144128 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbport.sys
2020-03-18 15:30 - 2013-08-09 01:55 - 000005376 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbd.sys
2020-03-18 15:30 - 2009-03-18 12:02 - 000030336 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbehci.sys
2020-03-18 14:37 - 2020-04-02 21:58 - 000032586 _____ C:\WINDOWS\SchedLgU.Txt
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2020-04-03 01:24 - 2004-10-22 18:12 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Temp
2020-04-03 00:58 - 2010-02-12 02:52 - 000000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2020-04-03 00:49 - 2013-08-31 20:07 - 000000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2020-04-02 19:58 - 2010-02-12 02:52 - 000000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2020-03-31 22:29 - 2002-09-19 20:49 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2020-03-31 22:26 - 2004-10-22 18:12 - 000000178 ___SH C:\Documents and Settings\Susan Bailey\ntuser.ini
2020-03-31 22:26 - 2004-10-22 18:12 - 000000000 ____D C:\Documents and Settings\Susan Bailey
2020-03-31 20:22 - 2002-09-19 20:37 - 000568748 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2020-03-31 12:57 - 2002-09-19 20:26 - 000001170 _____ C:\WINDOWS\system32\wpa.dbl
2020-03-28 23:28 - 2002-09-19 20:34 - 000000000 ___HD C:\WINDOWS\inf
2020-03-28 23:27 - 2012-11-06 23:10 - 000000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\NETGEAR WNDA3200 Smart Wizard
2020-03-28 22:43 - 2004-10-21 15:29 - 000009690 _____ C:\WINDOWS\ModemLog_Smart Link 56K Modem.txt
2020-03-28 22:28 - 2006-07-05 10:36 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Desktop\Utilities
2020-03-28 13:22 - 2007-05-31 12:17 - 000000000 ____D C:\WINDOWS\network diagnostic
2020-03-28 13:19 - 2007-06-01 00:02 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\Google
2020-03-28 11:05 - 2002-09-19 20:36 - 000270984 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2020-03-28 01:26 - 2009-07-25 11:00 - 000000664 _____ C:\WINDOWS\system32\d3d9caps.dat
2020-03-28 00:33 - 2004-10-22 20:41 - 000058824 _____ C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2020-03-28 00:31 - 2012-12-10 02:24 - 000000000 ____D C:\WINDOWS\system32\GroupPolicy
2020-03-27 21:34 - 2004-10-30 00:42 - 000000000 ____D C:\Documents and Settings\Susan Bailey\My Documents\My Downloads
2020-03-21 17:13 - 2002-09-19 20:53 - 000000000 __SHD C:\Documents and Settings\LocalService
2020-03-19 20:53 - 2013-08-31 20:07 - 000842296 _____ (Adobe) C:\WINDOWS\system32\FlashPlayerApp.exe
2020-03-19 20:53 - 2012-11-03 23:17 - 000175160 _____ (Adobe) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2020-03-19 20:51 - 2002-09-19 20:46 - 000000000 ____D C:\WINDOWS\system32\Macromed
2020-03-19 12:58 - 2004-10-26 21:29 - 000000000 __SHD C:\Documents and Settings\Susan Bailey\UserData
2020-03-18 22:31 - 2004-10-22 18:12 - 000001602 _____ C:\Documents and Settings\Susan Bailey\Start Menu\Programs\Remote Assistance.lnk
2020-03-18 21:22 - 2012-11-29 16:35 - 000000000 ____D C:\Documents and Settings\All Users\eBay
2020-03-18 20:51 - 2010-02-02 00:51 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\avg9
2020-03-18 16:30 - 2002-09-19 20:34 - 000000000 ____D C:\WINDOWS\system32\dllcache
2020-03-18 14:06 - 2008-04-15 16:15 - 000000000 ____D C:\Documents and Settings\Susan Bailey\My Documents\MyBackups
2020-03-18 13:40 - 2007-05-31 23:59 - 000000000 ____D C:\Program Files\Google
2020-03-18 13:32 - 2010-02-13 03:17 - 000000000 ____D C:\Documents and Settings\Susan Bailey\My Documents\Arri Excel
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 22-03-2020
Ran by [removed] (03-04-2020 01:28:15)
Running from C:\Documents and Settings\[removed]\Desktop
Microsoft Windows XP Home Edition Service Pack 3 (X86) (2004-10-21 15:06:26)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1391219076-2454486130-4279418029-500 - Administrator - Enabled)
ASPNET (S-1-5-21-1391219076-2454486130-4279418029-1010 - Limited - Enabled)
Guest (S-1-5-21-1391219076-2454486130-4279418029-501 - Limited - Disabled)
HelpAssistant (S-1-5-21-1391219076-2454486130-4279418029-1005 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-1391219076-2454486130-4279418029-1002 - Limited - Disabled)
Susan Bailey (S-1-5-21-1391219076-2454486130-4279418029-1006 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Susan Bailey
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Malwarebytes (Enabled - Up to date) {D4AC7077-9720-47B0-8B38-DFAF3AA21DB6}
AV: Panda Dome (Enabled - Up to date) {5AD27692-540A-464E-B625-78275FA38393}
AV: Emsisoft Anti-Malware (Enabled - Out of date) {0F8591BB-342B-4493-91C3-4E948ED21255}
FW: ZoneAlarm Firewall (Disabled) {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Download Manager (HKLM\…\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}) (Version: 1.6.2.60 - NOS Microsystems Ltd.)
Adobe Flash Player 32 NPAPI (HKLM\…\Adobe Flash Player NPAPI) (Version: 32.0.0.344 - Adobe)
Adobe Flash Player ActiveX (HKLM\…\Adobe Flash Player ActiveX) (Version: 9.0.124.0 - Adobe Systems Incorporated)
Adobe Reader XI (HKLM\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
CCleaner (HKLM\…\CCleaner) (Version: 3.24 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Defraggler (HKLM\…\Defraggler) (Version: 2.11 - Piriform)
Emsisoft Anti-Malware (HKLM\…\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 10.0 - Emsisoft Ltd.)
Eraser (HKLM\…\{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}) (Version: 5.86 - Heidi Computers Ltd.) Hidden
Eraser (HKLM\…\Eraser) (Version: - Heidi Computers Ltd.)
GIMP 2.6.7 (HKLM\…\WinGimp-2.0_is1) (Version: - )
Google Toolbar for Internet Explorer (HKLM\…\{18455581-E099-4BA8-BC6B-F34B2F06600C}) (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (HKLM\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7210.1528 - Google Inc.)
IncrediMail Xe (HKLM\…\IncrediMail) (Version: - )
INQ1 Modem (HKLM\…\{65F6D129-8EB6-4DC1-A5C0-E5EB1C6755AB}) (Version: 1.10.0000 - amoi)
Labtec Mouse Software 2.0 (HKLM\…\{77E6239B-BF3B-496B-9634-2AC9589B61BB}) (Version: - )
Malwarebytes version 3.5.1.2522 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)
MetaTrader 4.00 (HKLM\…\{3E5CBADD-2E51-47C1-BBE2-B802DB6DA56A}) (Version: 4.00 - MetaQuotes Software Corp.)
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\…\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\…\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\…\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\…\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Base Smart Card Cryptographic Service Provider Package (HKLM\…\KB909520) (Version: - Microsoft Corporation)
Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\…\MSCompPackV1) (Version: 1 - Microsoft Corporation)
Microsoft Office 2000 Premium (HKLM\…\{00000409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft User-Mode Driver Framework Feature Pack 1.7 (HKLM\…\Wudf01007) (Version: - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Mozilla Firefox (3.6.28) (HKLM\…\Mozilla Firefox (3.6.28)) (Version: 3.6.28 (en-US) - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 6.0 Parser (KB933579) (HKLM\…\{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}) (Version: 6.10.1200.0 - Microsoft Corporation)
NETGEAR WNDA3200 wireless adapter Setup (HKLM\…\{9B02F55E-7E6B-4226-8E67-76514D33FD41}_is1) (Version: 1.0.0.11 - NETGEAR)
OpenOffice.org 3.0 (HKLM\…\{F44DA61E-720D-4E79-871F-F6E628B33242}) (Version: 3.0.9358 - OpenOffice.org)
Packard Bell Companion (HKLM\…\{09B44E78-A988-4BC0-962F-63ECD3333708}) (Version: 1.1.5.1 - Packard Bell) Hidden
Panda Devices Agent (HKLM\…\{DB0164A2-ADE9-4FEE-B080-D506BDD6427F}) (Version: 1.08.09 - Panda Security) Hidden
Panda Devices Agent (HKLM\…\Panda Devices Agent) (Version: 1.03.09 - Panda Security) Hidden
Panda Dome (HKLM\…\{02971888-3742-4F3B-B17B-49F4F1A72AE1}) (Version: 11.12.20 - Panda Security) Hidden
Panda Dome (HKLM\…\Panda Universal Agent Endpoint) (Version: 20.00.00.0000 - Panda Security)
PC Connectivity Solution (HKLM\…\{0C973594-7DDF-4BD0-84ED-3517F7622037}) (Version: 9.23.3.0 - Nokia)
Recuva (HKLM\…\Recuva) (Version: 1.37 - Piriform)
SiS 900 PCI Fast Ethernet Adapter Driver (HKLM\…\SiSLan) (Version: - )
SiS VGA Utilities (HKLM\…\SiS VGA Utilities) (Version: - )
Skype™ 5.10 (HKLM\…\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}) (Version: 5.10.116 - Skype Technologies S.A.)
Smart Defrag (HKLM\…\Smart Defrag_is1) (Version: 1.3.0 - IObit)
Sonic RecordNow! (HKLM\…\{9541FED0-327F-4DF0-8B96-EF57EF622F19}) (Version: 6.7.0 - Sonic Solutions)
SpywareBlaster 5.0 (HKLM\…\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
SUPERAntiSpyware (HKLM\…\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 4.41.1000 - SUPERAntiSpyware.com)
Turbo Lister 2 (HKLM\…\InstallShield_{69640730-B830-4C24-BB5C-222DA1260548}) (Version: 2.0.0 - eBay)
Tweak UI (HKLM\…\Tweak UI 2.10) (Version: - )
VC 9.0 Runtime (HKLM\…\{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}) (Version: 1.0.0 - Check Point Software Technologies Ltd) Hidden
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\…\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
Visual Studio 2012 x86 Redistributables (HKLM\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VoipCheap (HKLM\…\VoipCheap_is1) (Version: 2.09 build 321 - Finarea S.A. Switzerland)
WebFldrs XP (HKLM\…\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}) (Version: 9.50.6513 - Microsoft Corporation) Hidden
WinDirStat 1.1.2 (HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\WinDirStat) (Version: - )
Windows Driver Package - Amoi Incorporated (INQ1usbser) Modem (01/01/2007 2.0.5.0) (HKLM\…\75F6C4F084A18C2A71179397570DD3BE34BA2679) (Version: 01/01/2007 2.0.5.0 - Amoi Incorporated)
Windows Driver Package - Amoi Incorporated (INQ1usbser) Ports (01/01/2007 2.0.5.0) (HKLM\…\3448AA55E35CFBCE2DBCEED25E4046660049CDBD) (Version: 01/01/2007 2.0.5.0 - Amoi Incorporated)
Windows Genuine Advantage Notifications (KB905474) (HKLM\…\WgaNotify) (Version: 1.5.0532.0 - Microsoft Corporation)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\…\KB892130) (Version: - Microsoft Corporation)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\…\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\…\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Management Framework Core (HKLM\…\KB968930) (Version: - Microsoft Corporation)
Windows Media Format 11 runtime (HKLM\…\Windows Media Format Runtime) (Version: - )
Windows Media Player 11 (HKLM\…\Windows Media Player) (Version: - )
Windows XP Service Pack 3 (HKLM\…\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
WinPatrol (HKLM\…\WinPatrol) (Version: - )
ZoneAlarm Free Firewall (HKLM\…\ZoneAlarm Free Firewall) (Version: 11.0.768.000 - Check Point)
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Windows Component Publisher -> Microsoft Corporation)
SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Windows Component Publisher -> Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Windows -> Microsoft Corporation)
SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\System32\stobject.dll (Microsoft Windows Component Publisher -> Microsoft Corporation)
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Windows Component Publisher -> Microsoft Corporation)
ShellExecuteHooks: URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\system32\shell32.dll [8462848 2012-06-08] (Microsoft Windows Component Publisher -> Microsoft Corporation)
ContextMenuHandlers1: [Erasext] -> {8BE13461-936F-11D1-A87D-444553540000} => C:\WINDOWS\system32\erasext.dll [2007-12-23] (Heidi Computers Ltd -> -)
ContextMenuHandlers1: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => C:\Program Files\Panda Security\Panda Security Protection\PSUAShell.dll [2019-06-18] (Panda Security S.L. -> Panda Security, S.L.)
ContextMenuHandlers2: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU.DLL [2014-07-09] (Emsisoft GmbH -> Emsisoft GmbH)
ContextMenuHandlers2: [Erasext] -> {8BE13461-936F-11D1-A87D-444553540000} => C:\WINDOWS\system32\erasext.dll [2007-12-23] (Heidi Computers Ltd -> -)
ContextMenuHandlers3: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU.DLL [2014-07-09] (Emsisoft GmbH -> Emsisoft GmbH)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers5: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => C:\Program Files\Panda Security\Panda Security Protection\PSUAShell.dll [2019-06-18] (Panda Security S.L. -> Panda Security, S.L.)
ContextMenuHandlers6: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU.DLL [2014-07-09] (Emsisoft GmbH -> Emsisoft GmbH)
ContextMenuHandlers6: [Erasext] -> {8BE13461-936F-11D1-A87D-444553540000} => C:\WINDOWS\system32\erasext.dll [2007-12-23] (Heidi Computers Ltd -> -)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => C:\Program Files\Panda Security\Panda Security Protection\PSUAShell.dll [2019-06-18] (Panda Security S.L. -> Panda Security, S.L.)
==================== Codecs (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Drivers32: [msacm.trspch] => C:\WINDOWS\system32\tssoft32.acm [8192 2002-08-29] (Microsoft Windows Component Publisher -> DSP GROUP, INC.)
HKLM\…\Drivers32: [vidc.I420] => C:\WINDOWS\system32\msh263.drv [294912 2008-04-14] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\…\Drivers32: [vidc.iv31] => C:\WINDOWS\system32\ir32_32.dll [199168 2002-08-29] (Microsoft Windows Component Publisher -> )
HKLM\…\Drivers32: [vidc.iv32] => C:\WINDOWS\system32\ir32_32.dll [199168 2002-08-29] (Microsoft Windows Component Publisher -> )
HKLM\…\Drivers32: [msacm.msg723] => C:\WINDOWS\system32\msg723.acm [118784 2002-08-29] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\…\Drivers32: [vidc.M263] => C:\WINDOWS\system32\msh263.drv [294912 2008-04-14] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\…\Drivers32: [vidc.M261] => C:\WINDOWS\system32\msh261.drv [188416 2008-04-14] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\…\Drivers32: [msacm.msaudio1] => C:\WINDOWS\system32\msaud32.acm [282654 2009-09-01] (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\…\Drivers32: [msacm.sl_anet] => C:\WINDOWS\system32\sl_anet.acm [86016 2008-04-14] (Microsoft Windows Component Publisher -> Sipro Lab Telecom Inc.)
HKLM\…\Drivers32: [vidc.iv41] => C:\WINDOWS\system32\ir41_32.ax [848384 2008-04-14] (Microsoft Windows Component Publisher -> Intel Corporation)
HKLM\…\Drivers32: [msacm.iac2] => C:\WINDOWS\system32\iac25_32.ax [199680 2008-04-14] (Microsoft Windows Component Publisher -> Intel Corporation)
HKLM\…\Drivers32: [vidc.iv50] => C:\WINDOWS\system32\ir50_32.dll [755200 2008-04-14] (Microsoft Windows Component Publisher -> Intel Corporation)
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
WMI:subscription\__FilterToConsumerBinding->\\.\root\subscription:MSFT_UCScenarioControl.Name=\"Microsoft WMI Updating Consumer Scenario Control\"",Filter="\\.\root\subscription:__EventFilter.Name=\"Microsoft WMI Updating Consumer Scenario Control\"::
WMI:subscription\__EventFilter->Microsoft WMI Updating Consumer Scenario Control::[Query => SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'MSFT_UCScenario']
Shortcut: C:\Documents and Settings\Susan Bailey\NetHood\My Web Sites on MSN\target.lnk -> hxxp://www.msnusers.co
==================== Loaded Modules (Whitelisted) =============
2003-11-06 06:00 - 2003-11-06 06:00 - 000073728 _____ () [File not signed] c:\Apps\RecordNow\shlext.dll
2012-11-06 23:10 - 2010-08-24 16:18 - 000249856 _____ () [File not signed] C:\Program Files\NETGEAR\WNDA3200\WPSLib.dll
2009-11-15 19:42 - 2004-06-15 08:00 - 000116736 _____ (CANON INC.) [File not signed] C:\WINDOWS\system32\CNMLM61.DLL
2009-11-15 19:42 - 2004-06-15 08:00 - 000017920 _____ (CANON INC.) [File not signed] C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD61.DLL
2020-03-21 16:52 - 2018-05-01 12:10 - 001137152 _____ (Igor Pavlov) [File not signed] C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dll
2002-01-05 03:37 - 2002-01-05 03:37 - 000344064 _____ (Microsoft Corporation) [File not signed] c:\Apps\RecordNow\MSVCR70.dll
2004-01-29 15:08 - 2004-01-29 15:08 - 001277952 _____ (Microsoft Corporation) [File not signed] C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL
2004-01-29 15:08 - 2004-01-29 15:08 - 000086016 _____ (Microsoft Corporation) [File not signed] C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMWS.DLL
2011-05-13 21:04 - 2011-05-13 21:04 - 001101824 _____ (Microsoft Corporation) [File not signed] C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\MFC80.DLL
2011-05-13 20:45 - 2011-05-13 20:45 - 000057344 _____ (Microsoft Corporation) [File not signed] C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\MFC80ENU.DLL
2016-07-19 12:30 - 2016-07-19 12:30 - 000111296 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\CommsWrapper.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000088648 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Dispatcher.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000136504 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_Config.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000136528 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_Diagnosis.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000160712 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_Inventory.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000173584 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_Mobility.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000125704 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_Monitor.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000096352 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_NDKConfig.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000121584 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_Notifications.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000141696 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_Scheduler.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000227680 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Plugins\Plugin_Status.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000074704 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Util_CompressionService.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000069536 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Util_ConfigService.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000039184 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Util_LogService.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000055640 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Devices Agent\Util_NDKService.dll
2016-07-19 12:30 - 2016-07-19 12:30 - 000111296 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\CommsWrapper.dll
2017-01-17 08:46 - 2017-01-17 08:46 - 000383632 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\PSAEng.dll
2017-04-06 15:53 - 2017-04-06 15:53 - 000079360 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\pskcrt.dll
2017-04-06 15:53 - 2017-04-06 15:53 - 000061344 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\pskfcmp.dll
2017-04-06 15:56 - 2017-04-06 15:56 - 000474856 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\PSKSQLT.dll
2017-04-06 15:59 - 2017-04-06 15:59 - 000033528 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\psksrf.dll
2017-04-06 15:57 - 2017-04-06 15:57 - 000023232 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\pskstr.dll
2017-04-06 15:54 - 2017-04-06 15:54 - 000536120 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\pskxml.dll
2017-04-06 16:04 - 2017-04-06 16:04 - 000040208 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\putczip.dll
2017-04-09 21:21 - 2017-04-09 21:21 - 000040744 _____ (Panda Security S.L -> Panda Security, S.L.) [File not signed] C:\Program Files\Panda Security\Panda Security Protection\USBVacineDLL.dll
2012-11-06 23:10 - 2005-03-19 01:24 - 000102400 _____ (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed] C:\Program Files\NETGEAR\WNDA3200\W32N55.dll
2004-07-10 11:54 - 2004-02-27 04:04 - 000176128 ____N (Silicon Integrated Systems Corporation) [File not signed] C:\WINDOWS\system32\SiSApCom.dll
2008-07-29 15:43 - 2008-07-29 15:43 - 000596480 _____ (STLport Consulting, Inc.) [File not signed] C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\stlport_vc7145.dll
2008-08-28 15:56 - 2008-08-28 15:56 - 000357888 _____ (Sun Microsystems, Inc.) [File not signed] C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
2007-02-27 20:39 - 2007-02-27 20:39 - 000061440 _____ (SUPERAntiSpyware.com) [File not signed] C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL
2009-09-03 23:21 - 2009-09-03 23:21 - 000548352 _____ (SUPERAntiSpyware.com) [File not signed] C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
2020-03-28 12:39 - 2015-03-02 21:51 - 001125888 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\Emsisoft Anti-Malware\libeay32.dll
2020-03-28 12:39 - 2015-03-02 21:51 - 000283648 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\Emsisoft Anti-Malware\ssleay32.dll
2020-03-21 16:51 - 2018-01-18 17:16 - 000030208 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\iconengines\qsvgicon.dll
2020-03-21 16:51 - 2018-01-18 17:15 - 000024576 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qgif.dll
2020-03-21 16:51 - 2018-01-18 17:16 - 000031232 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qicns.dll
2020-03-21 16:51 - 2018-01-18 17:15 - 000025088 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qico.dll
2020-03-21 16:51 - 2018-01-18 17:15 - 000242688 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qjpeg.dll
2020-03-21 16:51 - 2018-01-18 17:16 - 000019968 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qsvg.dll
2020-03-21 16:51 - 2018-01-18 17:16 - 000018944 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qtga.dll
2020-03-21 16:51 - 2018-01-18 17:16 - 000318976 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qtiff.dll
2020-03-21 16:51 - 2018-01-18 17:16 - 000017920 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qwbmp.dll
2020-03-21 16:51 - 2018-01-18 17:16 - 000328704 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qwebp.dll
2020-03-21 16:51 - 2018-01-18 17:15 - 000993792 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\platforms\qwindows.dll
2020-03-21 16:51 - 2018-05-09 10:35 - 004809728 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll
2020-03-21 16:51 - 2018-01-18 17:12 - 005100032 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Gui.dll
2020-03-21 16:51 - 2018-01-18 17:10 - 002012672 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Network.dll
2020-03-21 16:51 - 2018-01-18 17:18 - 002522112 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Qml.dll
2020-03-21 16:51 - 2018-01-18 17:20 - 002570752 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Quick.dll
2020-03-21 16:51 - 2018-01-18 17:16 - 000247808 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Svg.dll
2020-03-21 16:51 - 2018-01-18 17:14 - 004482048 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Widgets.dll
2020-03-21 16:51 - 2018-01-18 17:24 - 000206336 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5WinExtras.dll
2020-03-21 16:51 - 2018-01-18 17:22 - 000013312 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\modelsplugin.dll
2020-03-21 16:51 - 2018-01-18 17:22 - 000013824 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\qtquick2plugin.dll
2020-03-21 16:51 - 2018-01-18 17:27 - 000698368 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\qtquickcontrolsplugin.dll
2020-03-21 16:51 - 2018-01-18 17:27 - 000173056 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\dialogplugin.dll
2020-03-21 16:51 - 2018-01-18 17:26 - 000069632 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts\qquicklayoutsplugin.dll
2020-03-21 16:51 - 2018-01-18 17:27 - 000097280 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\widgetsplugin.dll
2020-03-21 16:51 - 2018-01-18 17:22 - 000013312 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\windowplugin.dll
2020-03-21 16:51 - 2018-01-18 17:29 - 000102400 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\scenegraph\softwarecontext.dll
==================== Alternate Data Streams (Whitelisted) ========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 [119]
==================== Safe Mode (Whitelisted) ==================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UploadMgr => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
==================== Association (Whitelisted) =================
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
HKLM\…\batfile\DefaultIcon: %SystemRoot%\System32\shell32.dll,-153 <==== ATTENTION
==================== Internet Explorer trusted/restricted ==========
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\…\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\…\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\…\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\…\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\…\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\…\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\…\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\…\123simsen.com -> www.123simsen.com
IE restricted site: HKU\.DEFAULT\…\123topsearch.com -> www.123topsearch.com
IE restricted site: HKU\.DEFAULT\…\125sms.co.uk -> www.125sms.co.uk
There are 5356 more sites.
IE restricted site: HKU\S-1-5-19\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-19\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-19\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-19\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-19\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-19\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-19\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-19\…\1-extreme.biz -> www.1-extreme.biz
IE restricted site: HKU\S-1-5-19\…\1001-search.info -> www.1001-search.info
IE restricted site: HKU\S-1-5-19\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-19\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-19\…\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-19\…\123topsearch.com -> www.123topsearch.com
IE restricted site: HKU\S-1-5-19\…\132.com -> www.132.com
IE restricted site: HKU\S-1-5-19\…\136136.net -> down.136136.net
IE restricted site: HKU\S-1-5-19\…\139mm.com -> www.139mm.com
IE restricted site: HKU\S-1-5-19\…\163.com -> www.163.com
IE restricted site: HKU\S-1-5-19\…\163ns.com -> ert0003.e76.163ns.com
IE restricted site: HKU\S-1-5-19\…\17-plus.com -> 17-plus.com
IE restricted site: HKU\S-1-5-19\…\171203.com -> 171203.com
There are 2043 more sites.
IE restricted site: HKU\S-1-5-20\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-20\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-20\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-20\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-20\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-20\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-20\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-20\…\1-extreme.biz -> www.1-extreme.biz
IE restricted site: HKU\S-1-5-20\…\1001-search.info -> www.1001-search.info
IE restricted site: HKU\S-1-5-20\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-20\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-20\…\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-20\…\123topsearch.com -> www.123topsearch.com
IE restricted site: HKU\S-1-5-20\…\132.com -> www.132.com
IE restricted site: HKU\S-1-5-20\…\136136.net -> down.136136.net
IE restricted site: HKU\S-1-5-20\…\139mm.com -> www.139mm.com
IE restricted site: HKU\S-1-5-20\…\163.com -> www.163.com
IE restricted site: HKU\S-1-5-20\…\163ns.com -> ert0003.e76.163ns.com
IE restricted site: HKU\S-1-5-20\…\17-plus.com -> 17-plus.com
IE restricted site: HKU\S-1-5-20\…\171203.com -> 171203.com
There are 2043 more sites.
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\100sexlinks.com -> 100sexlinks.com
There are 5613 more sites.
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2002-09-19 20:26 - 2008-06-06 18:25 - 000249518 _____ C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.1001-search.info
127.0.0.1 1001-search.info
127.0.0.1 www.100888290cs.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
127.0.0.1 www.123topsearch.com
127.0.0.1 123topsearch.com
127.0.0.1 www.132.com
127.0.0.1 132.com
127.0.0.1 www.136136.net
127.0.0.1 136136.net
127.0.0.1 www.139mm.com
127.0.0.1 139mm.com
127.0.0.1 www.163ns.com
127.0.0.1 163ns.com
127.0.0.1 171203.com
There are 8693 more lines.
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files\Nokia\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\COMMON~1\TVNAVI~1;"C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier";C:\WINDOWS\system32\WindowsPowerShell\v1.0
HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
DNS Servers: [removed] - [removed]
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName3 -> C:\WINDOWS\system32\ipconf.tsp (Microsoft Windows Component Publisher -> Microsoft Corporation)
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName4 -> C:\WINDOWS\system32\h323.tsp (Microsoft Windows Component Publisher -> Microsoft Corporation)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(If an entry is included in the fixlist, it will be removed.)
MSCONFIG\startupreg: MSMSGS => "C:\Program Files\Messenger\msmsgs.exe" /background
MSCONFIG\startupreg: RealTray => C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
MSCONFIG\startupreg: SiSUSBRG => C:\WINDOWS\SiSUSBrg.exe
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
DomainProfile\AuthorizedApplications: [C:\Program Files\MSN Messenger\msnmsgr.exe] => Enabled:MSN Messenger 7.5
StandardProfile\AuthorizedApplications: [C:\Program Files\IncrediMail\bin\IncMail.exe] => Enabled:IncrediMail
StandardProfile\AuthorizedApplications: [C:\Program Files\IncrediMail\bin\IMApp.exe] => Enabled:IncrediMail
StandardProfile\AuthorizedApplications: [C:\Program Files\Messenger\msmsgs.exe] => Enabled:Windows Messenger
StandardProfile\AuthorizedApplications: [C:\Program Files\VoipCheap\VoipCheap.exe] => Enabled:VoipCheap
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\ZoneLabs\vsmon.exe] => Enabled:vsmon
StandardProfile\AuthorizedApplications: [C:\Program Files\Skype\Phone\Skype.exe] => Enabled:Skype
StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgmfapx.exe] => Enabled:AVG Installer
StandardProfile\AuthorizedApplications: [C:\Program Files\Emsisoft Anti-Malware\a2start.exe] => Enabled:Emsisoft Anti-Malware
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\sistray.exe] => Enabled:Utility Tray
StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22007
StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22008
==================== Restore Points =========================
31-03-2020 21:13:24 System Checkpoint
01-04-2020 21:33:29 System Checkpoint
02-04-2020 22:33:31 System Checkpoint
==================== Faulty Device Manager Devices ============
==================== Event log errors: ========================
Application errors:
==================
Error: (04/03/2020 01:52:18 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: Invalid algorithm specified.
Error: (04/03/2020 01:52:17 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: Invalid algorithm specified.
Error: (04/03/2020 01:52:17 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: Invalid algorithm specified.
Error: (04/03/2020 01:52:17 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: Invalid algorithm specified.
Error: (04/03/2020 01:47:07 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: Invalid algorithm specified.
Error: (04/03/2020 01:47:07 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: Invalid algorithm specified.
Error: (04/03/2020 01:47:06 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: Invalid algorithm specified.
Error: (04/03/2020 01:46:59 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: Invalid algorithm specified.
System errors:
=============
Error: (04/02/2020 04:26:45 PM) (Source: W32Time) (EventID: 34) (User: )
Description: The time service has detected that the system time needs to be
changed by +172544 seconds. The time service will not change the system
time by more than +54000 seconds. Verify that your time and time zone
are correct, and that the time source time.windows.com (ntp.m|0x1|192.168.0.27:123->51.105.208.173:123) is working properly.
Error: (03/31/2020 10:30:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
Error: (03/31/2020 01:45:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Presentation Foundation Font Cache 4.0.0.0 service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (03/31/2020 01:45:08 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Timeout (30000 milliseconds) waiting for the Windows Presentation Foundation Font Cache 4.0.0.0 service to connect.
Error: (03/31/2020 01:03:21 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Panda Product Service service hung on starting.
Error: (03/31/2020 12:58:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
Error: (03/29/2020 12:07:53 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Panda Product Service service hung on starting.
Error: (03/29/2020 12:03:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
==================== Memory info ===========================
BIOS: Insyde Software INSYDE - 1 09/02/2002
Motherboard: NEC Computers International Titan N
Processor: Intel(R) Celeron(R) CPU 2.80GHz
Percentage of memory in use: 82%
Total physical RAM: 703.48 MB
Available physical RAM: 121.47 MB
Total Virtual: 2530.66 MB
Available Virtual: 219.28 MB
==================== Drives ================================
Drive c: (HDD) (Fixed) (Total:33.25 GB) (Free:13.98 GB) NTFS ==>[drive with boot components (Windows XP)]
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (Size: 37.3 GB) (Disk ID: E02AE02A)
Partition 1: (Not Active) - (Size=4 GB) - (Type=1B)
Partition 2: (Active) - (Size=33.2 GB) - (Type=07 NTFS)
==================== End of Addition.txt =======================
Regards Christopher
OK thanks. It's 2:05am here in the UK and I'm off for sleep so I'll be in touch tomorrow.
Nina
Run Farbar Recovery Scan Tool
Open notepad, (Start >All Programs > Accessories > Notepad). Please copy the entire contents of the code box below and paste it into Notepad.
CloseProcesses:
HKLM\…\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKLM\Software\Microsoft\Active Setup\Installed Components: [{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] ->
HKLM\Software\Microsoft\Active Setup\Installed Components: [{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] ->
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Registration reminder 2.job => C:\WINDOWS\System32\OOBE\oobebaln.exe
FF Plugin: [removed]/YahooActiveXPluginBridge;version=1.0.0.1 -> C:\Program Files\Yahoo!\Common\npyaxmpb.dll [No File]
C:\Program Files\Yahoo!
S3 AR9271; system32\DRIVERS\athuw.sys [X]
2020-03-24 19:04 - 2020-03-24 19:23 - 028853240 _____ (Adlice Software ) C:\Documents and Settings\Susan Bailey\Desktop\RogueKiller.exe
2020-03-23 22:32 - 2020-03-23 22:32 - 000000000 ____D C:\Documents and Settings\Default User\Local Settings\Application Data\CEF
2020-03-23 22:32 - 2020-03-23 22:32 - 000000000 ____D C:\Documents and Settings\Default User\Application Data\AVG
2020-03-23 22:21 - 2020-03-23 22:22 - 000000000 ____D C:\Documents and Settings\Default User\Local Settings\Application Data\AVG
2020-03-19 00:23 - 2020-03-19 00:23 - 000000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\AVG
2020-03-18 21:40 - 2020-03-18 21:40 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Application Data\AVG
2020-03-18 21:27 - 2020-03-18 21:27 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Application Data\TuneUp Software
2020-03-18 21:05 - 2020-03-27 16:41 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData
2020-03-18 21:05 - 2020-03-18 21:05 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\MFAData
2020-03-18 20:42 - 2020-03-27 17:45 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\AvgSetupLog
2020-03-18 18:55 - 2020-03-27 16:41 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\Avg
2020-03-18 18:55 - 2020-03-18 18:55 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\CEF
2020-03-18 18:49 - 2020-03-27 18:27 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\Avg
2020-04-03 00:58 - 2010-02-12 02:52 - 000000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2020-04-03 00:49 - 2013-08-31 20:07 - 000000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2020-04-02 19:58 - 2010-02-12 02:52 - 000000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2020-03-18 20:51 - 2010-02-02 00:51 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\avg9
AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 [119]
HKLM\…\batfile\DefaultIcon: %SystemRoot%\System32\shell32.dll,-153 <==== ATTENTION
StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgmfapx.exe] => Enabled:AVG Installer
CMD: ipconfig /flushdns
EmptyTemp:
NOTE: this script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
================================================
Run AVG removal tool
There are still be some remnants of AVG on your computer so please download AVG Removal Tool from here.
================================================
Remove Firefox extensions
================================================
Run Farbar Recovery Scan Tool
drivercure;free registry cleaner;eusing registry cleaner
Logs to include in the next post:
Fixlog.txt
Search.txt
Nina
Hi Satchfan
Feeling like we are making progress. Here are your two logs. Also is there a programme that completely removes all traces of IncrediMail
Fix result of Farbar Recovery Scan Tool (x86) Version: 22-03-2020
Ran by [removed] (05-04-2020 11:53:03) Run:3
Running from C:\Documents and Settings\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
fixlist content:
*****************
CloseProcesses:
HKLM\…\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\…\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKLM\Software\Microsoft\Active Setup\Installed Components: [{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] ->
HKLM\Software\Microsoft\Active Setup\Installed Components: [{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] ->
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Registration reminder 2.job => C:\WINDOWS\System32\OOBE\oobebaln.exe
FF Plugin: [removed]/YahooActiveXPluginBridge;version=1.0.0.1 -> C:\Program Files\Yahoo!\Common\npyaxmpb.dll [No File]
C:\Program Files\Yahoo!
S3 AR9271; system32\DRIVERS\athuw.sys [X]
2020-03-24 19:04 - 2020-03-24 19:23 - 028853240 _____ (Adlice Software ) C:\Documents and Settings\Susan Bailey\Desktop\RogueKiller.exe
2020-03-23 22:32 - 2020-03-23 22:32 - 000000000 ____D C:\Documents and Settings\Default User\Local Settings\Application Data\CEF
2020-03-23 22:32 - 2020-03-23 22:32 - 000000000 ____D C:\Documents and Settings\Default User\Application Data\AVG
2020-03-23 22:21 - 2020-03-23 22:22 - 000000000 ____D C:\Documents and Settings\Default User\Local Settings\Application Data\AVG
2020-03-19 00:23 - 2020-03-19 00:23 - 000000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\AVG
2020-03-18 21:40 - 2020-03-18 21:40 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Application Data\AVG
2020-03-18 21:27 - 2020-03-18 21:27 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Application Data\TuneUp Software
2020-03-18 21:05 - 2020-03-27 16:41 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData
2020-03-18 21:05 - 2020-03-18 21:05 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\MFAData
2020-03-18 20:42 - 2020-03-27 17:45 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\AvgSetupLog
2020-03-18 18:55 - 2020-03-27 16:41 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\Avg
2020-03-18 18:55 - 2020-03-18 18:55 - 000000000 ____D C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\CEF
2020-03-18 18:49 - 2020-03-27 18:27 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\Avg
2020-04-03 00:58 - 2010-02-12 02:52 - 000000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2020-04-03 00:49 - 2013-08-31 20:07 - 000000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2020-04-02 19:58 - 2010-02-12 02:52 - 000000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2020-03-18 20:51 - 2010-02-02 00:51 - 000000000 ____D C:\Documents and Settings\All Users\Application Data\avg9
AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 [119]
HKLM\…\batfile\DefaultIcon: %SystemRoot%\System32\shell32.dll,-153 <==== ATTENTION
StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgmfapx.exe] => Enabled:AVG Installer
CMD: ipconfig /flushdns
EmptyTemp:
*****************
Processes closed successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\LinkResolveIgnoreLinkInfo" => removed successfully.
"HKU\S-1-5-21-1391219076-2454486130-4279418029-1006\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\LinkResolveIgnoreLinkInfo" => removed successfully.
HKLM\Software\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} => removed successfully.
HKLM\Software\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} => removed successfully.
C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\WINDOWS\Tasks\Registration reminder 2.job => moved successfully
HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1 => removed successfully.
C:\Program Files\Yahoo! => moved successfully
HKLM\System\CurrentControlSet\Services\AR9271 => removed successfully.
AR9271 => service removed successfully.
C:\Documents and Settings\Susan Bailey\Desktop\RogueKiller.exe => moved successfully
C:\Documents and Settings\Default User\Local Settings\Application Data\CEF => moved successfully
C:\Documents and Settings\Default User\Application Data\AVG => moved successfully
C:\Documents and Settings\Default User\Local Settings\Application Data\AVG => moved successfully
C:\Documents and Settings\LocalService\Local Settings\Application Data\AVG => moved successfully
C:\Documents and Settings\Susan Bailey\Application Data\AVG => moved successfully
C:\Documents and Settings\Susan Bailey\Application Data\TuneUp Software => moved successfully
C:\Documents and Settings\All Users\Application Data\MFAData => moved successfully
C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\MFAData => moved successfully
C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\AvgSetupLog => moved successfully
C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\Avg => moved successfully
C:\Documents and Settings\Susan Bailey\Local Settings\Application Data\CEF => moved successfully
C:\Documents and Settings\All Users\Application Data\Avg => moved successfully
"C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job" => not found
"C:\WINDOWS\Tasks\Adobe Flash Player Updater.job" => not found
"C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job" => not found
C:\Documents and Settings\All Users\Application Data\avg9 => moved successfully
C:\Documents and Settings\All Users\Application Data\TEMP => ":5C321E34" ADS removed successfully.
HKLM\Software\Classes\batfile\DefaultIcon\\"Default"="%SystemRoot%\System32\shell32.dll,-153" => value restored successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\AVG\Av\avgmfapx.exe" => removed successfully.
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
=========== EmptyTemp: ==========
BITS transfer queue => 10381 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache => 42529 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/dllcache/drivers => 60201914 B
Edge => 0 B
Chrome => 0 B
Firefox => 6560802 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Documents and Settings => 0 B
Default User => 66228 B
All Users => 66228 B
systemprofile => 66228 B
LocalService => 66920 B
NetworkService => 133148 B
Susan Bailey => 444014630 B
RecycleBin => 1488138731 B
EmptyTemp: => 1.9 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 12:02:56 ====
Farbar Recovery Scan Tool (x86) Version: 22-03-2020
Ran by [removed] (05-04-2020 23:57:09)
Running from C:\Documents and Settings\[removed]\Desktop
Boot Mode: Normal
================== Search Files: "drivercure;free registry cleaner;eusing registry cleaner" =============
====== End of Search ======
Regards Christopher
there a programme that completely removes all traces of IncrediMail
Don't believe every 'removal' tool you find on the Internet. If you don't want Incredimail, we can easily remove it.
How are things and what remaining problems?
It has again been 3 days since I heard from you.
If I hear nothing within 24 hours, I'll assume that all is now well and mark this topic as 'solved'
Nina
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI