1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved N

Discussion in 'Malware and Virus Removal' started by dodopie, 2017/02/08.

Page 1 of 2
  1. 2017/02/08
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    now my desktop is acting crazy like it won't type in the title block, only got the letter n. it is also going into safe mode and also any site i go to is acting crazy.
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-02-2017
    Ran by Tori (administrator) on TORI-PC (08-02-2017 12:19:37)
    Running from C:\Users\Tori\Desktop
    Loaded Profiles: Tori (Available Profiles: IUSR_NMPR & Tori)
    Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (Dropbox, Inc.) C:\WINDOWS\System32\DbxSvc.exe
    () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehrecvr.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehsched.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    (Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
    () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    (Conexant Systems, Inc.) C:\WINDOWS\System32\drivers\XAudio.exe
    (Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    (Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    (Realtek Semiconductor) C:\WINDOWS\RtHDVCpl.exe
    (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
    (Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxsrvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
    (Logitech Inc.) C:\Program Files\Logitech\Logitech Vid\Vid.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    (NETGEAR) C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    () C:\Program Files\NETGEAR\WNA1100\WNA1100.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
    (Google Inc.) C:\Program Files\Google\Update\1.3.32.7\GoogleCrashHandler.exe
    (Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    () C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
    (Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Hewlett-Packard Company) C:\hp\KBD\kbd.exe
    (Yahoo! Inc.) C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
    HKLM\...\Run: [hpsysdrv] => c:\hp\support\hpsysdrv.exe [65536 2006-09-28] (Hewlett-Packard Company)
    HKLM\...\Run: [KBD] => C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
    HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-11-15] (Intel Corporation)
    HKLM\...\Run: [CCUTRAYICON] => FactoryMode
    HKLM\...\Run: [] => [X]
    HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-10-14] (Hewlett-Packard)
    HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
    HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4390912 2007-03-01] (Realtek Semiconductor)
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1311312 2010-06-25] (Logitech, Inc.)
    HKLM\...\Run: [hpqSRMon] => [X]
    HKLM\...\Run: [Search Protection] => C:\ProgramData\Search Protection\SearchProtection.exe
    HKLM\...\Run: [jswtrayutil] => "C:\Program Files\NETGEAR\WNA1100\jswtrayutil.exe"
    HKLM\...\Run: [SBRegRebootCleaner] => "C:\Program Files\Ad-Aware Antivirus\SBRC.exe"
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-15] (AVAST Software)
    HKLM\...\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [26220296 2017-02-06] (Dropbox, Inc.)
    HKLM\...\RunOnce: [Launcher] => C:\Windows\SMINST\launcher.exe [44168 2007-03-07] (soft thinks)
    HKLM\...\Policies\Explorer: [MemCheckBoxInRunDlg] 1
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Logitech Vid] => C:\Program Files\Logitech\Logitech Vid\Vid.exe [5458704 2009-07-16] (Logitech Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\MountPoints2: {5f63f7cd-6535-11e3-911a-001bfca58000} - F:\LGAutoRun.exe
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\MountPoints2: {b226832a-3248-11e3-aec1-001bfca58000} - F:\LGAutoRun.exe
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\MountPoints2: {cfb38aad-3cad-11e4-953b-001bfca58000} - F:\LG_PC_Programs.exe
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [221184 2008-01-19] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-08-30] (AVAST Software)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2012-03-17]
    ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WN111v2 Smart Wizard.lnk [2013-08-18]
    ShortcutTarget: NETGEAR WN111v2 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WN111v2\WN111v2.exe (NETGEAR)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Smart Wizard.lnk [2016-06-07]
    ShortcutTarget: NETGEAR WNA1100 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WNA1100\WNA1100.exe ()
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk [2007-04-21]
    ShortcutTarget: Snapfish Media Detector.lnk -> C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe ()
    Startup: C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2009-10-31]
    ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
    Startup: C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk [2010-10-24]
    ShortcutTarget: ZooskMessenger.lnk -> C:\Program Files\ZooskMessenger\ZooskMessenger.exe (No File)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{2E0AA886-5EBF-401D-B070-6204C97B6624}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{435B15BB-F8C5-4712-9E94-F75174A18D50}: [DhcpNameServer] 208.59.247.45 208.59.247.46
    Tcpip\..\Interfaces\{5D2835A6-C339-499D-A5C8-A58D50CBC840}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{7F33EFC5-70C0-4B52-B39A-8F7FCDA6A7AD}: [DhcpNameServer] 75.114.81.1 75.114.81.2
    Tcpip\..\Interfaces\{FE880611-5A3F-4E43-8528-9B371CDA42BE}: [DhcpNameServer] 65.32.5.111 65.32.5.112

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=8
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yahoo.com/?ilc=8
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hxxp://www.yahoo.com/?ilc=8.yahoo.com
    SearchScopes: HKLM -> DefaultScope {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&query={searchTerms}&invocationType=tb50-ie-aol-chromesbox-en-us&tb_uuid=20101015151855842&tb_oid=15-10-2010&tb_mrud=15-07-2011
    SearchScopes: HKLM -> {24FDD0CA-702A-485E-8F15-9F28ADAA3BA4} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
    SearchScopes: HKLM -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
    SearchScopes: HKLM -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&query={searchTerms}&invocationType=tb50-ie-aol-chromesbox-en-us&tb_uuid=20101015151855842&tb_oid=15-10-2010&tb_mrud=15-07-2011
    SearchScopes: HKLM -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=HVDUS7
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> DefaultScope {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {24FDD0CA-702A-485E-8F15-9F28ADAA3BA4} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=chr-tyc-inbox
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL =
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://www.bing.com/search?FORM=UP94DF&PC=UP94&dt=072313&q={searchTerms}&src=IE-SearchBox
    BHO: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4EFB-9B51-7695ECA05670} -> C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2013-05-10] (Yahoo! Inc.)
    BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23] (Adobe Systems Incorporated)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-20] (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-10-24] (AVAST Software)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-20] (Oracle Corporation)
    Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2013-05-10] (Yahoo! Inc.)
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

    FireFox:
    ========
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: (Microsoft .NET Framework Assistant) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-10-22] [not signed]
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-08-30]
    FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
    FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-08-30]
    FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-20] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-20] (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @real.com/nppl3260;version=6.0.11.2571 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprjplug;version=1.0.2.2629 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 -> C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll [2006-03-31] (RealNetworks, Inc.)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
    FF Plugin: @viewpoint.com/VMP -> C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll [2004-02-20] ()

    Chrome:
    =======
    CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}
    CHR DefaultSearchKeyword: Default -> yahoo.com
    CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}
    CHR Profile: C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default [2017-02-08]
    CHR Extension: (ConvertAnyFile) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\elldknmoogdfipmglklpbkoppgeipbfa [2016-10-02]
    CHR Extension: (Avast Online Security) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-12-15]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-18]
    CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
    CHR HKLM\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files\adawaretb\chrome-newtab-search.crx <not found>

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation) [File not signed]
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-08-30] (AVAST Software)
    S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [40256 2017-02-06] (Dropbox, Inc.)
    R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] () [File not signed]
    R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [139264 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 IAANTMON; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [81920 2006-11-15] (Intel Corporation) [File not signed]
    S3 IDriverT; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
    S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation) [File not signed]
    S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 jswpsapi; C:\Program Files\NETGEAR\WNA1100\jswpsapi.exe [960992 2010-03-22] (Atheros Communications, Inc.)
    R2 LightScribeService; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
    S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-09-01] () [File not signed]
    S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation) [File not signed]
    R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
    R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
    S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation) [File not signed]
    S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
    R2 WSWNA1100; C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe [266240 2010-08-04] () [File not signed]

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34008 2016-08-30] (AVAST Software)
    R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [35096 2016-08-30] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [92256 2016-08-30] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [64272 2016-08-30] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [60424 2016-08-30] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [735488 2016-09-13] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [433768 2016-09-22] (AVAST Software)
    R3 aswStmXP; C:\Windows\system32\drivers\aswStmXP.sys [184592 2016-08-30] (AVAST Software)
    S3 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [66688 2016-08-30] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [224752 2016-10-13] (AVAST Software)
    R3 athur; C:\Windows\System32\DRIVERS\athur.sys [1439744 2010-10-10] (Atheros Communications, Inc.)
    S3 DNIMp50; C:\Windows\System32\Drivers\DNIMp50.sys [21504 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    S3 DNISp50; C:\Windows\System32\Drivers\DNISp50.sys [20480 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-06-29] (GFI Software)
    S3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE2500vista.sys [1073216 2011-03-30] (Broadcom Corporation)
    R3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25752 2009-10-07] ()
    S3 LVUSBSta; C:\Windows\System32\drivers\lvusbsta.sys [41248 2006-12-15] (Logitech Inc.)
    R1 SBRE; C:\Windows\system32\drivers\SBREDrv.sys [101720 2011-11-01] (Sunbelt Software)
    R0 SCMNdisP; C:\Windows\System32\DRIVERS\scmndisp.sys [21728 2007-01-19] (Windows (R) Codename Longhorn DDK provider)
    S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)
    S3 WN111v2; C:\Windows\System32\DRIVERS\WN111v2v.sys [453120 2009-01-13] (Atheros Communications, Inc.)
    S3 AndNetDiag; system32\DRIVERS\lgandnetdiag.sys [X]
    S3 ANDNetModem; system32\DRIVERS\lgandnetmodem.sys [X]
    S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
    S3 dbx; system32\DRIVERS\dbx.sys [X]
    S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
    S3 LVcKap; system32\DRIVERS\LVcKap.sys [X]
    S3 LVMVDrv; system32\DRIVERS\LVMVDrv.sys [X]
    S3 LVRS; system32\DRIVERS\lvrs.sys [X]
    S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
    S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
    S3 pepifilter; system32\DRIVERS\lv302af.sys [X]
    S3 PID_PEPI; system32\DRIVERS\LV302V32.SYS [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-02-08 12:19 - 2017-02-08 12:21 - 00024082 _____ C:\Users\Tori\Desktop\FRST.txt
    2017-02-08 12:19 - 2017-02-08 12:19 - 00000000 ____D C:\FRST
    2017-02-08 12:18 - 2017-02-08 12:17 - 01763328 _____ (Farbar) C:\Users\Tori\Desktop\FRST.exe
    2017-02-07 18:29 - 2017-02-07 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
    2017-02-06 23:38 - 2017-02-06 23:38 - 00040256 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
    2017-02-06 23:38 - 2017-02-06 23:38 - 00035440 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
    2017-02-06 23:38 - 2017-02-06 23:38 - 00035440 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
    2017-02-06 23:38 - 2017-02-06 23:38 - 00035440 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
    2017-01-28 06:34 - 2017-01-28 06:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    2017-01-27 16:22 - 2017-01-27 16:22 - 00044544 _____ C:\Users\Tori\Downloads\tori (2).pdf
    2017-01-27 16:22 - 2017-01-27 16:22 - 00044544 _____ C:\Users\Tori\Downloads\tori (1).pdf
    2017-01-27 15:59 - 2017-01-27 15:59 - 00044544 _____ C:\Users\Tori\Downloads\tori.pdf
    2017-01-15 12:16 - 2017-01-15 12:16 - 00000000 ___HD C:\Windows\system32\CanonIJ Uninstaller Information
    2017-01-15 12:16 - 2017-01-15 12:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP280 series
    2017-01-15 12:15 - 2017-01-15 12:15 - 00000000 ___HD C:\ProgramData\CanonBJ
    2017-01-15 12:03 - 2010-03-18 19:25 - 00307200 _____ (CANON INC.) C:\Windows\system32\CNC280L.dll
    2017-01-15 12:03 - 2010-03-18 17:12 - 01335296 _____ (CANON INC.) C:\Windows\system32\CNC280C.dll
    2017-01-15 12:03 - 2010-03-18 17:12 - 00114688 _____ (CANON INC.) C:\Windows\system32\CNC280I.dll
    2017-01-15 12:03 - 2010-03-18 17:11 - 00106496 _____ (CANON INC.) C:\Windows\system32\CNC280U.dll
    2017-01-15 11:21 - 2017-01-15 11:21 - 00211640 _____ C:\Windows\Minidump\Mini011517-01.dmp
    2017-01-11 03:15 - 2017-01-05 11:57 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-02-08 12:20 - 2015-12-01 11:47 - 00000892 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
    2017-02-08 12:16 - 2006-11-02 07:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    2017-02-08 12:16 - 2006-11-02 07:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    2017-02-08 11:55 - 2015-12-01 11:51 - 00000000 ___RD C:\Users\Tori\Dropbox
    2017-02-08 11:54 - 2016-07-26 20:50 - 00000000 ___RD C:\Users\Tori\Desktop\****
    2017-02-08 11:53 - 2015-12-01 11:47 - 00000888 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
    2017-02-08 11:53 - 2007-04-21 06:29 - 00000000 ____D C:\Windows\SMINST
    2017-02-08 11:51 - 2006-11-02 08:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2017-02-08 11:51 - 2006-11-02 07:37 - 00000000 ___RD C:\Users\Public\Recorded TV
    2017-02-08 11:50 - 2015-12-01 11:47 - 00000000 ____D C:\Program Files\Dropbox
    2017-02-08 11:49 - 2013-06-29 12:04 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
    2017-02-07 15:30 - 2013-06-29 12:02 - 00000384 _____ C:\Windows\Tasks\Ad-Aware Update (Weekly).job
    2017-02-06 15:44 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\inf
    2017-02-06 15:44 - 2006-11-02 05:33 - 00778466 _____ C:\Windows\system32\PerfStringBackup.INI
    2017-01-28 06:34 - 2013-06-29 11:24 - 00000000 ____D C:\Program Files\Google
    2017-01-27 16:40 - 2009-10-31 13:28 - 00012414 _____ C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2017-01-15 12:14 - 2009-10-20 09:11 - 00000000 ____D C:\Users\Tori
    2017-01-15 11:21 - 2014-08-20 18:28 - 281032561 _____ C:\Windows\MEMORY.DMP
    2017-01-15 11:21 - 2010-06-05 14:08 - 00000000 ____D C:\Windows\Minidump
    2017-01-11 03:35 - 2006-11-02 08:01 - 00032556 _____ C:\Windows\Tasks\SCHEDLGU.TXT
    2017-01-11 03:15 - 2013-09-06 15:18 - 00000000 ____D C:\Windows\system32\MRT
    2017-01-11 03:01 - 2006-11-02 05:24 - 133456224 ____C (Microsoft Corporation) C:\Windows\system32\mrt.exe
    2017-01-10 22:50 - 2013-06-29 12:04 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
    2017-01-10 22:50 - 2013-06-29 12:04 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
    2017-01-10 22:49 - 2007-04-21 05:54 - 00000000 ____D C:\Windows\system32\Macromed

    ==================== Files in the root of some directories =======

    2015-08-03 17:34 - 2015-08-03 17:34 - 6420480 _____ () C:\Program Files\GUT4441.tmp
    2010-10-24 07:32 - 2010-10-24 07:33 - 0000513 _____ () C:\Users\Tori\AppData\Roaming\com.zoosk.Desktop_state.xml
    2012-02-18 18:36 - 2012-02-18 18:36 - 0011248 _____ () C:\Users\Tori\AppData\Roaming\UserTile.png
    2009-10-31 13:28 - 2017-01-27 16:40 - 0012414 _____ () C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2010-02-10 16:43 - 2016-11-29 16:43 - 0052736 _____ () C:\Users\Tori\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2007-04-21 05:58 - 2016-07-14 10:11 - 0009390 _____ () C:\ProgramData\hpzinstall.log

    Some files in TEMP:
    ====================
    2015-12-09 09:00 - 2015-12-09 09:00 - 0071168 _____ () C:\Users\Tori\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyzd9or.dll
    2015-12-10 12:20 - 2015-12-10 12:22 - 0035680 _____ () C:\Users\Tori\AppData\Local\Temp\i4jdel0.exe
    2016-07-22 05:45 - 2016-07-22 05:45 - 0741440 _____ (Oracle Corporation) C:\Users\Tori\AppData\Local\Temp\jre-8u101-windows-au.exe
    2016-10-21 05:45 - 2016-10-21 05:45 - 0737856 _____ (Oracle Corporation) C:\Users\Tori\AppData\Local\Temp\jre-8u111-windows-au.exe
    2017-01-18 17:45 - 2017-01-18 17:45 - 0739904 _____ (Oracle Corporation) C:\Users\Tori\AppData\Local\Temp\jre-8u121-windows-au.exe
    2015-11-10 10:59 - 2015-11-10 10:59 - 0585824 _____ (Oracle Corporation) C:\Users\Tori\AppData\Local\Temp\jre-8u66-windows-au.exe
    2016-03-25 05:44 - 2016-03-25 05:44 - 0736320 _____ (Oracle Corporation) C:\Users\Tori\AppData\Local\Temp\jre-8u77-windows-au.exe
    2016-05-27 05:44 - 2016-05-27 05:45 - 0739904 _____ (Oracle Corporation) C:\Users\Tori\AppData\Local\Temp\jre-8u91-windows-au.exe
    2016-07-14 09:13 - 2016-07-14 09:13 - 0006144 _____ () C:\Users\Tori\AppData\Local\Temp\oibsklso.dll
    2016-08-19 12:52 - 2016-08-19 12:54 - 69030792 _____ (Dropbox, Inc.) C:\Users\Tori\AppData\Local\Temp\{5C25BDC2-F52F-4487-B062-808147B1C431}-DropboxClient_8.4.19.exe
    2016-09-19 23:52 - 2016-09-19 23:53 - 70542136 _____ (Dropbox, Inc.) C:\Users\Tori\AppData\Local\Temp\{B4AA6437-0D3B-48C1-89E1-B8B1C4DAFA07}-DropboxClient_10.4.26.exe

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2017-02-08 11:58

    ==================== End of FRST.txt ============================
    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 05-02-2017
    Ran by Tori (08-02-2017 12:21:48)
    Running from C:\Users\Tori\Desktop
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) (2009-10-20 17:03:37)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1137620820-469648318-63125674-500 - Administrator - Disabled)
    Guest (S-1-5-21-1137620820-469648318-63125674-501 - Limited - Enabled)
    IUSR_NMPR (S-1-5-21-1137620820-469648318-63125674-1000 - Limited - Disabled) => C:\Users\IUSR_NMPR
    Tori (S-1-5-21-1137620820-469648318-63125674-1001 - Administrator - Enabled) => C:\Users\Tori

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    2600 (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    2600_Help (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    2600Trb (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
    Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
    Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
    Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.0.3.13070 - Adobe Systems Inc.)
    Adobe Flash Player 24 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 24.0.0.194 - Adobe Systems Incorporated)
    Adobe Reader 8 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A80000000002}) (Version: 8.0.0 - Adobe Systems Incorporated)
    AIO_CDB_ProductContext (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    AIO_CDB_Software (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    AiO_Scan (Version: 43.0.217.000 - Hewlett-Packard) Hidden
    AIO_Scan (Version: 82.0.173.000 - Hewlett-Packard) Hidden
    AndroChef Java Decompiler (HKLM\...\{8DC30045-8565-492C-A6C4-30DEFF1169DE}) (Version: 1.0.0.12 - Atanas Neshkov)
    Avast Free Antivirus (HKLM\...\Avast) (Version: 12.3.2280 - AVAST Software)
    BufferChm (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version: - )
    Cards_Calendar_OrderGift_DoMorePlugout (Version: 1.00.0000 - Hewlett-Packard) Hidden
    CCleaner (HKLM\...\CCleaner) (Version: 3.15 - Piriform)
    Copy (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Destination Component (Version: 100.0.0.0 - Hewlett-Packard) Hidden
    DeviceDiscovery (Version: 100.0.190.000 - Hewlett-Packard) Hidden
    DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_ProductContext (Version: 100.0.215.000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_Software (Version: 100.0.206.000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_Software_Min (Version: 100.0.213.000 - Hewlett-Packard) Hidden
    DocProc (Version: 10.0.0.0 - Hewlett-Packard) Hidden
    Download Updater (AOL LLC) (HKLM\...\SoftwareUpdUtility) (Version: - ) <==== ATTENTION
    Dropbox (HKLM\...\Dropbox) (Version: 19.4.13 - Dropbox, Inc.)
    Dropbox Update Helper (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
    EE Full (HKLM\...\{C087A7EF-E572-4A39-B7EE-B1391B12D516}) (Version: 1.0.0.0 - )
    Enhanced Multimedia Keyboard Solution (HKLM\...\KBD) (Version: - Hewlett-Packard)
    eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
    Extension Changer (HKLM\...\Extension Changer) (Version: 0.5 - Yehia A.Salam)
    Fax (Version: 82.0.188.000 - Hewlett-Packard) Hidden
    Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
    Google Earth (HKLM\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
    Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.32.7 - Google Inc.) Hidden
    GPBaseService (Version: 100.0.187.000 - Hewlett-Packard) Hidden
    Hardware Diagnostic Tools (HKLM\...\PC-Doctor 5 for Windows) (Version: 5.00.4424.15 - PC-Doctor, Inc.)
    HP Advisor (HKLM\...\{73A43E42-3658-4DD9-8551-FACDA3632538}) (Version: 3.1.9152.3107 - Hewlett-Packard)
    HP Customer Experience Enhancements (HKLM\...\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}) (Version: 5.1.0.2264 - Hewlett-Packard)
    HP Customer Participation Program 10.0 (HKLM\...\HPExtendedCapabilities) (Version: 10.0 - HP)
    HP Deskjet F4200 All-In-One Driver Software 10.0 Rel .3 (HKLM\...\{AE9A67F9-ADF1-4a44-BAB5-C1DB302B37A2}) (Version: 10.0 - HP)
    HP Easy Setup - Frontend (HKLM\...\{40F7AED3-0C7D-4582-99F6-484A515C73F2}) (Version: 5.1.0.2269 - Hewlett-Packard)
    HP Imaging Device Functions 10.0 (HKLM\...\HP Imaging Device Functions) (Version: 10.0 - HP)
    HP On-Screen Cap/Num/Scroll Lock Indicator (HKLM\...\OsdMaestro) (Version: - Hewlett-Packard)
    HP Photosmart C4400 All-In-One Driver Software 10.0 Rel .3 (HKLM\...\{FF1F4E8E-A833-4c4b-A14A-45D5B841B5D8}) (Version: 10.0 - HP)
    HP Photosmart Essential (HKLM\...\{EB21A812-671B-4D08-B974-2A347F0D8F70}) (Version: 1.12.0.46 - HP)
    HP Photosmart Essential 2.5 (HKLM\...\HP Photosmart Essential) (Version: 2.5 - HP)
    HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B (HKLM\...\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}) (Version: 8.0 - HP)
    HP Smart Web Printing (HKLM\...\HP Smart Web Printing) (Version: 3.5 - HP)
    HP Solution Center 10.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 10.0 - HP)
    HP Update (HKLM\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
    HPPhotoSmartPhotobookWebPack1 (Version: 1.00.0000 - Hewlett-Packard) Hidden
    HPProductAssistant (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    HPSSupply (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
    Intel(R) Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - )
    Intel® Viiv™ Software (HKLM\...\Intel(R) Configuration Center) (Version: 1.6.361.6 - Intel Corporation)
    Java 8 Update 66 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
    LG PC Suite (HKLM\...\LG PC Suite) (Version: 5.3.25.20150529 - LG Electronics)
    LG United Mobile Drivers (HKLM\...\{4DE95ED9-0A29-4C4F-8463-35857CF9BA36}) (Version: 3.14.1 - LG Electronics)
    LightScribe 1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
    Logitech Legacy USB Camera Driver Package (HKLM\...\legacyqcam_10.50) (Version: 10.50.1091 - )
    Logitech SetPoint 6.15 (HKLM\...\SP6) (Version: 6.15.25 - Logitech)
    Logitech Vid (HKLM\...\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}) (Version: 1.10.1009 - Logitech Inc.)
    Logitech Webcam Software (HKLM\...\{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}) (Version: 12.10.1113 - Logitech Inc.)
    MarketResearch (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (HKLM\...\{90120000-00B2-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Works (HKLM\...\{6D52C408-B09A-4520-9B18-475B81D393F1}) (Version: 08.05.0818 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    muvee autoProducer 6.0 (HKLM\...\{6AF49698-949A-4C89-9B31-041D2CCB5FBD}) (Version: 6.00.050 - muvee Technologies)
    My HP Games (HKLM\...\WildTangent hpdesktop Master Uninstall) (Version: HPCMPQ1701 - WildTangent)
    NETGEAR WNA1100 N150 Wireless USB Adapter (HKLM\...\{A2AE9709-283B-4B48-AA34-729C070A62FB}) (Version: 1.0.0.133 - NETGEAR)
    OCR Software by I.R.I.S. 10.0 (HKLM\...\HPOCR) (Version: 10.0 - HP)
    OpenOffice 4.0.1 (HKLM\...\{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}) (Version: 4.01.9714 - Apache Software Foundation)
    PanoStandAlone (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_ProductContext (Version: 100.0.215.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_Software (Version: 100.0.206.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_Software_Min (Version: 100.0.213.000 - Hewlett-Packard) Hidden
    PSSWCORE (Version: 2.02.0000 - Hewlett-Packard) Hidden
    Python 2.4.3 (HKLM\...\{75E71ADD-042C-4F30-BFAC-A9EC42351313}) (Version: 2.4.3150 - Martin v. Löwis)
    RangeMax Wireless-N USB Adapter WN111v2 (HKLM\...\InstallShield_{1C0E9C6B-D4D5-4D3C-8A10-F10A3E7BEEA5}) (Version: 2.00.0000 - NETGEAR)
    RealPlayer (HKLM\...\RealPlayer 6.0) (Version: - RealNetworks)
    Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5789 - Realtek Semiconductor Corp.)
    Rhapsody (HKLM\...\Rhapsody) (Version: - )
    Rhapsody Player Engine (HKLM\...\{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}) (Version: 1.0.604 - RealNetworks)
    Roxio Creator Audio (HKLM\...\{83FFCFC7-88C6-41c6-8752-958A45325C82}) (Version: 3.4.0 - Roxio)
    Roxio Creator Basic v9 (HKLM\...\{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}) (Version: 3.4.0 - Roxio)
    Roxio Creator Copy (HKLM\...\{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}) (Version: 3.4.0 - Roxio)
    Roxio Creator Data (HKLM\...\{0D397393-9B50-4c52-84D5-77E344289F87}) (Version: 3.4.0 - Roxio)
    Roxio Creator EasyArchive (HKLM\...\{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}) (Version: 3.4.0 - Roxio)
    Roxio Creator Tools (HKLM\...\{0394CDC8-FABD-4ed8-B104-03393876DFDF}) (Version: 3.4.0 - Roxio)
    Roxio Express Labeler 3 (HKLM\...\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 3.2.1 - Roxio)
    Roxio MyDVD Basic v9 (HKLM\...\{938B1CD7-7C60-491E-AA90-1F1888168240}) (Version: 9.0.559 - Roxio)
    RTC Client API v1.2 (HKLM\...\{44CDBD1B-89FB-4E02-8319-2A4C550F664A}) (Version: 1.2.0000 - Microsoft)
    SafeZone Stable 1.48.2066.120 (Version: 1.48.2066.120 - Avast Software) Hidden
    Scan (Version: 10.1.0.0 - Hewlett-Packard) Hidden
    Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 10.0 - HP)
    SmartWebPrintingOC (Version: 100.0.189.000 - Hewlett-Packard) Hidden
    Snapfish Media Detector (HKLM\...\{4EF6FDB0-3B11-4820-9860-8E08E9965195}) (Version: 1.7.0.15 - HP Snapfish)
    Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1) (Version: 7.74.00 - Conexant Systems)
    SolutionCenter (Version: 100.0.175.000 - Hewlett-Packard) Hidden
    Status (Version: 100.0.175.000 - Hewlett-Packard) Hidden
    Sunshine PC (HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Sunshine PC) (Version: Sunshine PC rev6.13.4792 - Sunshine)
    Toolbox (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Toolbox (Version: 82.0.173.000 - Hewlett-Packard) Hidden
    TrayApp (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    UnloadSupport (Version: 10.0.0 - Hewlett-Packard) Hidden
    VideoToolkit01 (Version: 100.0.128.000 - Hewlett-Packard) Hidden
    Viewpoint Media Player (HKLM\...\ViewpointMediaPlayer) (Version: - )
    Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
    WebReg (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    WN111v2 (Version: 2.00.0000 - NETGEAR) Hidden
    Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
    Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - Yahoo! Inc.)
    Yahoo! Toolbar (HKLM\...\Yahoo! Companion) (Version: - Yahoo! Inc.)
     
    dodopie,
    #1
  2. 2017/02/08
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00021401-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 -> C:\Windows\system32\mswinsck.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 -> C:\Windows\system32\mswinsck.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{32E26FD9-F435-4A20-A561-35D4B987CFDC}\InprocServer32 -> c:\programdata\webex\924\atucfobj.dll (WebEx Communications Inc.)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE3-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{477A3783-2D4D-11D3-B244-444553540000}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6352-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6353-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6354-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6355-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6356-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6357-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6359-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa72-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa73-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa74-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa83-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa88-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa89-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa8f-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa92-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa93-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa94-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa95-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{CD773740-B187-4974-A1D5-E0FF91372277}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InprocServer32 -> no filepath

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {1533533B-0541-4E1E-B126-29AE2B8247E7} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
    Task: {4FA38426-9AFD-4185-9B03-E217B2E1F355} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-08-30] (AVAST Software)
    Task: {60BEC739-0380-410D-B334-C30E1582211E} - System32\Tasks\{82BFA003-5420-4828-BFD6-DE291CBA9854} => pcalua.exe -a E:\AOLSETUP.EXE -d E:\
    Task: {87EB81E7-622A-47D7-8791-778D87482306} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {9D9D408E-5E19-4E7E-9E7E-E3251ACFE470} - System32\Tasks\{446F2DB2-C365-478F-BB1C-F9855EA21D4F} => pcalua.exe -a "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" -d "C:\Program Files\HP\Digital Imaging\bin" -c -inst "#Hewlett-Packard#HP Photosmart 2600 series#1278605344" -d "HP Photosmart 2600 series"
    Task: {B1E95ABF-FD81-4AA4-A721-E85EFB97EEA6} - System32\Tasks\{DE1E14F6-5C0B-4325-ACD5-6529E07DEA9E} => pcalua.exe -a E:\setup.exe -d E:\
    Task: {BA03F5AC-EFD2-4D50-95B8-F5B8456D7ECD} - System32\Tasks\SafeZone scheduled Autoupdate 1463521888 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-12] (Avast Software)
    Task: {BEFAF415-CC21-44C0-A50B-AE6EFBC43069} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-10] (Adobe Systems Incorporated)
    Task: {C2E3D536-DBA7-41F2-A56E-5B208E233C3B} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
    Task: {CD4C578E-AB63-4F8A-9C5E-3DA54FB93F13} - System32\Tasks\{17CB9E1B-FB64-4438-8EAF-820620F944C5} => pcalua.exe -a E:\SETUP.EXE -d E:\
    Task: {D4DCE6C6-38FC-4DBA-BF94-8D9965609BF1} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
    Task: {EE3AFF7D-09AC-4C27-845E-FCE758B530FE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\Ad-Aware Update (Weekly).job => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
    Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2016-08-30 13:09 - 2016-08-30 13:09 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2017-02-08 11:54 - 2017-02-08 11:54 - 06461320 _____ () C:\Program Files\AVAST Software\Avast\defs\17020800\algo.dll
    2016-08-30 13:09 - 2016-08-30 13:09 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
    2006-09-03 12:32 - 2006-09-03 12:32 - 00208896 _____ () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    2016-06-07 11:48 - 2010-08-04 13:44 - 00266240 _____ () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    2016-06-07 11:48 - 2010-03-10 13:50 - 00360448 _____ () C:\Program Files\NETGEAR\WNA1100\WifiLib.dll
    2005-06-24 10:13 - 2005-06-24 10:13 - 00407552 _____ () C:\Program Files\Extension Changer\extcontext.dll
    2009-10-14 13:36 - 2009-10-14 13:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    2016-06-30 07:45 - 2016-06-30 07:45 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2017-02-07 18:28 - 2017-02-06 23:48 - 00801600 _____ () C:\Program Files\Dropbox\Client\dropbox_watchdog.dll
    2017-02-02 17:03 - 2017-01-13 18:53 - 00035792 _____ () C:\Program Files\Dropbox\Client\_multiprocessing.pyd
    2017-02-02 17:03 - 2017-01-13 18:53 - 00100296 _____ () C:\Program Files\Dropbox\Client\_ctypes.pyd
    2017-02-02 17:02 - 2017-01-13 18:53 - 00018888 _____ () C:\Program Files\Dropbox\Client\select.pyd
    2017-02-02 17:02 - 2017-02-06 23:50 - 00019776 _____ () C:\Program Files\Dropbox\Client\tornado.speedups.pyd
    2017-02-02 17:02 - 2017-01-13 18:53 - 00694224 _____ () C:\Program Files\Dropbox\Client\unicodedata.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00020824 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
    2017-02-02 17:03 - 2017-01-13 18:54 - 00123856 _____ () C:\Program Files\Dropbox\Client\_cffi_backend.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 01682768 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00020816 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
    2017-02-07 18:28 - 2017-01-13 18:53 - 00145864 _____ () C:\Program Files\Dropbox\Client\pyexpat.pyd
    2017-02-07 18:28 - 2017-01-13 18:54 - 00019408 _____ () C:\Program Files\Dropbox\Client\faulthandler.pyd
    2017-02-07 18:28 - 2017-01-13 18:53 - 00116688 _____ () C:\Program Files\Dropbox\Client\pywintypes27.dll
    2017-02-02 17:03 - 2017-01-13 18:56 - 00105928 _____ () C:\Program Files\Dropbox\Client\win32api.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00022864 _____ () C:\Program Files\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00052544 _____ () C:\Program Files\Dropbox\Client\psutil._psutil_windows.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00038712 _____ () C:\Program Files\Dropbox\Client\fastpath.pyd
    2017-02-07 18:28 - 2017-01-13 18:53 - 00392144 _____ () C:\Program Files\Dropbox\Client\pythoncom27.dll
    2017-02-07 18:28 - 2017-01-13 18:56 - 00020936 _____ () C:\Program Files\Dropbox\Client\mmapfile.pyd
    2017-02-02 17:03 - 2017-01-13 18:56 - 00024528 _____ () C:\Program Files\Dropbox\Client\win32event.pyd
    2017-02-02 17:03 - 2017-01-13 18:57 - 00116176 _____ () C:\Program Files\Dropbox\Client\win32security.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00381760 _____ () C:\Program Files\Dropbox\Client\win32com.shell.shell.pyd
    2017-02-02 17:03 - 2017-01-13 18:56 - 00124880 _____ () C:\Program Files\Dropbox\Client\win32file.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00026456 _____ () C:\Program Files\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
    2017-02-02 17:03 - 2017-01-13 18:56 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32clipboard.pyd
    2017-02-02 17:03 - 2017-01-13 18:56 - 00175560 _____ () C:\Program Files\Dropbox\Client\win32gui.pyd
    2017-02-02 17:03 - 2017-01-13 18:57 - 00030160 _____ () C:\Program Files\Dropbox\Client\win32pipe.pyd
    2017-02-02 17:03 - 2017-01-13 18:57 - 00043472 _____ () C:\Program Files\Dropbox\Client\win32process.pyd
    2017-02-02 17:03 - 2017-01-13 18:57 - 00048592 _____ () C:\Program Files\Dropbox\Client\win32service.pyd
    2017-02-02 17:03 - 2017-01-13 18:56 - 00057808 _____ () C:\Program Files\Dropbox\Client\win32evtlog.pyd
    2017-02-02 17:03 - 2017-01-13 18:57 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32profile.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00246608 _____ () C:\Program Files\Dropbox\Client\breakpad.client.windows.handler.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00027488 _____ () C:\Program Files\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
    2017-02-02 17:03 - 2017-01-13 18:55 - 00241104 _____ () C:\Program Files\Dropbox\Client\_jpegtran.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00022336 _____ () C:\Program Files\Dropbox\Client\cpuid.compiled._cpuid.pyd
    2017-02-02 17:03 - 2017-01-13 18:57 - 00028616 _____ () C:\Program Files\Dropbox\Client\win32ts.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 01826104 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtCore.pyd
    2017-02-02 17:02 - 2017-01-13 18:54 - 00083912 _____ () C:\Program Files\Dropbox\Client\sip.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 01972536 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtGui.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 03928896 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWidgets.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00531264 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtNetwork.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00025432 _____ () C:\Program Files\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00133432 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKit.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00224064 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00207680 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtPrintSupport.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00021840 _____ () C:\Program Files\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00022872 _____ () C:\Program Files\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00021848 _____ () C:\Program Files\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00022872 _____ () C:\Program Files\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd
    2017-02-02 17:03 - 2017-01-13 18:57 - 00350152 _____ () C:\Program Files\Dropbox\Client\winxpgui.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00023896 _____ () C:\Program Files\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00025936 _____ () C:\Program Files\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
    2017-02-07 18:28 - 2017-01-13 18:51 - 00036296 _____ () C:\Program Files\Dropbox\Client\librsync.dll
    2017-02-07 18:28 - 2017-02-06 23:50 - 00084288 _____ () C:\Program Files\Dropbox\Client\dropbox_sqlite_ext.dll
    2017-02-07 18:28 - 2017-01-13 19:02 - 00017864 _____ () C:\Program Files\Dropbox\Client\libEGL.dll
    2017-02-07 18:28 - 2017-01-13 19:02 - 01631184 _____ () C:\Program Files\Dropbox\Client\libGLESv2.dll
    2017-02-07 18:28 - 2017-01-13 19:02 - 14419408 _____ () C:\Program Files\Dropbox\Client\opengl32sw.dll
    2017-02-07 18:28 - 2017-02-06 23:50 - 00042816 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebChannel.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00171336 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
    2017-02-07 18:28 - 2017-02-06 23:50 - 00357688 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQml.pyd
    2017-02-02 17:03 - 2017-01-13 18:57 - 00060880 _____ () C:\Program Files\Dropbox\Client\win32print.pyd
    2017-02-02 17:03 - 2017-02-06 23:50 - 00026456 _____ () C:\Program Files\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
    2009-06-02 07:58 - 2009-06-02 07:58 - 02140944 _____ () C:\Program Files\Logitech\Logitech Vid\QtCore4.dll
    2009-06-02 07:58 - 2009-06-02 07:58 - 07704336 _____ () C:\Program Files\Logitech\Logitech Vid\QtGui4.dll
    2009-06-02 07:58 - 2009-06-02 07:58 - 00968976 _____ () C:\Program Files\Logitech\Logitech Vid\QtNetwork4.dll
    2009-06-02 07:58 - 2009-06-02 07:58 - 00475408 _____ () C:\Program Files\Logitech\Logitech Vid\QtOpenGL4.dll
    2009-06-02 07:59 - 2009-06-02 07:59 - 00363792 _____ () C:\Program Files\Logitech\Logitech Vid\QtXml4.dll
    2009-06-02 07:59 - 2009-06-02 07:59 - 00199952 _____ () C:\Program Files\Logitech\Logitech Vid\QtSql4.dll
    2009-06-02 07:59 - 2009-06-02 07:59 - 00027408 _____ () C:\Program Files\Logitech\Logitech Vid\SDL.dll
    2009-06-02 07:59 - 2009-06-02 07:59 - 11311888 _____ () C:\Program Files\Logitech\Logitech Vid\QtWebKit4.dll
    2009-06-02 07:58 - 2009-06-02 07:58 - 00291600 _____ () C:\Program Files\Logitech\Logitech Vid\phonon4.dll
    2009-06-02 08:00 - 2009-06-02 08:00 - 00028944 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
    2009-06-02 08:00 - 2009-06-02 08:00 - 00035088 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
    2009-06-02 08:00 - 2009-06-02 08:00 - 00138000 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
    2016-06-07 11:48 - 2011-01-04 14:34 - 04545024 _____ () C:\Program Files\NETGEAR\WNA1100\WNA1100.exe
    2016-06-07 11:48 - 2009-08-28 15:50 - 00282624 _____ () C:\Program Files\NETGEAR\WNA1100\WifiSvcLib.dll
    2009-10-14 13:34 - 2009-10-14 13:34 - 00560472 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    2016-02-27 23:49 - 2012-05-25 04:25 - 00921600 _____ () C:\Program Files\Yahoo!\Messenger\yui.dll
    2016-07-14 09:21 - 2016-07-06 17:01 - 17602240 _____ () C:\Users\Tori\AppData\Local\Google\Chrome\User Data\PepperFlash\22.0.0.209\pepflashplayer.dll
    2016-09-06 19:44 - 2016-09-06 11:00 - 05197312 _____ () C:\Users\Tori\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libglesv2.dll
    2016-09-06 19:44 - 2016-09-06 11:00 - 00147456 _____ () C:\Users\Tori\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libegl.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\Users\Tori\Downloads\006.mp4:TOC.WMV [130]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)

    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.exe: => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.scr: => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.bat: => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.com: => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.cmd: => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.reg: => <===== ATTENTION

    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE trusted site: HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\driversupport.com -> hxxp://apps.driversupport.com
    IE trusted site: HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\driversupport.com -> hxxps://apps.driversupport.com

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2006-11-02 05:23 - 2006-09-18 16:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

    127.0.0.1 localhost
    ::1 localhost

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Tori\Pictures\2015-12-02\20150909_175108.jpg
    DNS Servers: 192.168.1.254
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [WinCollab-DFSR-In-TCP] => %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-DFSR-Out-TCP] => %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-In-TCP] => %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-TCP] => %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-In-UDP] => %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-UDP] => %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [{7E08AE05-29F9-4FA2-A855-BC94B1812FEC}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe
    FirewallRules: [{8AD4B445-2665-49C1-868C-57B236CEDCA4}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe
    FirewallRules: [{CEE89B6C-00C8-4144-B5A6-0476047653A5}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    FirewallRules: [{43127B7F-6787-4AC9-98E9-5FB21C41FD6A}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    FirewallRules: [{92363EFE-3ED7-45D5-8406-56DA8AEEF7E2}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    FirewallRules: [{1FBA613B-8DB4-4AC4-B1BF-F0D97D0E2198}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    FirewallRules: [{25C42470-733A-44AA-9C25-08180AF8F86B}] => LPort=9442
    FirewallRules: [{E5C1C5C6-E862-46F7-9566-D884DD2BFAC3}] => LPort=1900
    FirewallRules: [{E4CE3B3A-59B8-4E11-8F2A-7993F4B86185}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{6485DC41-213D-4A8D-AA8B-551F99D23BE9}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{12619514-D9E8-4900-9E4D-ECDF93F13427}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{944880D9-B475-483D-BC04-009A3F5E2CE7}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{DE12E2DE-87E7-44F8-B3EE-2959C4DB6C77}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{D51E78BF-818E-445C-943E-B27861212FF5}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{92CFE1BD-98CD-48CC-8F4B-3C89317682AA}] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{9E4547A2-D64F-40E5-B488-DB594050B014}] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{D91AB1FB-C3A3-4C12-B4CB-03FCC5D9B2CC}] => LPort=80
    FirewallRules: [{3D4D1636-B373-4D9A-979E-1F56EB31AF31}] => LPort=80
    FirewallRules: [{03104623-B954-49BE-9D4C-702CE859704F}] => LPort=80
    FirewallRules: [TCP Query User{01EB243C-E9F8-4B10-A42E-67F4C1C2B088}C:\program files\yahoo!\messenger\yahoomessenger.exe] => C:\program files\yahoo!\messenger\yahoomessenger.exe
    FirewallRules: [UDP Query User{57D3BE13-369B-4FAF-AC8C-776CEDA4C67B}C:\program files\yahoo!\messenger\yahoomessenger.exe] => C:\program files\yahoo!\messenger\yahoomessenger.exe
    FirewallRules: [TCP Query User{D5EF77F1-E966-48A9-ADE8-56B930510E4A}C:\program files\logitech\logitech vid\vid.exe] => C:\program files\logitech\logitech vid\vid.exe
    FirewallRules: [UDP Query User{67E147EE-488D-4F1F-BC40-D55FAE320043}C:\program files\logitech\logitech vid\vid.exe] => C:\program files\logitech\logitech vid\vid.exe
    FirewallRules: [{732C57C5-D5B5-4C3D-8948-E1EA0162E1D0}] => C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{C10344C7-ABFF-4BD4-9EFF-7669EB75C1E9}] => C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{75DE061E-26E1-4887-B05F-9496091CBE79}] => C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{6CB0275C-8CEF-4FBB-B5E9-98BC592FC41F}] => C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{830A844F-BD25-45CD-A2BC-F725B73F2D05}] => C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{281B09ED-0AD5-4D5E-90C5-00FC4998C848}] => C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{7BFAB5B2-3AEE-41C0-9D8A-F834B9437422}] => C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{A0B5A194-3773-4FF7-8269-F68144160961}] => C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{109B5621-110B-4C60-B0B0-A396DE293AD4}] => C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{B91F2D9F-CA09-45A4-B597-2C2E7BAAA4B7}] => C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{C97A52B4-08D3-43C6-8DAF-B11FF6EE4475}] => C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{055F6980-8CBE-466C-B366-2993401E8580}] => C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{07721B83-175D-4895-99C0-663F782A0499}] => C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{63D32969-17FC-4164-9623-9921FBCE106E}] => C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{6B8CB9A2-DADF-4F30-9741-71E6709147D6}] => C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{6EE3A0B2-3BE4-49D2-9B75-24F6D74F69B5}] => C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{3C84CCB4-82E3-43EB-97FE-B8ADBD396FD8}] => C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{BA5BB4D8-8411-472E-8A11-967F4475C850}] => C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{ED35A362-A609-4AC8-8F2F-62A05A414EBA}] => C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{7F314E9E-753D-4699-ADB0-7CF44FC7F91F}] => C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{A941BA5E-E8DB-47C0-AEC0-2E0F69DFAEAB}] => C:\Program Files\adawaretb\dtUser.exe
    FirewallRules: [{3DED6E5B-DE8C-45C0-A7A0-0E4231DC2193}] => C:\Program Files\adawaretb\dtUser.exe
    FirewallRules: [{427B9501-4991-4E3D-878A-19B46AB2B95B}] => C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    FirewallRules: [{E046F771-B7FC-4B47-BDB3-206CC6F761D2}] => LPort=50308
    FirewallRules: [{5221F830-B378-42AE-842F-C42C7E374B70}] => LPort=3479
    FirewallRules: [{853AA996-5145-4CF9-9509-BFFE56E09C35}] => C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe
    FirewallRules: [{4A0F71C4-4023-4A71-9CF9-16BDFA55CE5F}] => C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe
    FirewallRules: [{2E7AB4BB-99CB-4CD7-9254-5167FAFC7DBF}] => C:\Program Files\Google\Chrome\Application\chrome.exe
    FirewallRules: [{1ACF1982-B5AF-4265-B4FC-2B18427B1266}] => C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{CFF6D1F2-4B1C-4E61-B665-968498FB0F6B}] => C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{7EC01A6D-F50B-4A51-BB7C-26E58F6682AF}] => C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{E293C848-7B13-47E7-8242-3C6A1C6E191C}] => C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{35907039-A8F4-408E-B76C-B35093EC679D}] => C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{B6626F49-6218-446E-B906-0F96F9FEFB75}] => C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{D4E4C272-0350-4204-ABFB-1F6CAC497A90}] => C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{0661BF77-2F77-4D15-8E76-C0C08A69C358}] => C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{3D0D28AC-0258-4C4E-8531-5F7C90FADBAC}] => C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{6884201E-DA8B-4152-82D8-1F628CF4B0E7}] => C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{8881BA11-F95F-4894-B5A5-8D9BC2D457F7}] => C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{535423E9-C220-46BD-AFC8-1967A844B235}] => C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{3E1B3056-85A0-441A-BBE1-8FCEDD6E5AF7}] => C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{61CFB5E2-86B2-4D1E-8E57-17064959FD75}] => C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{11E41D8A-D121-44B1-AE66-F76FCB674933}] => C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{AEFA4582-DB14-417A-B2EC-1FA8B110C278}] => C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{F5A72B58-3252-4EE0-AA3B-23FB1366CDF7}] => C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{6896DD4D-5DDB-4A55-B347-A649C19ECF87}] => C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{AF94A0C9-4660-4CAE-B9BB-45E55EF716E0}] => C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{611D8009-6374-4AA1-BCB6-67136478A6A2}] => C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{A4DCC555-D8AD-45B5-88F7-2D603B858CD6}] => C:\Program Files\Logitech\Logitech Vid\Vid.exe
    FirewallRules: [{1E4A59A2-9901-4BBD-AFB4-1EF430F7D2EF}] => C:\Program Files\Logitech\Logitech Vid\Vid.exe
    FirewallRules: [{478570A2-5D2E-4191-B078-7F6CA3F93377}] => C:\Program Files\Dropbox\Client\Dropbox.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\EarthLink TotalAccess\TaskPanl.exe] => Enabled:Earthlink

    ==================== Restore Points =========================

    16-01-2017 16:41:52 Scheduled Checkpoint
    18-01-2017 00:00:01 Scheduled Checkpoint
    19-01-2017 00:00:08 Scheduled Checkpoint
    20-01-2017 00:00:04 Scheduled Checkpoint
    21-01-2017 00:00:03 Scheduled Checkpoint
    22-01-2017 00:00:04 Scheduled Checkpoint
    23-01-2017 00:00:03 Scheduled Checkpoint
    24-01-2017 00:00:10 Scheduled Checkpoint
    25-01-2017 00:00:04 Scheduled Checkpoint
    26-01-2017 00:00:05 Scheduled Checkpoint
    27-01-2017 00:00:10 Scheduled Checkpoint
    28-01-2017 12:23:04 Scheduled Checkpoint
    30-01-2017 00:00:07 Scheduled Checkpoint
    31-01-2017 00:00:05 Scheduled Checkpoint
    01-02-2017 00:00:06 Scheduled Checkpoint
    02-02-2017 00:00:08 Scheduled Checkpoint
    03-02-2017 00:37:00 Scheduled Checkpoint
    04-02-2017 00:00:04 Scheduled Checkpoint
    05-02-2017 03:34:43 Scheduled Checkpoint
    06-02-2017 00:00:04 Scheduled Checkpoint
    06-02-2017 19:43:43 Scheduled Checkpoint

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (02/08/2017 11:51:07 AM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/07/2017 06:29:17 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/07/2017 06:29:09 PM) (Source: DbxSvc) (EventID: 270) (User: )
    Description: Filter Unload failed with: (-2145452013) The system could not find the filter specified.

    Error: (02/06/2017 03:45:58 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/03/2017 12:06:03 AM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/02/2017 05:03:28 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/02/2017 05:03:23 PM) (Source: DbxSvc) (EventID: 270) (User: )
    Description: Filter Unload failed with: (-2145452013) The system could not find the filter specified.

    Error: (01/23/2017 09:42:51 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (01/23/2017 09:42:45 PM) (Source: DbxSvc) (EventID: 270) (User: )
    Description: Filter Unload failed with: (-2145452013) The system could not find the filter specified.

    Error: (01/15/2017 11:21:36 AM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.


    System errors:
    =============
    Error: (02/08/2017 11:52:57 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    i8042prt

    Error: (02/08/2017 11:52:38 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The HP CUE DeviceDiscovery Service service hung on starting.

    Error: (02/08/2017 11:52:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Parallel port driver service failed to start due to the following error:
    The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

    Error: (02/08/2017 11:51:01 AM) (Source: EventLog) (EventID: 6008) (User: )
    Description: The previous system shutdown at 11:48:38 AM on 2/8/2017 was unexpected.

    Error: (02/06/2017 03:48:02 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    i8042prt

    Error: (02/06/2017 03:47:26 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The HP CUE DeviceDiscovery Service service hung on starting.

    Error: (02/06/2017 03:47:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Parallel port driver service failed to start due to the following error:
    The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

    Error: (02/06/2017 03:45:50 PM) (Source: EventLog) (EventID: 6008) (User: )
    Description: The previous system shutdown at 3:43:41 PM on 2/6/2017 was unexpected.

    Error: (02/03/2017 12:07:42 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    i8042prt

    Error: (02/03/2017 12:07:38 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The HP CUE DeviceDiscovery Service service hung on starting.


    CodeIntegrity:
    ===================================
    Date: 2016-10-05 14:44:35.282
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-03 15:35:23.086
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-03 14:43:50.563
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-03 13:10:25.001
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-03 13:02:27.440
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 16:35:40.773
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 16:31:56.210
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 16:27:52.909
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 16:09:46.289
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 15:57:58.229
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
    Percentage of memory in use: 76%
    Total physical RAM: 2037.77 MB
    Available physical RAM: 469.75 MB
    Total Virtual: 4316.78 MB
    Available Virtual: 2610.18 MB

    ==================== Drives ================================

    Drive c: (HP) (Fixed) (Total:289.26 GB) (Free:183.38 GB) NTFS ==>[drive with boot components (obtained from BCD)]
    Drive d: (Recovery) (Fixed) (Total:8.83 GB) (Free:1 GB) NTFS ==>[system with boot components (obtained from drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 298.1 GB) (Disk ID: 1549F232)
    Partition 1: (Active) - (Size=289.3 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=8.8 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
    dodopie,
    #2


  3. to hide this advert.

  4. 2017/02/08
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===================================

    [​IMG] Does the issue happen in all browsers?

    [​IMG] Uninstall following unwanted program: Download Updater.

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2
    • Close all the running programs
    • Double click on downloaded setup.exe file to install the program.
    • Click on Start Scan button.
    • Click on another Start Scan button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    [​IMG] Please download Malwarebytes to your desktop.
    • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
    • Then click Finish.
    • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
    • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
    • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
    • Restart your computer when prompted to do so.
    • The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.
    [​IMG] Please download AdwCleaner by Xplode and save to your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
      Vista/Windows 7/8 users right-click and select Run As Administrator
    • The tool will start to update the database if one is required.
    • Click on the Scan button.
    • AdwCleaner will begin...be patient as the scan may take some time to complete.
    • After the scan has finished, click on the Logfile button.
    • A window will open which lists the logs of your scans.
    • Click on the Scan tab.
    • Double-click the most recent scan which will be at the top of the list....the log will appear.
    • Review the results...see note below
    • After reviewing the log, click on the Clean button.
    • Press OK when asked to close all programs and follow the onscreen prompts.
    • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
    • After rebooting, a logfile report (AdwCleaner[CX].txt) will open automatically (where the largest value of X represents the most recent report).
    • To open a Cleaning log, launch AdwareClearer, click on the Logfile button, click on the Cleaning tab and double-click the log at the top of the list.
    • Copy and paste the contents of AdwCleaner[CX].txt in your next reply.
    • A copy of all logfiles are saved to C:\AdwCleaner.
    -- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name or entry that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on and uncheck any items you want to keep.


    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
    broni,
    #3
  5. 2017/02/08
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    RogueKiller V12.9.7.0 [Feb 6 2017] (Free) by Adlice Software
    mail : Contact - Adlice Software
    Feedback : Adlice forum - Home
    Website : RogueKiller Anti-Malware Free Download - Official Website
    Blog : Adlice Software

    Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
    Started in : Normal mode
    User : Tori [Administrator]
    Started from : C:\Program Files\RogueKiller\RogueKiller.exe
    Mode : Delete -- Date : 02/08/2017 21:26:47 (Duration : 00:58:18)

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 41 ¤¤¤
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E} (C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\visic_coupon.dll) -> Deleted
    [Suspicious.Path] HKEY_CLASSES_ROOT\CLSID\{0AA8B942-6B69-4370-A257-99FFBB4AF721} (C:\Users\ADMINI~1\AppData\Local\Temp\{6E7BF6EC-C3E7-43A7-8A03-0D204E3EC01B}\InstallerSupport.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\visic_coupon.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} (C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{1E57256D-9F39-4267-AB39-D7813D644C5A} ("C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbb.exe") -> Deleted
    [Suspicious.Path] HKEY_CLASSES_ROOT\CLSID\{210D8F0C-EDA1-4DD2-B3AF-1E9F0545B557} (C:\Users\ADMINI~1\AppData\Local\Temp\{6E7BF6EC-C3E7-43A7-8A03-0D204E3EC01B}\InstallerSupportPS.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{31371420-098D-4C0E-A11E-EBEC2305DD01} ("C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbb.exe") -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{3A06AA27-D94B-48C2-BB55-9FD0FF2120E3} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{46140CE4-76FE-440E-AE88-4C2272BC05C7} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [PUP.Gen1] HKEY_CLASSES_ROOT\CLSID\{8B9A2A56-55A7-4A3D-8A3F-A0D3EED7477D} (C:\Program Files\Yahoo!\Companion\Installs\cpn\YMERemote.dll) -> Deleted
    [PUP.Gen1] HKEY_CLASSES_ROOT\CLSID\{91B10C56-7871-4F73-B7D9-A838E159653D} (C:\Program Files\Yahoo!\Companion\Installs\cpn\HPAdvisor.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{9F9C4C5C-2BA8-4E00-A697-9F710BB1026B} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [Suspicious.Path] HKEY_CLASSES_ROOT\CLSID\{B80B5599-9D25-48BF-B488-96457BF68B89} (C:\Users\ADMINI~1\AppData\Local\Temp\{6E7BF6EC-C3E7-43A7-8A03-0D204E3EC01B}\InstallHelper.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{C60CCE95-6AF9-4E74-B66B-3212D19F1D2F} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [PUP.Gen1] HKEY_CLASSES_ROOT\CLSID\{C658F505-7C8B-45FA-A4C7-4CF8D56BAD59} (C:\Program Files\AOL Toolbar\aoltbServerPS.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{F51C15D4-3D0A-4DBA-A095-EBCC09F24DA2} (C:\Program Files\Yahoo!\Companion\Installs\cpn\YMERemote.dll) -> Deleted
    [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{FBE30D66-39A2-4b72-8B43-6D4C335A6F34} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\Software\MetaStream -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\Software\Viewpoint -> Deleted
    [PUP.Gen0] HKEY_USERS\S-1-5-21-1137620820-469648318-63125674-1001\Software\Sunshine -> Deleted
    [PUP.Gen1] HKEY_USERS\S-1-5-21-1137620820-469648318-63125674-1001\Software\YahooPartnerToolbar -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Toolbar -> Deleted
    [PUP.Gen1] HKEY_USERS\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer -> Deleted
    [PUP.Gen1] HKEY_USERS\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Yahoo! Companion -> Deleted
    [PUP.Gen0] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [PUP.Gen0] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar | {EF99BD32-C1FB-11D2-892F-0090271D4F88} : (C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll) -> Deleted
    [Suspicious.Path] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | Search Protection : C:\ProgramData\Search Protection\SearchProtection.exe [x] -> Deleted
    [PUM.HomePage] HKEY_USERS\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://http://www.yahoo.com/?ilc=8.yahoo.com -> Replaced (MSN.com - Hotmail, Outlook, Skype, Bing, Latest News, Photos & Videos)
    [PUP.Gen1] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A941BA5E-E8DB-47C0-AEC0-2E0F69DFAEAB} : v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files\adawaretb\dtUser.exe|Name=Ad-Aware Security Add-on DTX Broker|Edge=FALSE| [x] -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {3DED6E5B-DE8C-45C0-A7A0-0E4231DC2193} : v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files\adawaretb\dtUser.exe|Name=Ad-Aware Security Add-on DTX Broker|Edge=FALSE| [x] -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A941BA5E-E8DB-47C0-AEC0-2E0F69DFAEAB} : v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files\adawaretb\dtUser.exe|Name=Ad-Aware Security Add-on DTX Broker|Edge=FALSE| [x] -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {3DED6E5B-DE8C-45C0-A7A0-0E4231DC2193} : v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files\adawaretb\dtUser.exe|Name=Ad-Aware Security Add-on DTX Broker|Edge=FALSE| [x] -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A941BA5E-E8DB-47C0-AEC0-2E0F69DFAEAB} : v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files\adawaretb\dtUser.exe|Name=Ad-Aware Security Add-on DTX Broker|Edge=FALSE| [x] -> Deleted
    [PUP.Gen1] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {3DED6E5B-DE8C-45C0-A7A0-0E4231DC2193} : v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files\adawaretb\dtUser.exe|Name=Ad-Aware Security Add-on DTX Broker|Edge=FALSE| [x] -> Deleted

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 15 ¤¤¤
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\MetaStreamConfig.ini -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\MTSDownloadSites.txt -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1033625800.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1291042541.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1632108825.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1839921641.mtz -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1941326580.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-2015167067.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-2079369664.mtz -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-371405197.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-388101637.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-491314164.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-635593843.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-727969835.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-99306037.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1043439145.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1265996568.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1287855660.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1376184584.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1381528805.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1395687570.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\144551481.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1689702636.mtz -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1717208253.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1965221205.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1994550604.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\225883322.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\348794195.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\57649701.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\641880511.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\781825834.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1006567525.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1049299314.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1246624052.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1280222126.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1340620777.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1428395217.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1757642022.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1839921636.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1914384785.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1999476388.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-2095132315.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-2110907284.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-397273289.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-468464551.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-794243946.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-844485417.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1156428440.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\154363364.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\158399316.mtz -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1594477922.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\180140716.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\264989505.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\33449417.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\351578073.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\375055703.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\44719014.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\938081234.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1081422650.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1197121005.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1214089112.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1280222117.mtz -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1335289186.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1385694166.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1456072399.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1519387795.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-327222488.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-472484759.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-643611118.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-912635092.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-934922559.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1018018407.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1143180934.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1464706573.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1540514963.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1674539231.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\177684171.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\203235953.mzv -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\256160741.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558.ini -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558_1.ini -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\452832402.mtz -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\522764874.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\641854543.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\67784436.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\962360617.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1099044802.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-126809689.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1330216079.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1338147255.mtz -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1524781535.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1739696679.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1746223540.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1943184874.mzv -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-2079369653.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-2136143126.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-238053149.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-556770252.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-635593740.mtz -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-709947214.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-769932685.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-794850727.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-850791885.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1094473608.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1190906055.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1418327668.mtx -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1567462043.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1569578800.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1587010403.swf -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1745011144.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1758730961.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1822466240.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\2022717923.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\2066124122.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\2110680965.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\666120353.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\75023221.mzv -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\918569107.mts -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9\FLFBootStrap.mtx -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9 -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus\FLFBootStrap.mtx -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Yahoo! Companion -> Deleted
    [PUP.Gen1][File] C:\ProgramData\Yahoo! Companion\bootstrap.ini -> Deleted
    [PUP.Gen0][File] C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sunshine PC\Sunshine PC.lnk [LNK@] C:\PROGRA~1\Sunshine\SUNSHI~1\SUNSHI~1.EXE -> Deleted
    [PUP.Gen0][File] C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sunshine PC\Uninstall.lnk [LNK@] C:\PROGRA~1\Sunshine\SUNSHI~1\UNINST~1.EXE -> Deleted
    [PUP.Gen1][Folder] C:\Users\Tori\AppData\Roaming\SecureSearch -> Deleted
    [PUP.Gen1][File] C:\Users\Tori\AppData\Roaming\SecureSearch\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}.ico -> Deleted
    [PUP.Gen0][Folder] C:\Users\Tori\AppData\Roaming\Sunshine -> Deleted
    [PUP.Gen0][File] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\DB\spika.db -> Deleted
    [PUP.Gen0][Folder] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\DB -> Deleted
    [PUP.Gen0][File] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\pcc\config\uuid.ini -> Deleted
    [PUP.Gen0][Folder] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\pcc\config -> Deleted
    [PUP.Gen0][Folder] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\pcc\log\Dump -> Deleted
    [PUP.Gen0][File] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\pcc\log\racore_20151201_0.log -> Deleted
    [PUP.Gen0][Folder] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\pcc\log -> Deleted
    [PUP.Gen0][Folder] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\pcc -> Deleted
    [PUP.Gen0][Folder] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC\Thumbnail -> Deleted
    [PUP.Gen0][Folder] C:\Users\Tori\AppData\Roaming\Sunshine\Sunshine PC -> Deleted
    [PUP.Gen1][Folder] C:\Users\Tori\AppData\Roaming\Yahoo!\Companion -> Deleted
    [PUP.Gen1][Folder] C:\Users\Tori\AppData\Roaming\Yahoo!\Companion\Buttons -> Deleted
    [PUP.Gen1][Folder] C:\ProgramData\Viewpoint -> ERROR [3]
    [PUP.Gen1][Folder] C:\ProgramData\Yahoo! Companion -> ERROR [3]
    [PUP.Conduit|PUP.Gen1][Folder] C:\Program Files\Conduit -> Deleted
    [PUP.Gen0][Folder] C:\Program Files\Sunshine -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\add_fw_port.bat -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_bzlib_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_jbig_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_jp2_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_jpeg_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_lcms_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_libxml_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_Magick++_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_magick_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_png_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_tiff_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_ttf_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_wand_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_xlib_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\CORE_RL_zlib_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\dpreference.fk -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\ffmpeg.exe -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\id3lib.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\LGPL.txt -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\libeay32.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\MediaInfo.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\mfc100.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\mfc100u.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\mfc100ud.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_aai_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_art_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_avs_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_bgr_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_bmp_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_braille_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_cals_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_caption_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_cin_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_cip_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_clipboard_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_clip_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_cmyk_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_cut_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_dcm_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_dds_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_debug_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_dib_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_djvu_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_dng_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_dot_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_dps_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_dpx_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_emf_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_ept_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_exr_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_fax_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_fits_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_fpx_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_gif_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_gradient_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_gray_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_hald_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_hdr_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_histogram_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_hrz_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_html_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_icon_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_info_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_inline_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_ipl_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_jbig_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_jp2_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_jpeg_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_label_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_mac_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_magick_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_map_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_matte_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_mat_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_meta_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_miff_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_mono_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_mpc_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_mpeg_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_mpr_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_msl_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_mtv_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_mvg_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_null_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_otb_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_palm_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pattern_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pcd_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pcl_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pcx_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pdb_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pdf_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pes_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pict_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pix_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_plasma_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_png_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pnm_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_preview_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_ps2_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_ps3_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_psd_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_ps_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_pwp_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_raw_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_rgb_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_rla_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_rle_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_scr_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_sct_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_sfw_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_sgi_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_stegano_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_sun_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_svg_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_tga_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_thumbnail_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_tiff_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_tile_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_tim_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_ttf_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_txt_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_uil_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_url_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_uyvy_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_vicar_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_vid_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_viff_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_wbmp_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_webp_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_wmf_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_wpg_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_xbm_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_xcf_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_xc_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_xpm_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_xps_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_xtrn_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_xwd_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_x_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_ycbcr_.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\coders\IM_MOD_RL_yuv_.dll -> Deleted
    [PUP.Gen0][Folder] C:\Program Files\Sunshine\Sunshine PC\modules\coders -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\modules\filters\analyze.dll -> Deleted
    [PUP.Gen0][Folder] C:\Program Files\Sunshine\Sunshine PC\modules\filters -> Deleted
    [PUP.Gen0][Folder] C:\Program Files\Sunshine\Sunshine PC\modules -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\msvcp100.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\msvcp100d.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\msvcr100.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\msvcr100d.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\opensource_video.txt -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\portmap.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\preference.fk -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\pthreadVC2.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\pthreadVSE2.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\remove_fw_port.bat -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\ssleay32.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\sunshine.ico -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\SunshinePCEng.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\SunshinePCKor.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\sunshine_PC.jpg -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\sunshine_PC.png -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\sunshine_PC_L.jpg -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\sunshine_PC_L.png -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\Uninstall.exe -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\vcomp100.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\X11.dll -> Deleted
    [PUP.Gen0][File] C:\Program Files\Sunshine\Sunshine PC\Xext.dll -> Deleted
    [PUP.Gen0][Folder] C:\Program Files\Sunshine\Sunshine PC -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Viewpoint -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ServiceComponent.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VectorView.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPAudio.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPSpeech.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Viewpoint\Viewpoint Experience Technology\DownloadedComponents -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Viewpoint\Viewpoint Experience Technology -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Yahoo!\Companion -> Deleted
    [PUP.Gen1][File] C:\Program Files\Yahoo!\Companion\Data\apps.html -> Deleted
    [PUP.Gen1][File] C:\Program Files\Yahoo!\Companion\Data\loading.html -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Yahoo!\Companion\Data -> Deleted
    [PUP.Gen1][File] C:\Program Files\Yahoo!\Companion\Installs\cpn0\inyt.exe.manifest -> Deleted
    [PUP.Gen1][File] C:\Program Files\Yahoo!\Companion\Installs\cpn0\visic_coupon.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll -> Deleted
    [PUP.Gen1][File] C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbb.exe -> Deleted
    [PUP.Gen1][File] C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbn.exe -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Yahoo!\Companion\Installs\cpn0 -> Deleted
    [PUP.Gen1][Folder] C:\Program Files\Yahoo!\Companion\Installs -> Deleted
    [PUP.Gen0][File] C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sunshine PC\Sunshine PC.lnk [LNK@] C:\PROGRA~1\Sunshine\SUNSHI~1\SUNSHI~1.EXE -> Removed at reboot [2]
    [PUP.Gen0][File] C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sunshine PC\Uninstall.lnk [LNK@] C:\PROGRA~1\Sunshine\SUNSHI~1\UNINST~1.EXE -> Removed at reboot [2]

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 1 ¤¤¤
    [PUM.SearchPage][Chrome:Config] Default [SecurePrefs] : default_search_provider_data.template_url_data.keyword [yahoo.com] -> Deleted

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: SAMSUNG HD320KJ +++++
    --- User ---
    [MBR] 0f59b3acc8c4a3dbadffb3a6717afd9f
    [BSP] 2552b2d2227b2ea2b3c92a526a1a6f5d : HP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 296198 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 606614400 | Size: 9044 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: Generic- Compact Flash USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )

    +++++ PhysicalDrive2: Generic- SM/xD-Picture USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )

    +++++ PhysicalDrive3: Generic- SD/MMC USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )

    +++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )
     
    dodopie,
    #4
  6. 2017/02/09
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Malwarebytes
    www.malwarebytes.com

    -Log Details-
    Scan Date: 2/9/17
    Scan Time: 1:18 AM
    Logfile: malwaretxt.txt
    Administrator: Yes

    -Software Information-
    Version: 3.0.6.1469
    Components Version: 1.0.50
    Update Package Version: 1.0.1216
    License: Trial

    -System Information-
    OS: Windows Vista Service Pack 2
    CPU: x86
    File System: NTFS
    User: Tori-PC\Tori

    -Scan Summary-
    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 1293642
    Time Elapsed: 6 hr, 29 min, 7 sec

    -Scan Options-
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    -Scan Details-
    Process: 0
    (No malicious items detected)

    Module: 0
    (No malicious items detected)

    Registry Key: 3
    PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-1137620820-469648318-63125674-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B0AD6CE7-F8E5-4EE6-AC83-5888C72F7488}, Quarantined, [13782], [234010],1.0.1216
    PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{B0AD6CE7-F8E5-4EE6-AC83-5888C72F7488}, Quarantined, [13782], [234010],1.0.1216
    PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\Toolbar.CT2438727, Quarantined, [13782], [234010],1.0.1216

    Registry Value: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Data Stream: 0
    (No malicious items detected)

    Folder: 3
    PUP.Optional.Conduit, C:\Users\Tori\AppData\LocalLow\Conduit\Toolbar\Facebook, Quarantined, [715], [182117],1.0.1216
    PUP.Optional.Conduit, C:\Users\Tori\AppData\LocalLow\Conduit\Toolbar, Quarantined, [715], [182117],1.0.1216
    PUP.Optional.Conduit, C:\USERS\TORI\APPDATA\LOCALLOW\CONDUIT, Quarantined, [715], [182117],1.0.1216

    File: 3
    PUP.Optional.Visicom, C:\PROGRAMDATA\ROGUEKILLER\QUARANTINE\613ACFA2A3A34765.VIR, Quarantined, [2124], [368958],1.0.1216
    PUP.Optional.Conduit, C:\Users\Tori\AppData\LocalLow\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=5_7_2_2.xml, Quarantined, [715], [182117],1.0.1216
    PUP.Optional.DriverDetective, C:\USERS\TORI\DOWNLOADS\DRIVERDETECTIVE.EXE, Quarantined, [1876], [335971],1.0.1216

    Physical Sector: 0
    (No malicious items detected)


    (end)
     
    dodopie,
    #5
  7. 2017/02/09
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    # AdwCleaner v6.043 - Logfile created 09/02/2017 at 17:12:03
    # Updated on 27/01/2017 by Malwarebytes
    # Database : 2017-02-09.1 [Server]
    # Operating System : Windows Vista (TM) Home Premium Service Pack 2 (X86)
    # Username : Tori - TORI-PC
    # Running from : C:\Users\Tori\Desktop\AdwCleaner.exe
    # Mode: Clean
    # Support : Customer Support & Help Center



    ***** [ Services ] *****

    [-] Service deleted: YahooAUService


    ***** [ Folders ] *****

    [-] Folder deleted: C:\Users\Tori\AppData\LocalLow\Yahoo! Companion
    [-] Folder deleted: C:\Users\Tori\AppData\LocalLow\Yahoo!\Companion
    [-] Folder deleted: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Yahoo! Companion
    [-] Folder deleted: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Yahoo!\Companion


    ***** [ Files ] *****

    [-] File deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
    [-] File deleted: C:\Program Files\Yahoo!\Common\unyt.exe
    [-] File deleted: C:\prefs.js


    ***** [ DLL ] *****



    ***** [ WMI ] *****



    ***** [ Shortcuts ] *****



    ***** [ Scheduled Tasks ] *****



    ***** [ Registry ] *****

    [-] Key deleted: HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
    [-] Key deleted: HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
    [-] Key deleted: HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\Sample.BrowserHandler
    [-] Key deleted: HKLM\SOFTWARE\Classes\Sample.BrowserHandler.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\Sample.YTBPartnerSample
    [-] Key deleted: HKLM\SOFTWARE\Classes\Sample.YTBPartnerSample.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
    [-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\YMERemote.YMECompPlugin
    [-] Key deleted: HKLM\SOFTWARE\Classes\YMERemote.YMECompPlugin.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\YMERemote.YMERemoteCtl
    [-] Key deleted: HKLM\SOFTWARE\Classes\YMERemote.YMERemoteCtl.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.CacheLoader
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.CacheLoader.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.Clickstream
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.Clickstream.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTBMButton
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTBMButton.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTHelper
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTHelper.2
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTNavAssistPlugin
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTNavAssistPlugin.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YToolbarBand
    [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YToolbarBand.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant
    [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF
    [-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP
    [-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{1CAE874F-F5C7-4BCC-BA46-9AD26DF35B93}
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{EFC0651C-B6D7-49CD-A6E0-B1CE9AB5FE46}
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{7375D127-3955-4654-8E7D-1949A7A9C902}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3C16E079-E4C7-493C-BE9F-E0F2BB0B7430}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{6EB4349D-4333-442F-ACA4-4C72AF28B6ED}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{7DB8B625-DBF0-4491-B544-5A06F7B17BB4}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{8E74A0AE-F0ED-47ED-A940-A8E99687646B}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{9DE77B51-89F6-468E-9402-16050382E950}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{8233093C-178B-484B-979E-3C6B5B147DBC}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{F56ACA29-1C99-40F1-AC64-2E44C4F6BC71}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{12D3E096-0FDF-42CC-8F44-04944F9C1648}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{22389F39-2CF4-47C4-B8B2-273BB16BF70C}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{23E3CEB3-D63A-433E-A5D0-4DB1C501B915}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{26A3152F-CF87-4C5B-8093-4D4B9EC084EB}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{29E3319C-4B3C-479F-8692-BDD2CA30BEDD}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{367BD1CD-74A3-451F-B1A4-6A2DE4129A2D}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{49F018EE-F362-4B5B-8EC8-BCF9246ABF21}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{63B73044-FC1A-4FE1-991B-FDBD4CDAA868}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{7207E52B-821E-4C05-A8D6-2965B2BE77CF}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{863FCF5D-DC39-4DA9-AF32-CB0025990EEE}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{B09E015A-4D4E-4F8D-A436-95E19140947D}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{B1E712C4-03AA-495F-B0F5-0F057E126E2A}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{D13DC65C-C77B-4986-9078-DEA3D34C71BB}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{371AD4A5-1520-4AA2-A8A4-F9AD3BAC6957}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{7F124846-5453-4BB8-A41D-E11481FFC9DF}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{8FD65019-BF09-45DA-AD81-E95AE911F1FD}
    [-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{B722ED8B-0B38-408E-BB89-260C73BCF3D4}
    [-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}
    [-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{61A2027D-B837-4080-A925-6E30E10DEF32}
    [-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{F6C2BABA-9E4C-425F-9AEC-24AB8F2B640D}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B13EC3E-999A-4B70-B9CB-2617B8323822}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7B13EC3E-999A-4B70-B9CB-2617B8323822}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
    [-] Key deleted: HKU\.DEFAULT\Software\Yahoo\Companion
    [-] Key deleted: HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Yahoo\Companion
    [-] Key deleted: HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Yahoo\YFriendsBar
    [-] Key deleted: HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\AppDataLow\Software\Yahoo\Companion
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1137620820-469648318-63125674-1001\Software\Yahoo\Companion
    [#] Key deleted on reboot: HKU\S-1-5-18\Software\Yahoo\Companion
    [#] Key deleted on reboot: HKCU\Software\Yahoo\Companion
    [#] Key deleted on reboot: HKCU\Software\Yahoo\YFriendsBar
    [#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Yahoo\Companion
    [-] Key deleted: HKLM\SOFTWARE\Yahoo\Companion
    [-] Key deleted: HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Internet Explorer\SearchScopes\{24FDD0CA-702A-485E-8F15-9F28ADAA3BA4}
    [#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{24FDD0CA-702A-485E-8F15-9F28ADAA3BA4}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24FDD0CA-702A-485E-8F15-9F28ADAA3BA4}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}
    [-] Data restored: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope] {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
    [-] Key deleted: HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\yt.DLL
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\ytbbroker.EXE
    [-] Key deleted: HKLM\SOFTWARE\Google\Chrome\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole


    ***** [ Web browsers ] *****



    *************************

    :: "Tracing" keys deleted
    :: Winsock settings cleared

    *************************

    C:\AdwCleaner\AdwCleaner[C0].txt - [9945 Bytes] - [09/02/2017 17:12:03]
    C:\AdwCleaner\AdwCleaner[S0].txt - [9566 Bytes] - [09/02/2017 09:29:49]

    ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [10091 Bytes] ##########
     
    dodopie,
    #6
  8. 2017/02/09
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.1.0 (12.05.2016)
    Operating System: Windows Vista (TM) Home Premium x86
    Ran by Tori (Administrator) on Thu 02/09/2017 at 17:30:43.92
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 19

    Successfully deleted: C:\Program Files\GUT4441.tmp (File)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\63IAIJ1Q (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A9QI6X6O (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D8I6F62W (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DRUQGZSC (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E5A3B54Z (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GU5247F9 (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LD43Z88V (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NBX6WAB4 (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\Tori\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WM344OA7 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\63IAIJ1Q (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A9QI6X6O (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D8I6F62W (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DRUQGZSC (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E5A3B54Z (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GU5247F9 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LD43Z88V (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NBX6WAB4 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WM344OA7 (Temporary Internet Files Folder)



    Registry: 3

    Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SBRegRebootCleaner (Registry Value)
    Successfully deleted: HKLM\Software\Wow6432Node\Google\Chrome\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole (Registry Key)
    Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6} (Registry Key)




    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Thu 02/09/2017 at 17:38:34.19
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
    dodopie,
    #7
  9. 2017/02/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    What about my question:
    [​IMG] Does the issue happen in all browsers?

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: Metadefender Endpoint Management
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: Downloading RKill
    iExplore.exe (renamed rKill.exe): Downloading RKill

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
    broni,
    #8
  10. 2017/02/09
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    the only other browser on this computer is IE and it won't work at all. The Chrome seems to be better now
     
    dodopie,
    #9
  11. 2017/02/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

    • Double click to run it.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
    broni,
    #10
  12. 2017/02/10
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    ComboFix 17-01-29.01 - Tori 02/09/2017 21:31:41.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.1053 [GMT -5:00]
    Running from: c:\users\Tori\Desktop\ComboFix.exe
    AV: Avast Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    SP: Avast Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files\Extension Changer\extmain.exe
    c:\users\Tori\Desktop\Setup.exe
    c:\users\Tori\wkwcedev.001
    c:\windows\system32\DEBUG.log
    c:\windows\system32\drivers\npf.sys
    c:\windows\system32\Packet.dll
    c:\windows\system32\pthreadVC.dll
    c:\windows\system32\SET231F.tmp
    c:\windows\system32\SETEDB0.tmp
    c:\windows\system32\skinboxer43.dll
    c:\windows\system32\WanPacket.dll
    c:\windows\system32\wpcap.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2017-01-10 to 2017-02-10 )))))))))))))))))))))))))))))))
    .
    .
    2017-02-10 06:50 . 2017-02-10 06:51 -------- d-----w- c:\users\Tori\AppData\Local\temp
    2017-02-10 06:50 . 2017-02-10 06:50 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
    2017-02-10 06:50 . 2017-02-10 06:50 -------- d-----w- c:\users\IUSR_NMPR\AppData\Local\temp
    2017-02-10 06:50 . 2017-02-10 06:50 -------- d-----w- c:\users\Default\AppData\Local\temp
    2017-02-09 14:24 . 2017-02-09 22:12 -------- d-----w- C:\AdwCleaner
    2017-02-09 03:52 . 2017-02-09 03:52 -------- d-----w- c:\program files\Malwarebytes
    2017-02-09 02:26 . 2017-02-09 02:26 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2017-02-09 02:25 . 2017-02-09 02:26 -------- d-----w- c:\program files\RogueKiller
    2017-02-09 02:25 . 2017-02-09 04:05 -------- d-----w- c:\programdata\RogueKiller
    2017-02-08 17:19 . 2017-02-08 17:24 -------- d-----w- C:\FRST
    2017-02-07 04:38 . 2017-02-07 04:38 40256 ----a-w- c:\windows\system32\DbxSvc.exe
    2017-02-07 04:38 . 2017-02-07 04:38 35440 ----a-w- c:\windows\system32\drivers\dbx-stable.sys
    2017-02-07 04:38 . 2017-02-07 04:38 35440 ----a-w- c:\windows\system32\drivers\dbx-dev.sys
    2017-02-07 04:38 . 2017-02-07 04:38 35440 ----a-w- c:\windows\system32\drivers\dbx-canary.sys
    2017-01-15 17:16 . 2017-01-15 17:16 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
    2017-01-15 17:15 . 2017-01-15 17:15 -------- d--h--w- c:\programdata\CanonBJ
    2017-01-15 17:03 . 2010-03-19 00:25 307200 ----a-w- c:\windows\system32\CNC280L.dll
    2017-01-15 17:03 . 2010-03-18 22:12 1335296 ----a-w- c:\windows\system32\CNC280C.dll
    2017-01-15 17:03 . 2010-03-18 22:12 114688 ----a-w- c:\windows\system32\CNC280I.dll
    2017-01-15 17:03 . 2010-03-18 22:11 106496 ----a-w- c:\windows\system32\CNC280U.dll
    2017-01-11 08:15 . 2017-01-05 16:57 1259008 ----a-w- c:\windows\system32\lsasrv.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2017-01-11 03:50 . 2013-06-29 17:04 802904 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2017-01-11 03:50 . 2013-06-29 17:04 144472 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2016-12-01 07:18 . 2016-12-01 07:18 875712 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
    2016-12-01 07:18 . 2016-12-01 07:18 536768 ----a-w- c:\windows\system32\msvcp120_clr0400.dll
    2016-12-01 07:18 . 2016-12-01 07:18 28352 ----a-w- c:\windows\system32\aspnet_counters.dll
    2016-12-01 07:18 . 2016-12-01 07:18 18088 ----a-w- c:\windows\system32\msvcr110_clr0400.dll
    2016-12-01 07:18 . 2016-12-01 07:18 18088 ----a-w- c:\windows\system32\msvcr100_clr0400.dll
    2016-12-01 07:18 . 2016-12-01 07:18 18088 ----a-w- c:\windows\system32\msvcp110_clr0400.dll
    2016-11-20 16:55 . 2016-12-18 08:05 83968 ----a-w- c:\windows\system32\hlink.dll
    2016-11-20 14:16 . 2016-12-18 08:01 276992 ----a-w- c:\windows\system32\bcrypt.dll
    2016-11-20 14:07 . 2016-12-18 08:01 444136 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2016-11-16 17:55 . 2016-12-18 08:05 244968 ----a-w- c:\windows\system32\clfs.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt01]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt02]
    @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt03]
    @="{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt04]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt05]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt06]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt07]
    @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt08]
    @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt09]
    @="{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt10]
    @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
    2017-02-07 04:45 236872 ----a-w- c:\program files\Dropbox\Client\DropboxExt.14.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2016-08-30 18:09 832488 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Logitech Vid"="c:\program files\Logitech\Logitech Vid\Vid.exe" [2009-07-16 5458704]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2012-05-25 6595928]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CCUTRAYICON"="FactoryMode" [X]
    "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
    "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-11-15 151552]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
    "LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 4390912]
    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-25 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-25 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-25 133656]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2015-11-09 596528]
    "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2016-11-15 9080768]
    "Dropbox"="c:\program files\Dropbox\Client\Dropbox.exe" [2017-02-07 26220296]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-07 44168]
    .
    c:\users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111v2.exe [2009-3-25 1724416]
    NETGEAR WNA1100 Smart Wizard.lnk - c:\program files\NETGEAR\WNA1100\WNA1100.exe [2016-6-7 4545024]
    Snapfish Media Detector.lnk - c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe [2007-3-2 1441792]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    "SoftwareSASGeneration"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "MemCheckBoxInRunDlg"= 1 (0x1)
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveTrack"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1137620820-469648318-63125674-1001]
    "EnableNotifications"=dword:00000001
    "EnableNotificationsRef"=dword:00000001
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - ESProtectionDriver
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2016-04-07 17:08 1106072 ----a-w- c:\program files\Google\Chrome\Application\49.0.2623.112\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2017-02-10 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-29 03:50]
    .
    2017-02-09 c:\windows\Tasks\DropboxUpdateTaskMachineCore.job
    - c:\program files\Dropbox\Update\DropboxUpdate.exe [2015-12-01 20:52]
    .
    2017-02-10 c:\windows\Tasks\DropboxUpdateTaskMachineUA.job
    - c:\program files\Dropbox\Update\DropboxUpdate.exe [2015-12-01 20:52]
    .
    .
    ------- Supplementary Scan -------
    .
    mStart Page = hxxp://www.yahoo.com/?ilc=8
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    Trusted Zone: driversupport.com\apps
    TCP: DhcpNameServer = 192.168.1.254
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKLM-Run-hpqSRMon - (no file)
    HKLM-Run-jswtrayutil - c:\program files\NETGEAR\WNA1100\jswtrayutil.exe
    c:\users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk - c:\program files\ZooskMessenger\ZooskMessenger.exe
    SafeBoot-WudfPf
    SafeBoot-WudfRd
    SafeBoot-MBAMService
    AddRemove-Sunshine PC - c:\program files\Sunshine\Sunshine PC\uninstall.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2017-02-10 01:51
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2017-02-10 01:55:46
    ComboFix-quarantined-files.txt 2017-02-10 06:55
    .
    Pre-Run: 196,793,925,632 bytes free
    Post-Run: 203,571,638,272 bytes free
    .
    - - End Of File - - 3F5CED5F2EA84B95E5F3DE23E4C95A1C
    8913823FF508CCF109DB74B636C301DA
     
    dodopie,
    #11
  13. 2017/02/10
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-02-2017
    Ran by Tori (administrator) on TORI-PC (10-02-2017 07:19:08)
    Running from C:\Users\Tori\Desktop
    Loaded Profiles: Tori (Available Profiles: IUSR_NMPR & Tori)
    Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (Dropbox, Inc.) C:\WINDOWS\System32\DbxSvc.exe
    () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehrecvr.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehsched.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    (Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (Google Inc.) C:\Program Files\Google\Update\1.3.32.7\GoogleCrashHandler.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxsrvc.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [hpsysdrv] => c:\hp\support\hpsysdrv.exe [65536 2006-09-28] (Hewlett-Packard Company)
    HKLM\...\Run: [KBD] => C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
    HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-11-15] (Intel Corporation)
    HKLM\...\Run: [CCUTRAYICON] => FactoryMode
    HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-10-14] (Hewlett-Packard)
    HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
    HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4390912 2007-03-01] (Realtek Semiconductor)
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1311312 2010-06-25] (Logitech, Inc.)
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-15] (AVAST Software)
    HKLM\...\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [26220296 2017-02-06] (Dropbox, Inc.)
    HKLM\...\RunOnce: [Launcher] => C:\Windows\SMINST\launcher.exe [44168 2007-03-07] (soft thinks)
    HKLM\...\Policies\Explorer: [MemCheckBoxInRunDlg] 1
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Logitech Vid] => C:\Program Files\Logitech\Logitech Vid\Vid.exe [5458704 2009-07-16] (Logitech Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [221184 2008-01-19] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.14.0.dll [2017-02-06] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-08-30] (AVAST Software)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2012-03-17]
    ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WN111v2 Smart Wizard.lnk [2013-08-18]
    ShortcutTarget: NETGEAR WN111v2 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WN111v2\WN111v2.exe (NETGEAR)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Smart Wizard.lnk [2016-06-07]
    ShortcutTarget: NETGEAR WNA1100 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WNA1100\WNA1100.exe ()
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk [2007-04-21]
    ShortcutTarget: Snapfish Media Detector.lnk -> C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe ()
    Startup: C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2009-10-31]
    ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{2E0AA886-5EBF-401D-B070-6204C97B6624}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{435B15BB-F8C5-4712-9E94-F75174A18D50}: [DhcpNameServer] 208.59.247.45 208.59.247.46
    Tcpip\..\Interfaces\{5D2835A6-C339-499D-A5C8-A58D50CBC840}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{7F33EFC5-70C0-4B52-B39A-8F7FCDA6A7AD}: [DhcpNameServer] 75.114.81.1 75.114.81.2
    Tcpip\..\Interfaces\{FE880611-5A3F-4E43-8528-9B371CDA42BE}: [DhcpNameServer] 65.32.5.111 65.32.5.112

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=8
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
    SearchScopes: HKLM -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&amp;entrypoint={referrer:source?}&amp;FORM=HVDUS7
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> DefaultScope {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=chr-tyc-inbox
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://www.bing.com/search?FORM=UP94DF&PC=UP94&dt=072313&q={searchTerms}&src=IE-SearchBox
    BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23] (Adobe Systems Incorporated)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-20] (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-10-24] (AVAST Software)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-20] (Oracle Corporation)
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

    FireFox:
    ========
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: (Microsoft .NET Framework Assistant) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-10-22] [not signed]
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-08-30]
    FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
    FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-08-30]
    FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-20] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-20] (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @real.com/nppl3260;version=6.0.11.2571 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprjplug;version=1.0.2.2629 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 -> C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll [2006-03-31] (RealNetworks, Inc.)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)

    Chrome:
    =======
    CHR Profile: C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default [2017-02-10]
    CHR Extension: (ConvertAnyFile) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\elldknmoogdfipmglklpbkoppgeipbfa [2016-10-02]
    CHR Extension: (Avast Online Security) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-02-09]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-02-09]
    CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation) [File not signed]
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-08-30] (AVAST Software)
    S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [40256 2017-02-06] (Dropbox, Inc.)
    R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] () [File not signed]
    R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [139264 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 IAANTMON; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [81920 2006-11-15] (Intel Corporation) [File not signed]
    S3 IDriverT; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
    S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation) [File not signed]
    S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 jswpsapi; C:\Program Files\NETGEAR\WNA1100\jswpsapi.exe [960992 2010-03-22] (Atheros Communications, Inc.)
    R2 LightScribeService; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
    S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-09-01] () [File not signed]
    S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation) [File not signed]
    R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
    R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
    S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
    R2 WSWNA1100; C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe [266240 2010-08-04] () [File not signed]

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34008 2016-08-30] (AVAST Software)
    R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [35096 2016-08-30] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [92256 2016-08-30] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [64272 2016-08-30] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [60424 2016-08-30] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [735488 2016-09-13] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [433768 2016-09-22] (AVAST Software)
    R3 aswStmXP; C:\Windows\system32\drivers\aswStmXP.sys [184592 2016-08-30] (AVAST Software)
    S3 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [66688 2016-08-30] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [224752 2016-10-13] (AVAST Software)
    R3 athur; C:\Windows\System32\DRIVERS\athur.sys [1439744 2010-10-10] (Atheros Communications, Inc.)
    S3 DNIMp50; C:\Windows\System32\Drivers\DNIMp50.sys [21504 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    S3 DNISp50; C:\Windows\System32\Drivers\DNISp50.sys [20480 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-06-29] (GFI Software)
    S3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE2500vista.sys [1073216 2011-03-30] (Broadcom Corporation)
    R3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25752 2009-10-07] ()
    S3 LVUSBSta; C:\Windows\System32\drivers\lvusbsta.sys [41248 2006-12-15] (Logitech Inc.)
    R1 SBRE; C:\Windows\system32\drivers\SBREDrv.sys [101720 2011-11-01] (Sunbelt Software)
    R0 SCMNdisP; C:\Windows\System32\DRIVERS\scmndisp.sys [21728 2007-01-19] (Windows (R) Codename Longhorn DDK provider)
    S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)
    S3 WN111v2; C:\Windows\System32\DRIVERS\WN111v2v.sys [453120 2009-01-13] (Atheros Communications, Inc.)
    S3 AndNetDiag; system32\DRIVERS\lgandnetdiag.sys [X]
    S3 ANDNetModem; system32\DRIVERS\lgandnetmodem.sys [X]
    U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
    S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
    U3 catchme; \??\C:\Users\Tori\AppData\Local\Temp\catchme.sys [X] <==== ATTENTION
    S3 dbx; system32\DRIVERS\dbx.sys [X]
    S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
    S3 LVcKap; system32\DRIVERS\LVcKap.sys [X]
    S3 LVMVDrv; system32\DRIVERS\LVMVDrv.sys [X]
    S3 LVRS; system32\DRIVERS\lvrs.sys [X]
    S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
    S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
    S3 pepifilter; system32\DRIVERS\lv302af.sys [X]
    S3 PID_PEPI; system32\DRIVERS\LV302V32.SYS [X]
    U3 mbr; \??\C:\ComboFix\mbr.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-02-10 07:19 - 2017-02-10 07:19 - 00019746 _____ C:\Users\Tori\Desktop\FRST.txt
    2017-02-10 01:55 - 2017-02-10 01:55 - 00014070 _____ C:\ComboFix.txt
    2017-02-09 21:28 - 2011-06-26 01:45 - 00256000 _____ C:\Windows\PEV.exe
    2017-02-09 21:28 - 2010-11-07 12:20 - 00208896 _____ C:\Windows\MBR.exe
    2017-02-09 21:28 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2017-02-09 21:28 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2017-02-09 21:28 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2017-02-09 21:28 - 2000-08-30 19:00 - 00098816 _____ C:\Windows\sed.exe
    2017-02-09 21:28 - 2000-08-30 19:00 - 00080412 _____ C:\Windows\grep.exe
    2017-02-09 21:28 - 2000-08-30 19:00 - 00068096 _____ C:\Windows\zip.exe
    2017-02-09 21:22 - 2017-02-10 01:55 - 00000000 ____D C:\Qoobox
    2017-02-09 21:21 - 2017-02-10 01:54 - 00000000 ____D C:\Windows\erdnt
    2017-02-09 21:21 - 2017-02-09 21:18 - 05659775 ____R (Swearware) C:\Users\Tori\Desktop\ComboFix.exe
    2017-02-09 17:38 - 2017-02-09 17:38 - 00003941 _____ C:\Users\Tori\Desktop\JRT.txt
    2017-02-09 09:24 - 2017-02-09 17:12 - 00000000 ____D C:\AdwCleaner
    2017-02-09 09:23 - 2017-02-09 09:23 - 01663040 _____ (Malwarebytes) C:\Users\Tori\Desktop\JRT.exe
    2017-02-09 09:19 - 2017-02-09 09:19 - 00002292 _____ C:\Users\Tori\Desktop\malwaretxt.txt
    2017-02-08 22:52 - 2017-02-08 22:52 - 00000000 ____D C:\Program Files\Malwarebytes
    2017-02-08 21:26 - 2017-02-08 21:26 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
    2017-02-08 21:26 - 2017-02-08 21:26 - 00000802 _____ C:\Users\Public\Desktop\RogueKiller.lnk
    2017-02-08 21:26 - 2017-02-08 21:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
    2017-02-08 21:25 - 2017-02-08 23:05 - 00000000 ____D C:\ProgramData\RogueKiller
    2017-02-08 21:25 - 2017-02-08 21:26 - 00000000 ____D C:\Program Files\RogueKiller
    2017-02-08 21:24 - 2017-02-08 21:23 - 04015056 _____ C:\Users\Tori\Desktop\AdwCleaner.exe
    2017-02-08 21:22 - 2017-02-08 21:22 - 55566792 _____ (Malwarebytes ) C:\Users\Tori\Desktop\mb3-setup-consumer-3.0.6.1469.exe
    2017-02-08 12:19 - 2017-02-10 07:19 - 00000000 ____D C:\FRST
    2017-02-08 12:18 - 2017-02-08 12:17 - 01763328 _____ (Farbar) C:\Users\Tori\Desktop\FRST.exe
    2017-02-07 18:29 - 2017-02-07 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
    2017-02-06 23:38 - 2017-02-06 23:38 - 00040256 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
    2017-02-06 23:38 - 2017-02-06 23:38 - 00035440 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
    2017-02-06 23:38 - 2017-02-06 23:38 - 00035440 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
    2017-02-06 23:38 - 2017-02-06 23:38 - 00035440 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
    2017-01-28 06:34 - 2017-01-28 06:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    2017-01-27 16:22 - 2017-01-27 16:22 - 00044544 _____ C:\Users\Tori\Downloads\tori (2).pdf
    2017-01-27 16:22 - 2017-01-27 16:22 - 00044544 _____ C:\Users\Tori\Downloads\tori (1).pdf
    2017-01-27 15:59 - 2017-01-27 15:59 - 00044544 _____ C:\Users\Tori\Downloads\tori.pdf
    2017-01-15 12:16 - 2017-01-15 12:16 - 00000000 ___HD C:\Windows\system32\CanonIJ Uninstaller Information
    2017-01-15 12:16 - 2017-01-15 12:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP280 series
    2017-01-15 12:15 - 2017-01-15 12:15 - 00000000 ___HD C:\ProgramData\CanonBJ
    2017-01-15 12:03 - 2010-03-18 19:25 - 00307200 _____ (CANON INC.) C:\Windows\system32\CNC280L.dll
    2017-01-15 12:03 - 2010-03-18 17:12 - 01335296 _____ (CANON INC.) C:\Windows\system32\CNC280C.dll
    2017-01-15 12:03 - 2010-03-18 17:12 - 00114688 _____ (CANON INC.) C:\Windows\system32\CNC280I.dll
    2017-01-15 12:03 - 2010-03-18 17:11 - 00106496 _____ (CANON INC.) C:\Windows\system32\CNC280U.dll
    2017-01-15 11:21 - 2017-01-15 11:21 - 00211640 _____ C:\Windows\Minidump\Mini011517-01.dmp
    2017-01-11 03:15 - 2017-01-05 11:57 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-02-10 07:17 - 2006-11-02 07:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    2017-02-10 07:17 - 2006-11-02 07:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    2017-02-10 06:49 - 2013-06-29 12:04 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
    2017-02-10 06:21 - 2015-12-01 11:47 - 00000892 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
    2017-02-10 01:51 - 2006-11-02 05:23 - 00000215 _____ C:\Windows\system.ini
    2017-02-10 01:49 - 2015-12-01 16:14 - 00000000 ____D C:\Program Files\Extension Changer
    2017-02-10 01:49 - 2009-10-20 09:11 - 00000000 ____D C:\Users\Tori
    2017-02-09 18:21 - 2015-12-01 11:47 - 00000888 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
    2017-02-09 17:23 - 2015-12-01 11:51 - 00000000 ___RD C:\Users\Tori\Dropbox
    2017-02-09 17:19 - 2007-04-21 06:29 - 00000000 ____D C:\Windows\SMINST
    2017-02-09 17:17 - 2006-11-02 08:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2017-02-09 17:17 - 2006-11-02 07:37 - 00000000 ___RD C:\Users\Public\Recorded TV
    2017-02-09 17:16 - 2006-11-02 08:01 - 00032556 _____ C:\Windows\Tasks\SCHEDLGU.TXT
    2017-02-09 09:51 - 2011-06-19 14:37 - 00000000 ____D C:\Users\Tori\AppData\LocalLow\Yahoo!
    2017-02-09 00:08 - 2015-09-29 11:39 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs
    2017-02-08 22:32 - 2015-12-01 13:24 - 00000000 ____D C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sunshine PC
    2017-02-08 22:32 - 2013-07-23 07:21 - 00000000 ____D C:\Users\Tori\AppData\Roaming\Yahoo!
    2017-02-08 22:32 - 2007-04-21 06:21 - 00000000 ____D C:\Program Files\Yahoo!
    2017-02-08 11:54 - 2016-07-26 20:50 - 00000000 ___RD C:\Users\Tori\Desktop\****
    2017-02-08 11:50 - 2015-12-01 11:47 - 00000000 ____D C:\Program Files\Dropbox
    2017-02-06 15:44 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\inf
    2017-02-06 15:44 - 2006-11-02 05:33 - 00778466 _____ C:\Windows\system32\PerfStringBackup.INI
    2017-01-28 06:34 - 2013-06-29 11:24 - 00000000 ____D C:\Program Files\Google
    2017-01-27 16:40 - 2009-10-31 13:28 - 00012414 _____ C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2017-01-15 11:21 - 2014-08-20 18:28 - 281032561 _____ C:\Windows\MEMORY.DMP
    2017-01-15 11:21 - 2010-06-05 14:08 - 00000000 ____D C:\Windows\Minidump
    2017-01-11 03:15 - 2013-09-06 15:18 - 00000000 ____D C:\Windows\system32\MRT
    2017-01-11 03:01 - 2006-11-02 05:24 - 133456224 ____C (Microsoft Corporation) C:\Windows\system32\mrt.exe

    ==================== Files in the root of some directories =======

    2010-10-24 07:32 - 2010-10-24 07:33 - 0000513 _____ () C:\Users\Tori\AppData\Roaming\com.zoosk.Desktop_state.xml
    2012-02-18 18:36 - 2012-02-18 18:36 - 0011248 _____ () C:\Users\Tori\AppData\Roaming\UserTile.png
    2009-10-31 13:28 - 2017-01-27 16:40 - 0012414 _____ () C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2010-02-10 16:43 - 2016-11-29 16:43 - 0052736 _____ () C:\Users\Tori\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2007-04-21 05:58 - 2016-07-14 10:11 - 0009390 _____ () C:\ProgramData\hpzinstall.log

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2017-02-10 05:47

    ==================== End of FRST.txt ============================
     
    dodopie,
    #12
  14. 2017/02/10
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 05-02-2017
    Ran by Tori (10-02-2017 07:20:14)
    Running from C:\Users\Tori\Desktop
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) (2009-10-20 17:03:37)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1137620820-469648318-63125674-500 - Administrator - Disabled)
    Guest (S-1-5-21-1137620820-469648318-63125674-501 - Limited - Enabled)
    IUSR_NMPR (S-1-5-21-1137620820-469648318-63125674-1000 - Limited - Disabled) => C:\Users\IUSR_NMPR
    Tori (S-1-5-21-1137620820-469648318-63125674-1001 - Administrator - Enabled) => C:\Users\Tori

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Avast Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Avast Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    2600 (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    2600_Help (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    2600Trb (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
    Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
    Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
    Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.0.3.13070 - Adobe Systems Inc.)
    Adobe Flash Player 24 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 24.0.0.194 - Adobe Systems Incorporated)
    Adobe Reader 8 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A80000000002}) (Version: 8.0.0 - Adobe Systems Incorporated)
    AIO_CDB_ProductContext (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    AIO_CDB_Software (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    AiO_Scan (Version: 43.0.217.000 - Hewlett-Packard) Hidden
    AIO_Scan (Version: 82.0.173.000 - Hewlett-Packard) Hidden
    AndroChef Java Decompiler (HKLM\...\{8DC30045-8565-492C-A6C4-30DEFF1169DE}) (Version: 1.0.0.12 - Atanas Neshkov)
    Avast Free Antivirus (HKLM\...\Avast) (Version: 12.3.2280 - AVAST Software)
    BufferChm (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version: - )
    Cards_Calendar_OrderGift_DoMorePlugout (Version: 1.00.0000 - Hewlett-Packard) Hidden
    CCleaner (HKLM\...\CCleaner) (Version: 3.15 - Piriform)
    Copy (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Destination Component (Version: 100.0.0.0 - Hewlett-Packard) Hidden
    DeviceDiscovery (Version: 100.0.190.000 - Hewlett-Packard) Hidden
    DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_ProductContext (Version: 100.0.215.000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_Software (Version: 100.0.206.000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_Software_Min (Version: 100.0.213.000 - Hewlett-Packard) Hidden
    DocProc (Version: 10.0.0.0 - Hewlett-Packard) Hidden
    Dropbox (HKLM\...\Dropbox) (Version: 19.4.13 - Dropbox, Inc.)
    Dropbox Update Helper (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
    EE Full (HKLM\...\{C087A7EF-E572-4A39-B7EE-B1391B12D516}) (Version: 1.0.0.0 - )
    Enhanced Multimedia Keyboard Solution (HKLM\...\KBD) (Version: - Hewlett-Packard)
    eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
    Extension Changer (HKLM\...\Extension Changer) (Version: 0.5 - Yehia A.Salam)
    Fax (Version: 82.0.188.000 - Hewlett-Packard) Hidden
    Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
    Google Earth (HKLM\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
    Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.32.7 - Google Inc.) Hidden
    GPBaseService (Version: 100.0.187.000 - Hewlett-Packard) Hidden
    Hardware Diagnostic Tools (HKLM\...\PC-Doctor 5 for Windows) (Version: 5.00.4424.15 - PC-Doctor, Inc.)
    HP Advisor (HKLM\...\{73A43E42-3658-4DD9-8551-FACDA3632538}) (Version: 3.1.9152.3107 - Hewlett-Packard)
    HP Customer Experience Enhancements (HKLM\...\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}) (Version: 5.1.0.2264 - Hewlett-Packard)
    HP Customer Participation Program 10.0 (HKLM\...\HPExtendedCapabilities) (Version: 10.0 - HP)
    HP Deskjet F4200 All-In-One Driver Software 10.0 Rel .3 (HKLM\...\{AE9A67F9-ADF1-4a44-BAB5-C1DB302B37A2}) (Version: 10.0 - HP)
    HP Easy Setup - Frontend (HKLM\...\{40F7AED3-0C7D-4582-99F6-484A515C73F2}) (Version: 5.1.0.2269 - Hewlett-Packard)
    HP Imaging Device Functions 10.0 (HKLM\...\HP Imaging Device Functions) (Version: 10.0 - HP)
    HP On-Screen Cap/Num/Scroll Lock Indicator (HKLM\...\OsdMaestro) (Version: - Hewlett-Packard)
    HP Photosmart C4400 All-In-One Driver Software 10.0 Rel .3 (HKLM\...\{FF1F4E8E-A833-4c4b-A14A-45D5B841B5D8}) (Version: 10.0 - HP)
    HP Photosmart Essential (HKLM\...\{EB21A812-671B-4D08-B974-2A347F0D8F70}) (Version: 1.12.0.46 - HP)
    HP Photosmart Essential 2.5 (HKLM\...\HP Photosmart Essential) (Version: 2.5 - HP)
    HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B (HKLM\...\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}) (Version: 8.0 - HP)
    HP Smart Web Printing (HKLM\...\HP Smart Web Printing) (Version: 3.5 - HP)
    HP Solution Center 10.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 10.0 - HP)
    HP Update (HKLM\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
    HPPhotoSmartPhotobookWebPack1 (Version: 1.00.0000 - Hewlett-Packard) Hidden
    HPProductAssistant (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    HPSSupply (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
    Intel(R) Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - )
    Intel® Viiv™ Software (HKLM\...\Intel(R) Configuration Center) (Version: 1.6.361.6 - Intel Corporation)
    Java 8 Update 66 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
    LG PC Suite (HKLM\...\LG PC Suite) (Version: 5.3.25.20150529 - LG Electronics)
    LG United Mobile Drivers (HKLM\...\{4DE95ED9-0A29-4C4F-8463-35857CF9BA36}) (Version: 3.14.1 - LG Electronics)
    LightScribe 1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
    Logitech Legacy USB Camera Driver Package (HKLM\...\legacyqcam_10.50) (Version: 10.50.1091 - )
    Logitech SetPoint 6.15 (HKLM\...\SP6) (Version: 6.15.25 - Logitech)
    Logitech Vid (HKLM\...\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}) (Version: 1.10.1009 - Logitech Inc.)
    Logitech Webcam Software (HKLM\...\{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}) (Version: 12.10.1113 - Logitech Inc.)
    MarketResearch (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (HKLM\...\{90120000-00B2-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Works (HKLM\...\{6D52C408-B09A-4520-9B18-475B81D393F1}) (Version: 08.05.0818 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    muvee autoProducer 6.0 (HKLM\...\{6AF49698-949A-4C89-9B31-041D2CCB5FBD}) (Version: 6.00.050 - muvee Technologies)
    My HP Games (HKLM\...\WildTangent hpdesktop Master Uninstall) (Version: HPCMPQ1701 - WildTangent)
    NETGEAR WNA1100 N150 Wireless USB Adapter (HKLM\...\{A2AE9709-283B-4B48-AA34-729C070A62FB}) (Version: 1.0.0.133 - NETGEAR)
    OCR Software by I.R.I.S. 10.0 (HKLM\...\HPOCR) (Version: 10.0 - HP)
    OpenOffice 4.0.1 (HKLM\...\{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}) (Version: 4.01.9714 - Apache Software Foundation)
    PanoStandAlone (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_ProductContext (Version: 100.0.215.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_Software (Version: 100.0.206.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_Software_Min (Version: 100.0.213.000 - Hewlett-Packard) Hidden
    PSSWCORE (Version: 2.02.0000 - Hewlett-Packard) Hidden
    Python 2.4.3 (HKLM\...\{75E71ADD-042C-4F30-BFAC-A9EC42351313}) (Version: 2.4.3150 - Martin v. Löwis)
    RangeMax Wireless-N USB Adapter WN111v2 (HKLM\...\InstallShield_{1C0E9C6B-D4D5-4D3C-8A10-F10A3E7BEEA5}) (Version: 2.00.0000 - NETGEAR)
    RealPlayer (HKLM\...\RealPlayer 6.0) (Version: - RealNetworks)
    Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5789 - Realtek Semiconductor Corp.)
    Rhapsody (HKLM\...\Rhapsody) (Version: - )
    Rhapsody Player Engine (HKLM\...\{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}) (Version: 1.0.604 - RealNetworks)
    RogueKiller version 12.9.7.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.9.7.0 - Adlice Software)
    Roxio Creator Audio (HKLM\...\{83FFCFC7-88C6-41c6-8752-958A45325C82}) (Version: 3.4.0 - Roxio)
    Roxio Creator Basic v9 (HKLM\...\{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}) (Version: 3.4.0 - Roxio)
    Roxio Creator Copy (HKLM\...\{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}) (Version: 3.4.0 - Roxio)
    Roxio Creator Data (HKLM\...\{0D397393-9B50-4c52-84D5-77E344289F87}) (Version: 3.4.0 - Roxio)
    Roxio Creator EasyArchive (HKLM\...\{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}) (Version: 3.4.0 - Roxio)
    Roxio Creator Tools (HKLM\...\{0394CDC8-FABD-4ed8-B104-03393876DFDF}) (Version: 3.4.0 - Roxio)
    Roxio Express Labeler 3 (HKLM\...\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 3.2.1 - Roxio)
    Roxio MyDVD Basic v9 (HKLM\...\{938B1CD7-7C60-491E-AA90-1F1888168240}) (Version: 9.0.559 - Roxio)
    RTC Client API v1.2 (HKLM\...\{44CDBD1B-89FB-4E02-8319-2A4C550F664A}) (Version: 1.2.0000 - Microsoft)
    SafeZone Stable 1.48.2066.120 (Version: 1.48.2066.120 - Avast Software) Hidden
    Scan (Version: 10.1.0.0 - Hewlett-Packard) Hidden
    Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 10.0 - HP)
    SmartWebPrintingOC (Version: 100.0.189.000 - Hewlett-Packard) Hidden
    Snapfish Media Detector (HKLM\...\{4EF6FDB0-3B11-4820-9860-8E08E9965195}) (Version: 1.7.0.15 - HP Snapfish)
    Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1) (Version: 7.74.00 - Conexant Systems)
    SolutionCenter (Version: 100.0.175.000 - Hewlett-Packard) Hidden
    Status (Version: 100.0.175.000 - Hewlett-Packard) Hidden
    Toolbox (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Toolbox (Version: 82.0.173.000 - Hewlett-Packard) Hidden
    TrayApp (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    UnloadSupport (Version: 10.0.0 - Hewlett-Packard) Hidden
    VideoToolkit01 (Version: 100.0.128.000 - Hewlett-Packard) Hidden
    Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
    WebReg (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    WN111v2 (Version: 2.00.0000 - NETGEAR) Hidden
    Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
    Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - Yahoo! Inc.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00021401-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 -> C:\Windows\system32\mswinsck.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 -> C:\Windows\system32\mswinsck.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{32E26FD9-F435-4A20-A561-35D4B987CFDC}\InprocServer32 -> c:\programdata\webex\924\atucfobj.dll (WebEx Communications Inc.)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE3-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{477A3783-2D4D-11D3-B244-444553540000}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6352-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6353-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6354-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6355-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6356-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6357-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6359-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> C:\Windows\system32\urlmon.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa72-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa73-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa74-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa83-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa88-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa89-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa8f-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa92-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa93-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa94-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa95-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{CD773740-B187-4974-A1D5-E0FF91372277}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InprocServer32 -> no filepath

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {4FA38426-9AFD-4185-9B03-E217B2E1F355} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-08-30] (AVAST Software)
    Task: {60BEC739-0380-410D-B334-C30E1582211E} - System32\Tasks\{82BFA003-5420-4828-BFD6-DE291CBA9854} => pcalua.exe -a E:\AOLSETUP.EXE -d E:\
    Task: {87EB81E7-622A-47D7-8791-778D87482306} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {9D9D408E-5E19-4E7E-9E7E-E3251ACFE470} - System32\Tasks\{446F2DB2-C365-478F-BB1C-F9855EA21D4F} => pcalua.exe -a "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" -d "C:\Program Files\HP\Digital Imaging\bin" -c -inst "#Hewlett-Packard#HP Photosmart 2600 series#1278605344" -d "HP Photosmart 2600 series"
    Task: {B1E95ABF-FD81-4AA4-A721-E85EFB97EEA6} - System32\Tasks\{DE1E14F6-5C0B-4325-ACD5-6529E07DEA9E} => pcalua.exe -a E:\setup.exe -d E:\
    Task: {BA03F5AC-EFD2-4D50-95B8-F5B8456D7ECD} - System32\Tasks\SafeZone scheduled Autoupdate 1463521888 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-12] (Avast Software)
    Task: {BEFAF415-CC21-44C0-A50B-AE6EFBC43069} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-10] (Adobe Systems Incorporated)
    Task: {C2E3D536-DBA7-41F2-A56E-5B208E233C3B} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
    Task: {CD4C578E-AB63-4F8A-9C5E-3DA54FB93F13} - System32\Tasks\{17CB9E1B-FB64-4438-8EAF-820620F944C5} => pcalua.exe -a E:\SETUP.EXE -d E:\
    Task: {D4DCE6C6-38FC-4DBA-BF94-8D9965609BF1} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
    Task: {EE3AFF7D-09AC-4C27-845E-FCE758B530FE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
    Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2016-08-30 13:09 - 2016-08-30 13:09 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2017-02-09 17:12 - 2017-02-09 17:12 - 06350336 _____ () C:\Program Files\AVAST Software\Avast\defs\17020901\algo.dll
    2016-08-30 13:09 - 2016-08-30 13:09 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
    2006-09-03 12:32 - 2006-09-03 12:32 - 00208896 _____ () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    2016-06-07 11:48 - 2010-08-04 13:44 - 00266240 _____ () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    2016-06-07 11:48 - 2010-03-10 13:50 - 00360448 _____ () C:\Program Files\NETGEAR\WNA1100\WifiLib.dll
    2016-06-30 07:45 - 2016-06-30 07:45 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2005-06-24 10:13 - 2005-06-24 10:13 - 00407552 _____ () C:\Program Files\Extension Changer\extcontext.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\Users\Tori\Downloads\006.mp4:TOC.WMV [130]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)

    HKLM\...\cmdfile\DefaultIcon: %SystemRoot%\System32\imageres.dll,-68 <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.scr: => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.bat: batfile => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.com: ComFile => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.cmd: cmdfile => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.reg: => <===== ATTENTION

    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE trusted site: HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\driversupport.com -> hxxp://apps.driversupport.com
    IE trusted site: HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\driversupport.com -> hxxps://apps.driversupport.com

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2006-11-02 05:23 - 2017-02-10 01:50 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

    127.0.0.1 localhost

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Tori\Pictures\2015-12-02\20150909_175108.jpg
    DNS Servers: 192.168.1.254
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [WinCollab-DFSR-In-TCP] => %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-DFSR-Out-TCP] => %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-In-TCP] => %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-TCP] => %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-In-UDP] => %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-UDP] => %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [{7E08AE05-29F9-4FA2-A855-BC94B1812FEC}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe
    FirewallRules: [{8AD4B445-2665-49C1-868C-57B236CEDCA4}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe
    FirewallRules: [{CEE89B6C-00C8-4144-B5A6-0476047653A5}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    FirewallRules: [{43127B7F-6787-4AC9-98E9-5FB21C41FD6A}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    FirewallRules: [{92363EFE-3ED7-45D5-8406-56DA8AEEF7E2}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    FirewallRules: [{1FBA613B-8DB4-4AC4-B1BF-F0D97D0E2198}] => C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    FirewallRules: [{25C42470-733A-44AA-9C25-08180AF8F86B}] => LPort=9442
    FirewallRules: [{E5C1C5C6-E862-46F7-9566-D884DD2BFAC3}] => LPort=1900
    FirewallRules: [{E4CE3B3A-59B8-4E11-8F2A-7993F4B86185}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{6485DC41-213D-4A8D-AA8B-551F99D23BE9}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{12619514-D9E8-4900-9E4D-ECDF93F13427}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{944880D9-B475-483D-BC04-009A3F5E2CE7}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{DE12E2DE-87E7-44F8-B3EE-2959C4DB6C77}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{D51E78BF-818E-445C-943E-B27861212FF5}] => C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{92CFE1BD-98CD-48CC-8F4B-3C89317682AA}] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{9E4547A2-D64F-40E5-B488-DB594050B014}] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{D91AB1FB-C3A3-4C12-B4CB-03FCC5D9B2CC}] => LPort=80
    FirewallRules: [{3D4D1636-B373-4D9A-979E-1F56EB31AF31}] => LPort=80
    FirewallRules: [{03104623-B954-49BE-9D4C-702CE859704F}] => LPort=80
    FirewallRules: [TCP Query User{01EB243C-E9F8-4B10-A42E-67F4C1C2B088}C:\program files\yahoo!\messenger\yahoomessenger.exe] => C:\program files\yahoo!\messenger\yahoomessenger.exe
    FirewallRules: [UDP Query User{57D3BE13-369B-4FAF-AC8C-776CEDA4C67B}C:\program files\yahoo!\messenger\yahoomessenger.exe] => C:\program files\yahoo!\messenger\yahoomessenger.exe
    FirewallRules: [TCP Query User{D5EF77F1-E966-48A9-ADE8-56B930510E4A}C:\program files\logitech\logitech vid\vid.exe] => C:\program files\logitech\logitech vid\vid.exe
    FirewallRules: [UDP Query User{67E147EE-488D-4F1F-BC40-D55FAE320043}C:\program files\logitech\logitech vid\vid.exe] => C:\program files\logitech\logitech vid\vid.exe
    FirewallRules: [{732C57C5-D5B5-4C3D-8948-E1EA0162E1D0}] => C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{C10344C7-ABFF-4BD4-9EFF-7669EB75C1E9}] => C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{75DE061E-26E1-4887-B05F-9496091CBE79}] => C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{6CB0275C-8CEF-4FBB-B5E9-98BC592FC41F}] => C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{830A844F-BD25-45CD-A2BC-F725B73F2D05}] => C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{281B09ED-0AD5-4D5E-90C5-00FC4998C848}] => C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{7BFAB5B2-3AEE-41C0-9D8A-F834B9437422}] => C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{A0B5A194-3773-4FF7-8269-F68144160961}] => C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{109B5621-110B-4C60-B0B0-A396DE293AD4}] => C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{B91F2D9F-CA09-45A4-B597-2C2E7BAAA4B7}] => C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{C97A52B4-08D3-43C6-8DAF-B11FF6EE4475}] => C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{055F6980-8CBE-466C-B366-2993401E8580}] => C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{07721B83-175D-4895-99C0-663F782A0499}] => C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{63D32969-17FC-4164-9623-9921FBCE106E}] => C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{6B8CB9A2-DADF-4F30-9741-71E6709147D6}] => C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{6EE3A0B2-3BE4-49D2-9B75-24F6D74F69B5}] => C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{3C84CCB4-82E3-43EB-97FE-B8ADBD396FD8}] => C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{BA5BB4D8-8411-472E-8A11-967F4475C850}] => C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{ED35A362-A609-4AC8-8F2F-62A05A414EBA}] => C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{7F314E9E-753D-4699-ADB0-7CF44FC7F91F}] => C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{427B9501-4991-4E3D-878A-19B46AB2B95B}] => C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    FirewallRules: [{E046F771-B7FC-4B47-BDB3-206CC6F761D2}] => LPort=50308
    FirewallRules: [{5221F830-B378-42AE-842F-C42C7E374B70}] => LPort=3479
    FirewallRules: [{853AA996-5145-4CF9-9509-BFFE56E09C35}] => C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe
    FirewallRules: [{4A0F71C4-4023-4A71-9CF9-16BDFA55CE5F}] => C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe
    FirewallRules: [{2E7AB4BB-99CB-4CD7-9254-5167FAFC7DBF}] => C:\Program Files\Google\Chrome\Application\chrome.exe
    FirewallRules: [{1ACF1982-B5AF-4265-B4FC-2B18427B1266}] => C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{CFF6D1F2-4B1C-4E61-B665-968498FB0F6B}] => C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{7EC01A6D-F50B-4A51-BB7C-26E58F6682AF}] => C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{E293C848-7B13-47E7-8242-3C6A1C6E191C}] => C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{35907039-A8F4-408E-B76C-B35093EC679D}] => C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{B6626F49-6218-446E-B906-0F96F9FEFB75}] => C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{D4E4C272-0350-4204-ABFB-1F6CAC497A90}] => C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{0661BF77-2F77-4D15-8E76-C0C08A69C358}] => C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{3D0D28AC-0258-4C4E-8531-5F7C90FADBAC}] => C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{6884201E-DA8B-4152-82D8-1F628CF4B0E7}] => C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{8881BA11-F95F-4894-B5A5-8D9BC2D457F7}] => C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{535423E9-C220-46BD-AFC8-1967A844B235}] => C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{3E1B3056-85A0-441A-BBE1-8FCEDD6E5AF7}] => C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{61CFB5E2-86B2-4D1E-8E57-17064959FD75}] => C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{11E41D8A-D121-44B1-AE66-F76FCB674933}] => C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{AEFA4582-DB14-417A-B2EC-1FA8B110C278}] => C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{F5A72B58-3252-4EE0-AA3B-23FB1366CDF7}] => C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{6896DD4D-5DDB-4A55-B347-A649C19ECF87}] => C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{AF94A0C9-4660-4CAE-B9BB-45E55EF716E0}] => C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{611D8009-6374-4AA1-BCB6-67136478A6A2}] => C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{A4DCC555-D8AD-45B5-88F7-2D603B858CD6}] => C:\Program Files\Logitech\Logitech Vid\Vid.exe
    FirewallRules: [{1E4A59A2-9901-4BBD-AFB4-1EF430F7D2EF}] => C:\Program Files\Logitech\Logitech Vid\Vid.exe
    FirewallRules: [{478570A2-5D2E-4191-B078-7F6CA3F93377}] => C:\Program Files\Dropbox\Client\Dropbox.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\EarthLink TotalAccess\TaskPanl.exe] => Enabled:Earthlink

    ==================== Restore Points =========================

    20-01-2017 00:00:04 Scheduled Checkpoint
    21-01-2017 00:00:03 Scheduled Checkpoint
    22-01-2017 00:00:04 Scheduled Checkpoint
    23-01-2017 00:00:03 Scheduled Checkpoint
    24-01-2017 00:00:10 Scheduled Checkpoint
    25-01-2017 00:00:04 Scheduled Checkpoint
    26-01-2017 00:00:05 Scheduled Checkpoint
    27-01-2017 00:00:10 Scheduled Checkpoint
    28-01-2017 12:23:04 Scheduled Checkpoint
    30-01-2017 00:00:07 Scheduled Checkpoint
    31-01-2017 00:00:05 Scheduled Checkpoint
    01-02-2017 00:00:06 Scheduled Checkpoint
    02-02-2017 00:00:08 Scheduled Checkpoint
    03-02-2017 00:37:00 Scheduled Checkpoint
    04-02-2017 00:00:04 Scheduled Checkpoint
    05-02-2017 03:34:43 Scheduled Checkpoint
    06-02-2017 00:00:04 Scheduled Checkpoint
    06-02-2017 19:43:43 Scheduled Checkpoint
    08-02-2017 13:12:27 Scheduled Checkpoint
    09-02-2017 10:24:08 Scheduled Checkpoint
    09-02-2017 17:30:44 JRT Pre-Junkware Removal

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (02/09/2017 05:17:56 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/09/2017 09:07:25 AM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/08/2017 04:07:58 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/08/2017 11:51:07 AM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/07/2017 06:29:17 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/07/2017 06:29:09 PM) (Source: DbxSvc) (EventID: 270) (User: )
    Description: Filter Unload failed with: (-2145452013) The system could not find the filter specified.

    Error: (02/06/2017 03:45:58 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/03/2017 12:06:03 AM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/02/2017 05:03:28 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

    Error: (02/02/2017 05:03:23 PM) (Source: DbxSvc) (EventID: 270) (User: )
    Description: Filter Unload failed with: (-2145452013) The system could not find the filter specified.


    System errors:
    =============
    Error: (02/10/2017 01:50:59 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (02/09/2017 09:42:59 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (02/09/2017 09:30:34 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (02/09/2017 09:29:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The XAudioService service terminated unexpectedly. It has done this 1 time(s).

    Error: (02/09/2017 09:22:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Process Monitor service terminated unexpectedly. It has done this 1 time(s).

    Error: (02/09/2017 05:19:33 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    i8042prt

    Error: (02/09/2017 05:19:30 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The HP CUE DeviceDiscovery Service service hung on starting.

    Error: (02/09/2017 05:19:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Parallel port driver service failed to start due to the following error:
    The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

    Error: (02/09/2017 09:31:51 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

    Error: (02/09/2017 09:31:51 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Yahoo! Updater service terminated unexpectedly. It has done this 1 time(s).


    CodeIntegrity:
    ===================================
    Date: 2016-10-05 14:44:35.282
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-03 15:35:23.086
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-03 14:43:50.563
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-03 13:10:25.001
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-03 13:02:27.440
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 16:35:40.773
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 16:31:56.210
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 16:27:52.909
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 16:09:46.289
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-10-02 15:57:58.229
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
    Percentage of memory in use: 46%
    Total physical RAM: 2037.77 MB
    Available physical RAM: 1083.63 MB
    Total Virtual: 4320.76 MB
    Available Virtual: 3349.22 MB

    ==================== Drives ================================

    Drive c: (HP) (Fixed) (Total:289.26 GB) (Free:189.68 GB) NTFS ==>[drive with boot components (obtained from BCD)]
    Drive d: (Recovery) (Fixed) (Total:8.83 GB) (Free:1 GB) NTFS ==>[system with boot components (obtained from drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 298.1 GB) (Disk ID: 1549F232)
    Partition 1: (Active) - (Size=289.3 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=8.8 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
    dodopie,
    #13
  15. 2017/02/10
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

    broni,
    #14
  16. 2017/02/10
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Fix result of Farbar Recovery Scan Tool (x86) Version: 10-02-2017
    Ran by Tori (10-02-2017 23:12:19) Run:1
    Running from C:\Users\Tori\Desktop
    Loaded Profiles: Tori (Available Profiles: IUSR_NMPR & Tori)
    Boot Mode: Normal

    ==============================================

    fixlist content:
    *****************
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    S3 AndNetDiag; system32\DRIVERS\lgandnetdiag.sys [X]
    S3 ANDNetModem; system32\DRIVERS\lgandnetmodem.sys [X]
    S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
    U3 catchme; \??\C:\Users\Tori\AppData\Local\Temp\catchme.sys [X] <==== ATTENTION
    S3 dbx; system32\DRIVERS\dbx.sys [X]
    S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
    S3 LVcKap; system32\DRIVERS\LVcKap.sys [X]
    S3 LVMVDrv; system32\DRIVERS\LVMVDrv.sys [X]
    S3 LVRS; system32\DRIVERS\lvrs.sys [X]
    S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
    S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
    S3 pepifilter; system32\DRIVERS\lv302af.sys [X]
    S3 PID_PEPI; system32\DRIVERS\LV302V32.SYS [X]
    U3 mbr; \??\C:\ComboFix\mbr.sys [X]
    2010-10-24 07:32 - 2010-10-24 07:33 - 0000513 _____ () C:\Users\Tori\AppData\Roaming\com.zoosk.Desktop_state.xml
    2012-02-18 18:36 - 2012-02-18 18:36 - 0011248 _____ () C:\Users\Tori\AppData\Roaming\UserTile.png
    2009-10-31 13:28 - 2017-01-27 16:40 - 0012414 _____ () C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2010-02-10 16:43 - 2016-11-29 16:43 - 0052736 _____ () C:\Users\Tori\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2007-04-21 05:58 - 2016-07-14 10:11 - 0009390 _____ () C:\ProgramData\hpzinstall.log
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00021401-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{477A3783-2D4D-11D3-B244-444553540000}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa72-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa73-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa74-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa83-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa88-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa89-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa8f-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa92-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa93-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa94-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa95-b84f-48f0-9393-7edc34128127}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{CD773740-B187-4974-A1D5-E0FF91372277}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InprocServer32 -> no filepath
    AlternateDataStreams: C:\Users\Tori\Downloads\006.mp4:TOC.WMV [130]
    HKLM\...\cmdfile\DefaultIcon: %SystemRoot%\System32\imageres.dll,-68 <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.scr: => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.bat: batfile => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.com: ComFile => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.cmd: cmdfile => <===== ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.reg: => <===== ATTENTION

    *****************

    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully.
    HKLM\System\CurrentControlSet\Services\AndNetDiag => key removed successfully.
    AndNetDiag => service removed successfully.
    HKLM\System\CurrentControlSet\Services\ANDNetModem => key removed successfully.
    ANDNetModem => service removed successfully.
    HKLM\System\CurrentControlSet\Services\blbdrive => key removed successfully.
    blbdrive => service removed successfully.
    HKLM\System\CurrentControlSet\Services\catchme => key removed successfully.
    catchme => service removed successfully.
    HKLM\System\CurrentControlSet\Services\dbx => key removed successfully.
    dbx => service removed successfully.
    HKLM\System\CurrentControlSet\Services\IpInIp => key removed successfully.
    IpInIp => service removed successfully.
    HKLM\System\CurrentControlSet\Services\LVcKap => key removed successfully.
    LVcKap => service removed successfully.
    HKLM\System\CurrentControlSet\Services\LVMVDrv => key removed successfully.
    LVMVDrv => service removed successfully.
    HKLM\System\CurrentControlSet\Services\LVRS => key removed successfully.
    LVRS => service removed successfully.
    HKLM\System\CurrentControlSet\Services\NwlnkFlt => key removed successfully.
    NwlnkFlt => service removed successfully.
    HKLM\System\CurrentControlSet\Services\NwlnkFwd => key removed successfully.
    NwlnkFwd => service removed successfully.
    HKLM\System\CurrentControlSet\Services\pepifilter => key removed successfully.
    pepifilter => service removed successfully.
    HKLM\System\CurrentControlSet\Services\PID_PEPI => key removed successfully.
    PID_PEPI => service removed successfully.
    mbr => service not found.
    C:\Users\Tori\AppData\Roaming\com.zoosk.Desktop_state.xml => moved successfully
    C:\Users\Tori\AppData\Roaming\UserTile.png => moved successfully
    C:\Users\Tori\AppData\Roaming\wklnhst.dat => moved successfully
    C:\Users\Tori\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
    C:\ProgramData\hpzinstall.log => moved successfully
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0000002F-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{00021401-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0002E005-0000-0000-C000-000000000046} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{477A3783-2D4D-11D3-B244-444553540000} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa72-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa73-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa74-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa83-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa88-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa89-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa8f-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa92-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa93-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa94-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{cd3afa95-b84f-48f0-9393-7edc34128127} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{CD773740-B187-4974-A1D5-E0FF91372277} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837} => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000} => key removed successfully.
    C:\Users\Tori\Downloads\006.mp4 => ":TOC.WMV" ADS removed successfully..
    HKLM\Software\Classes\cmdfile\DefaultIcon\\Default => value restored successfully
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.scr => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.bat => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.com => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.cmd => key removed successfully.
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Classes\.reg => key removed successfully.

    ==== End of Fixlog 23:12:22 ====
     
    dodopie,
    #15
  17. 2017/02/10
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Last scans....

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
    • Other Services

    Press "Scan".
    It will create a log (FSS.txt) in the same directory the tool is run.
    Please copy and paste the log to your reply.


    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    [​IMG] Download Sophos Free Virus Removal Tool and save it to your desktop.
    • Double click the icon and select Run
    • Click Next
    • Select I accept the terms in this license agreement, then click Next twice
    • Click Install
    • Click Finish to launch the program
    • Once the virus database has been updated click Start Scanning
    • If any threats are found click Details, then View log file... (bottom left hand corner)
    • Copy and paste the results in your reply
    • Close the Notepad document, close the Threat Details screen, then click Start cleanup
    • Click Exit to close the program
     
    broni,
    #16
  18. 2017/02/11
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Results of screen317's Security Check version 1.014 --- 12/23/15
    Windows Vista Service Pack 2 x86 (UAC is enabled)
    Internet Explorer 8 Out of date!
    Internet Explorer 8
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    Avast Antivirus
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    CCleaner
    Java 8 Update 66
    AndroChef Java Decompiler
    Adobe Reader 8 Adobe Reader out of Date!
    Google Chrome (49.0.2623.112)
    Google Chrome (49.0.2623.87)
    ````````Process Check: objlist.exe by Laurent````````
    AVAST Software Avast AvastSvc.exe
    AVAST Software Avast aswidsagent.exe
    AVAST Software Avast AvastUI.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 1 %
    ````````````````````End of Log``````````````````````
     
    dodopie,
    #17
  19. 2017/02/11
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Farbar Service Scanner Version: 27-01-2016
    Ran by Tori (administrator) on 11-02-2017 at 09:39:36
    Running from "C:\Users\Tori\Desktop"
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Policy:
    ========================


    Security Center:
    ============


    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => File is digitally signed
    C:\Windows\system32\Drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\system32\dhcpcsvc.dll => File is digitally signed
    C:\Windows\system32\Drivers\afd.sys => File is digitally signed
    C:\Windows\system32\Drivers\tdx.sys => File is digitally signed
    C:\Windows\system32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\system32\dnsrslvr.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\system32\mpssvc.dll => File is digitally signed
    C:\Windows\system32\bfe.dll => File is digitally signed
    C:\Windows\system32\Drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\system32\SDRSVC.dll => File is digitally signed
    C:\Windows\system32\vssvc.exe => File is digitally signed
    C:\Windows\system32\wscsvc.dll => File is digitally signed
    C:\Windows\system32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\system32\wuaueng.dll => File is digitally signed
    C:\Windows\system32\qmgr.dll => File is digitally signed
    C:\Windows\system32\es.dll => File is digitally signed
    C:\Windows\system32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Windows\system32\ipnathlp.dll => File is digitally signed
    C:\Windows\system32\iphlpsvc.dll => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed


    **** End of log ****
     
    dodopie,
    #18
  20. 2017/02/11
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Sophos found nothing, says the computer is clean.
     
    dodopie,
    #19
  21. 2017/02/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    [​IMG] Update Adobe Reader

    You can download it from Adobe Acrobat Reader DC Install for all versions
    After installing the latest Adobe Reader, uninstall all previous versions (if present).
    Note. If you already have Adobe Photoshop Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop Album Starter Edition.

    [​IMG] Update your Java version here: Java Downloads for All Operating Systems
    Alternate download: http://www.filehippo.com/search?q=java

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.
    Note 2: If you're running 64-bit system make sure you install BOTH, 32-bit and 64-bit Java.

    ====================================

    Your computer is clean [​IMG]

    1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
    This is a very crucial step so make sure you don't skip it.
    Download [​IMG]DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

    Double-click Delfix.exe to start the tool.
    Make sure the following items are checked:
    • Activate UAC (optional; some users prefer to keep it off)
    • Remove disinfection tools
    • Create registry backup
    • Purge System Restore
    • Reset system settings
    Now click "Run" and wait patiently.
    Once finished a logfile will be created. You don't have to attach it to your next reply.

    2. Make sure Windows Updates are current.

    3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    4. Check if your browser plugins are up to date.
    Firefox - Keep your Firefox healthy with a quick checkup
    other browsers: Qualys BrowserCheck (click on "Scan without installing plugin" and then on "Scan now")

    5. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    6. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

    7. Download and install Secunia Personal Software Inspector (PSI): Personal Software Inspector. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    8. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    9. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    10. Read:
    How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
    Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
    About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

    11. Please, let me know, how your computer is doing.
     
    broni,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...