Solved Computer acting infected again

Hi, this laptop wouldn't load my avg on restart and it was also not doing windows update and I have to click on anything twice to get it to go so i did a system restore to an earlier date. Still doing the same things.i've been running malwarebytes and tfc weekly along with scanning with avg once a week.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-01-2017
Ran by jerry (administrator) on JERRY-PC (31-01-2017 18:25:30)
Running from C:\Users\jerry\Downloads
Loaded Profiles: jerry (Available Profiles: jerry)
Platform: Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\ACER\Mobility Center\MobilityService.exe
(Realtek Semiconductor Corp.) C:\Users\jerry\AppData\Local\temp\RtkBtMnt.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Framework\Common\avgsvcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Framework\Common\avguix.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgwdsvcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgemcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgcsrvx.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\jerry\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AvgUi] => C:\Program Files\AVG\Framework\Common\avguirnx.exe [220944 2016-12-06] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\Framework\Common\avguirnx.exe [220944 2016-12-06] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6266880 2008-07-02] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2008-06-25] (Realtek Semiconductor Corp.)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1298456 2015-04-20] (CANON INC.)
HKU\S-1-5-21-4103279818-402611227-566158514-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6868696 2016-08-26] (Piriform Ltd)
HKU\S-1-5-21-4103279818-402611227-566158514-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [50599552 2016-02-10] (Skype Technologies S.A.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{79014BAE-3FE6-48B6-8DA3-FF4DE66098F4}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1214&m=aspire_5515
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4103279818-402611227-566158514-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://us.search.yahoo.com/?fr=hp-dt&type=bestsearch_US_HomePage
HKU\S-1-5-21-4103279818-402611227-566158514-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-4103279818-402611227-566158514-1000 -> DefaultScope {42AB4FD8-C833-46E4-8226-26D2A1E7EC01} URL = hxxp://us.search.yahoo.com/search?fr=ds-dt&type=bestsearch_US_DefaultSearchEngine&p={searchTerms}
SearchScopes: HKU\S-1-5-21-4103279818-402611227-566158514-1000 -> {42AB4FD8-C833-46E4-8226-26D2A1E7EC01} URL = hxxp://us.search.yahoo.com/search?fr=ds-dt&type=bestsearch_US_DefaultSearchEngine&p={searchTerms}
SearchScopes: HKU\S-1-5-21-4103279818-402611227-566158514-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={ED448115-DF19-4637-BADA-F61C16F54B70}&mid=26cb0d60824c47cdbcb3d157aa228a52-926113d46e07c1a10a54c687293e356df434df7e&lang=en&ds=AVG&coid=avgtbavg&cmpid=0516avz&pr=fr&d=2016-04-25 10:01:43&v=4.2.9.726&pid=wtu&sg=&sap=dsp&q={searchTerms}
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\jerry\AppData\Roaming\Mozilla\Firefox\Profiles\ihec866e.default-1466429628943 [2017-01-31]
FF Homepage: Mozilla\Firefox\Profiles\ihec866e.default-1466429628943 -> hxxps://www.yahoo.com/
FF Extension: (Ebates Cash Back) - C:\Users\jerry\AppData\Roaming\Mozilla\Firefox\Profiles\ihec866e.default-1466429628943\Extensions\{35d6291e-1d4b-f9b4-c52f-77e6410d1326}.xpi [2017-01-16]
FF Extension: (Adblock Plus) - C:\Users\jerry\AppData\Roaming\Mozilla\Firefox\Profiles\ihec866e.default-1466429628943\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-12-25] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-27] ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files\AVG\Av\avgidsagent.exe [4154016 2017-01-09] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files\AVG\Framework\Common\avgsvcx.exe [935184 2016-12-06] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\Av\avgwdsvcx.exe [603288 2017-01-09] (AVG Technologies CZ, s.r.o.)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-20] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 ahcix86s; C:\Windows\System32\DRIVERS\ahcix86s.sys [129552 2008-08-06] (AMD Technologies Inc.)
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [134912 2016-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [259328 2016-11-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [207616 2016-10-05] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-11-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [244992 2016-11-30] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [287008 2016-02-16] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [197376 2016-09-26] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [47360 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [231680 2016-07-27] (AVG Technologies CZ, s.r.o.)
R0 Avgunivx; C:\Windows\System32\DRIVERS\avgunivx.sys [65280 2016-06-20] (AVG Technologies CZ, s.r.o.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-20] (Microsoft Corporation)
S3 WinRing0_1_2_0; \??\C:\Program Files\TurboYourPC\Service.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-31 18:24 - 2017-01-31 18:25 - 01762816 _____ (Farbar) C:\Users\jerry\Downloads\FRST(1).exe
2017-01-30 17:02 - 2017-01-30 17:02 - 00000374 _____ C:\Windows\Tasks\REGUtilities Task.job
2017-01-30 17:02 - 2017-01-30 17:02 - 00000000 ____D C:\ProgramData\REGUtilities
2017-01-30 17:00 - 2017-01-30 17:00 - 01425776 _____ (Tuneup System Software Pvt Ltd. ) C:\Users\jerry\Downloads\REGUtilities_1.9_Setup.exe
2017-01-30 16:56 - 2017-01-30 16:56 - 02282656 _____ (Seven Servos Software Pvt Ltd. ) C:\Users\jerry\Downloads\TechUtilities_setup_1.9.exe.part
2017-01-27 15:35 - 2017-01-27 19:47 - 00000000 ____D C:\Program Files\Mozilla Firefox(147)

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-31 18:34 - 2015-12-13 10:33 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-01-31 18:31 - 2016-02-17 09:58 - 00009772 _____ C:\Users\jerry\Downloads\FRST.txt
2017-01-31 18:28 - 2014-12-25 08:00 - 00000000 ____D C:\ProgramData\MFAData
2017-01-31 18:25 - 2016-02-17 09:58 - 00000000 ____D C:\FRST
2017-01-31 18:13 - 2016-11-28 10:02 - 00000000 ____D C:\Users\jerry\AppData\LocalLow\Mozilla
2017-01-31 17:19 - 2006-11-02 07:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-31 17:19 - 2006-11-02 07:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-30 10:29 - 2015-05-19 20:47 - 00000000 ____D C:\ProgramData\Sophos
2017-01-29 11:02 - 2015-12-14 00:01 - 00000735 _____ C:\Users\Public\Desktop\AVG.lnk
2017-01-29 11:02 - 2015-12-14 00:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
2017-01-29 10:35 - 2015-12-14 00:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2017-01-29 09:27 - 2015-10-26 17:13 - 00000000 ____D C:\Users\jerry\AppData\Local\AvgSetupLog
2017-01-29 09:24 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\inf
2017-01-29 09:24 - 2006-11-02 05:33 - 00758862 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-29 09:21 - 2016-02-19 21:38 - 00000000 ____D C:\Users\jerry\AppData\Roaming\Skype
2017-01-29 09:21 - 2014-12-25 14:38 - 00000000 ____D C:\Users\jerry\Desktop\2014 Lease Tim Harvy
2017-01-29 09:19 - 2006-11-02 07:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-28 22:14 - 2006-11-02 07:58 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-01-28 20:33 - 2016-01-24 21:43 - 00000000 ____D C:\Users\jerry\Desktop\heli
2017-01-28 20:33 - 2016-01-07 00:38 - 00000000 ____D C:\Users\jerry\Desktop\pics
2017-01-28 20:33 - 2015-12-10 06:58 - 00000000 ____D C:\Users\jerry\Desktop\Old Firefox Data
2017-01-28 19:17 - 2016-05-06 20:48 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-01-28 18:47 - 2014-12-26 19:52 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-28 17:14 - 2016-05-06 20:48 - 00000862 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-01-28 17:14 - 2016-05-06 20:48 - 00000850 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-01-28 17:13 - 2016-10-21 18:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-01-28 17:06 - 2008-12-04 07:45 - 00000000 ____D C:\Windows\system32\Macromed
2017-01-27 22:36 - 2015-10-22 06:42 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2017-01-27 22:36 - 2015-10-22 06:42 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2017-01-27 21:14 - 2014-12-24 21:07 - 00000000 ____D C:\Users\jerry
2017-01-27 21:13 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\system32\Msdtc
2017-01-27 21:11 - 2006-11-02 05:22 - 44302336 _____ C:\Windows\system32\config\components_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 37486592 _____ C:\Windows\system32\config\software_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 18350080 _____ C:\Windows\system32\config\system_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2017-01-27 21:02 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\system32\spool
2017-01-27 21:01 - 2016-02-19 21:38 - 00000000 ___RD C:\Program Files\Skype
2017-01-27 21:01 - 2016-02-19 21:34 - 00000000 ____D C:\ProgramData\Skype
2017-01-27 21:01 - 2016-02-09 12:06 - 00000000 ___HD C:\ProgramData\CanonIJScan
2017-01-27 21:01 - 2016-02-09 11:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2017-01-27 21:01 - 2016-02-09 11:55 - 00000000 ____D C:\Program Files\Canon
2017-01-27 21:01 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\registration
2017-01-27 20:24 - 2015-05-18 07:19 - 00000000 ____D C:\Users\jerry\AppData\Local\CrashDumps

==================== Files in the root of some directories =======

2015-12-17 07:23 - 2015-12-17 07:23 - 0000000 _____ () C:\Users\jerry\AppData\Roaming\wklnhst.dat
2016-12-18 17:45 - 2016-12-18 17:45 - 0000680 _____ () C:\Users\jerry\AppData\Local\d3d9caps.dat
2016-01-09 10:11 - 2016-01-09 10:11 - 0003584 _____ () C:\Users\jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some files in TEMP:
====================
2017-01-28 22:16 - 2017-01-28 22:16 - 0204800 _____ (Realtek Semiconductor Corp.) C:\Users\jerry\AppData\Local\temp\RtkBtMnt.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-31 09:41

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 29-01-2017
Ran by jerry (31-01-2017 18:39:30)
Running from C:\Users\jerry\Downloads
Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) (2014-12-25 04:58:30)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4103279818-402611227-566158514-500 - Administrator - Disabled)
Guest (S-1-5-21-4103279818-402611227-566158514-501 - Limited - Disabled)
jerry (S-1-5-21-4103279818-402611227-566158514-1000 - Administrator - Enabled) => C:\Users\jerry

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Mobility Center Plug-In (HKLM\...\{11316260-6666-467B-AC34-183FCB5D4335}) (Version: 3.0.3000 - Acer Inc.)
Adobe Flash Player 24 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 24.0.0.194 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 24.0.0.194 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
ATI Catalyst Install Manager (HKLM\...\{67A8747E-0517-75EF-244F-9E219C440107}) (Version: 3.0.682.0 - ATI Technologies, Inc.)
AVG (HKLM\...\AvgZen) (Version: 1.113.2.50020 - AVG Technologies)
AVG (Version: 16.141.7998 - AVG Technologies) Hidden
AVG 2016 (Version: 16.0.4756 - AVG Technologies) Hidden
AVG Protection (HKLM\...\AVG) (Version: 2016.141.7998 - AVG Technologies)
AVG Zen (Version: 1.113.1 - AVG Technologies) Hidden
Canon MP Navigator EX 4.0 (HKLM\...\MP Navigator EX 4.0) (Version: - )
Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version: - )
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.6.1 - Canon Inc.)
ccc-core-static (Version: 2008.0703.2236.38526 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.22 - Piriform)
FMW 1 (Version: 1.143.3 - AVG Technologies) Hidden
InterVideo WinDVD 8 (HKLM\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0-B9.574 - InterVideo Inc.)
InterVideo WinDVD 8 (Version: 8.0-B9.574 - InterVideo Inc.) Hidden
iPhone Backup Extractor (HKU\S-1-5-21-4103279818-402611227-566158514-1000\...\iPhone Backup Extractor) (Version: 6.0.5.768 - Reincubate Ltd)
iPhone Backup Extractor (Version: 6.0.5.768 - Reincubate Ltd) Hidden
LightScribe 1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Word 2000 (HKLM\...\{00170409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Works (HKLM\...\{6D52C408-B09A-4520-9B18-475B81D393F1}) (Version: 08.05.0818 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox 51.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 51.0.1 (x86 en-US)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 51.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5657 - Realtek Semiconductor Corp.)
Skins (Version: 2008.0703.2236.38526 - ATI) Hidden
Skype™ 7.18 (HKLM\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.0.2.0 - Synaptics)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {2E839851-64A0-46DF-AE81-FCCB18DB1383} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-27] (Adobe Systems Incorporated)
Task: {3A445936-83FD-4657-9E0C-642CBB339A67} - System32\Tasks\REGUtilities Task => C:\Program Files\REGUtilities\REGUtilities.exe <==== ATTENTION
Task: {A7966D42-CBAF-44C5-857C-117C8C182EAC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {E69DD813-BDDA-4DE4-8657-B2133704CB52} - System32\Tasks\{C3ACDD59-0C4B-489B-9C4F-1A212A8EECF5} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=7.18.0.112&amp;LastError=-3
Task: {ED1459E4-D920-4BC1-91C7-F5231BE0E9B3} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-08-26] (Piriform Ltd)
Task: {FDF11D69-5BB6-4816-AACE-A6D537A2444E} - System32\Tasks\AVG EUpdate Task => avgsetupx.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\REGUtilities Task.job => C:\Program Files\REGUtilities\REGUtilities.exe -t C:\Program Files\REGUtilities\REGUtilities.exe <==== ATTENTION

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2008-12-04 08:14 - 2007-12-06 19:15 - 00110592 _____ () C:\Acer\Mobility Center\MobilityService.exe
2008-12-04 08:14 - 2007-11-27 18:08 - 00032768 _____ () C:\Acer\Mobility Center\MobilityInterface.dll
2008-12-04 06:05 - 2008-07-03 22:37 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2017-01-27 21:31 - 2017-01-27 21:30 - 48920064 _____ () C:\Program Files\AVG\UiDll\2623\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

HKLM\...\cmdfile\DefaultIcon: %SystemRoot%\System32\imageres.dll,-68 <===== ATTENTION

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 05:23 - 2006-09-18 16:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4103279818-402611227-566158514-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\jerry\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{BE1E1569-ADF3-41A9-AFE0-3FC8BE991B45}] => LPort=80
FirewallRules: [{7159459A-A8C5-4553-9438-3CCE6EAB70B8}] => LPort=80
FirewallRules: [{BCC31CF4-84BC-4C5B-B2E1-2ED8BCD49C5A}] => LPort=80
FirewallRules: [{F906CAAC-8DDC-4649-9D7C-EC061306C23A}] => C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{6855460D-A199-43C0-AE89-15D51F0FD8F5}] => C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{1D5EEB6A-9D2D-4A8D-A642-8A8F44023604}] => C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{070D6C14-EF15-42AB-911A-120A071C43BB}] => C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{29B0AD16-8FB2-42CA-A907-E77EEAD7AF2B}] => C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{87FB7EA3-705F-4CDD-87EE-993637BD74BB}] => C:\Program Files\Internet Explorer\iexplore.exe
FirewallRules: [{AD7643AB-98A6-46B5-8C9C-7978642AB843}] => C:\Program Files\Internet Explorer\iexplore.exe
FirewallRules: [{575321A2-C5AE-48D7-9EF4-F84527992757}] => C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{BB68C489-EF1D-4F36-A480-8CFDF8C17E93}] => C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{E854F8FA-3512-4EEF-9B81-8E8BB9D9C5A3}] => C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{6638745A-EC98-40AA-8336-C456CC02010A}] => C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{BB9CDCBE-DC76-4ADD-BF8F-A04AF833FF4C}] => C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{8F26D9C5-3156-4371-BBC4-2548174CE6EE}] => C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [TCP Query User{A6E575D2-4BE7-444E-A032-F2D7950751F5}C:\program files\free torrent opener\free torrent opener.exe] => C:\program files\free torrent opener\free torrent opener.exe
FirewallRules: [UDP Query User{8D168CB0-C15A-40B5-A6F7-8E7657E9D3B7}C:\program files\free torrent opener\free torrent opener.exe] => C:\program files\free torrent opener\free torrent opener.exe
FirewallRules: [{3AB13EA5-C06E-4ED0-87DC-293B0C572970}] => C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{1F5D30DC-58F5-4869-A35F-11BF401F1947}] => C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{835854F7-649A-44B3-9144-7533CD35B9B5}] => C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{2340A1CC-B5C8-4C46-983B-2154950B8F2C}] => C:\Program Files\AVG\Av\avgnsx.exe
FirewallRules: [{17066E2F-EF0D-440B-80F6-FE0A53D00163}] => C:\Program Files\AVG\Av\avgnsx.exe
FirewallRules: [{14D50BE1-150F-4903-B012-90FD6E8B3228}] => C:\Program Files\AVG\Av\avgemcx.exe
FirewallRules: [{D17364C8-D812-400E-8BC2-D7A17B6349A9}] => C:\Program Files\AVG\Av\avgemcx.exe

==================== Restore Points =========================

02-12-2016 17:23:38 Scheduled Checkpoint
04-12-2016 09:26:00 Scheduled Checkpoint
05-12-2016 13:12:35 Scheduled Checkpoint
06-12-2016 07:59:38 Scheduled Checkpoint
07-12-2016 12:05:27 Scheduled Checkpoint
08-12-2016 00:19:12 Scheduled Checkpoint
11-12-2016 17:04:50 Scheduled Checkpoint
27-01-2017 20:55:44 Restore Operation
30-01-2017 09:59:26 Removed Sophos Virus Removal Tool.
30-01-2017 10:03:29 Removed Sophos Virus Removal Tool.
30-01-2017 10:11:20 Installed Sophos Virus Removal Tool.
30-01-2017 10:28:32 Removed Sophos Virus Removal Tool.

==================== Faulty Device Manager Devices =============

Name: Synaptics PS/2 Port Pointing Device
Description: Synaptics PS/2 Port Pointing Device
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Synaptics
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/30/2017 10:28:02 AM) (Source: MsiInstaller) (EventID: 11606) (User: jerry-PC)
Description: Product: Sophos Virus Removal Tool -- Error 1606.Could not access network location data.

Error: (01/30/2017 10:28:01 AM) (Source: MsiInstaller) (EventID: 11606) (User: jerry-PC)
Description: Product: Sophos Virus Removal Tool -- Error 1606.Could not access network location data.

Error: (01/30/2017 09:49:55 AM) (Source: MsiInstaller) (EventID: 11606) (User: jerry-PC)
Description: Product: Sophos Virus Removal Tool -- Error 1606.Could not access network location data.

Error: (01/30/2017 09:49:52 AM) (Source: MsiInstaller) (EventID: 11606) (User: jerry-PC)
Description: Product: Sophos Virus Removal Tool -- Error 1606.Could not access network location data.

Error: (01/30/2017 09:49:20 AM) (Source: MsiInstaller) (EventID: 11606) (User: jerry-PC)
Description: Product: Sophos Virus Removal Tool -- Error 1606.Could not access network location data.

Error: (01/29/2017 09:20:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/28/2017 10:17:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/28/2017 07:18:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/27/2017 10:02:15 PM) (Source: MsiInstaller) (EventID: 11316) (User: NT AUTHORITY)
Description: Product: FMW 1 -- Error 1316. The specified account already exists.

Error: (01/27/2017 09:38:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "C:\Windows\Temp\AvgSetup\9192852e-db00-47cf-9f9c-d157aa228a52\install\fmw\avgrdsttestx.exe".
Dependent Assembly AVG.VC140.CRT,processorArchitecture="x86",publicKeyToken="f92d94485545da78",type="win32",version="14.0.23918.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.


System errors:
=============
Error: (01/29/2017 09:20:16 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.

Error: (01/29/2017 09:20:16 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.

Error: (01/29/2017 09:20:16 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Error: (01/29/2017 09:19:15 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 10:20:37 PM on 1/28/2017 was unexpected.

Error: (01/28/2017 10:17:42 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.

Error: (01/28/2017 10:17:04 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.

Error: (01/28/2017 10:17:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Error: (01/28/2017 10:14:18 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.

Error: (01/28/2017 07:18:27 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.

Error: (01/28/2017 07:18:27 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.


CodeIntegrity:
===================================
Date: 2017-01-31 18:31:10.858
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgunivx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:31:09.161
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgunivx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:31:07.501
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgunivx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:31:05.778
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgunivx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:31:03.523
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgmfx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:31:02.401
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgmfx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:31:01.235
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgmfx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:31:00.079
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgmfx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:30:49.852
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-31 18:30:48.152
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD Athlon(tm) Processor 2650e
Percentage of memory in use: 63%
Total physical RAM: 2813.25 MB
Available physical RAM: 1035.35 MB
Total Virtual: 5869.05 MB
Available Virtual: 3876.41 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:69.52 GB) (Free:29.18 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:69.52 GB) (Free:64.72 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149.1 GB) (Disk ID: B63EE216)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=69.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=69.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

 

RogueKiller V12.9.6.0 [Jan 30 2017] (Free) by Adlice Software
mail : Contact - Adlice Software
Feedback : Adlice forum - Home
Website : RogueKiller Anti-Malware Free Download - Official Website
Blog : Adlice Software

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : jerry [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller.exe
Mode : Delete -- Date : 01/31/2017 21:20:58 (Duration : 01:04:06)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 4 ¤¤¤
[PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C} (C:\Windows\COUPON~1.OCX) -> Deleted
[Suspicious.Path] HKEY_CLASSES_ROOT\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC} (C:\Windows\COUPON~1.OCX) -> Deleted
[PUP.Gen0|PUP.Gen1] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\WtuSystemSupport ("C:\Program Files\AVG Web TuneUp\WtuSystemSupport.exe") -> Deleted
[PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1214&m=aspire_5515 -> Replaced (MSN.com - Hotmail, Outlook, Skype, Bing, Latest News, Photos & Videos)

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 1 ¤¤¤
[PUP.Gen1][Folder] C:\Program Files\Coupons -> Deleted
[PUP.Gen1][File] C:\Program Files\Coupons\Coupons.ico -> Deleted
[PUP.Gen1][File] C:\Program Files\Coupons\CouponsDotCom.url -> Deleted
[PUP.Gen1][File] C:\Program Files\Coupons\license_agreement.txt -> Deleted
[PUP.Gen1][File] C:\Program Files\Coupons\Uninstall\uninstall.dat -> Deleted
[PUP.Gen1][File] C:\Program Files\Coupons\Uninstall\uninstall.xml -> Deleted
[PUP.Gen1][Folder] C:\Program Files\Coupons\Uninstall -> Deleted
[PUP.Gen1][File] C:\Program Files\Coupons\uninstall.exe -> Deleted

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD16 00BEVT-22ZCT0 SCSI Disk Device +++++
--- User ---
[MBR] 3cc9fe40bde09045362c2c919a02afed
[BSP] 0f071cfbe77f754bc10c577fc5353435 : Acer|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 10244 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 20981760 | Size: 71192 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 166782976 | Size: 71189 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! ([1] Incorrect function. )

 

malwarebytes didn't find anything

# AdwCleaner v6.042 - Logfile created 01/02/2017 at 08:24:47
# Updated on 06/01/2017 by Malwarebytes
# Database : 2017-01-31.1 [Server]
# Operating System : Windows Vista (TM) Home Basic Service Pack 2 (X86)
# Username : jerry - JERRY-PC
# Running from : C:\Users\jerry\Downloads\AdwCleaner.exe
# Mode: Clean
# Support : Customer Support & Help Center



***** [ Services ] *****



***** [ Folders ] *****

[-] Folder deleted: C:\Users\jerry\AppData\Local\VirtualStore\Program Files\Convesoft


***** [ Files ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****



***** [ Registry ] *****

[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key deleted: HKU\S-1-5-21-4103279818-402611227-566158514-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}


***** [ Web browsers ] *****



*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1604 Bytes] - [01/02/2017 08:24:47]
C:\AdwCleaner\AdwCleaner[S0].txt - [1884 Bytes] - [31/01/2017 23:38:32]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1750 Bytes] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows Vista (TM) Home Basic x86
Ran by jerry (Administrator) on Wed 02/01/2017 at 8:46:19.59
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 17

Failed to delete: C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KLO2SP8H (Temporary Internet Files Folder)
Failed to delete: C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VPWRMSDI (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\wininit.ini (File)
Successfully deleted: C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9EF1I078 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ARIW2DY4 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MFM8K5BM (Temporary Internet Files Folder)
Successfully deleted: C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MLKN8BQF (Temporary Internet Files Folder)
Successfully deleted: C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OIG2B32E (Temporary Internet Files Folder)
Successfully deleted: C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SJYR2UGL (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9EF1I078 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ARIW2DY4 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KLO2SP8H (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MFM8K5BM (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MLKN8BQF (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OIG2B32E (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SJYR2UGL (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VPWRMSDI (Temporary Internet Files Folder)



Registry: 1

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 02/01/2017 at 8:50:58.12
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

I am running combofix. I started it last night and at 11 pm it was on stage 41. Its been running all night and now at 8am its on stage 48. Should I just let it keep running?

 

Its 7:45pm and combofix is still on stage 48 so I will wait for your recommendation.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-01-2017
Ran by jerry (administrator) on JERRY-PC (02-02-2017 21:15:16)
Running from C:\Users\jerry\Downloads
Loaded Profiles: jerry (Available Profiles: jerry)
Platform: Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Framework\Common\avgsvcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgwdsvcx.exe
(InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Framework\Common\avguix.exe
() C:\ACER\Mobility Center\MobilityService.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
() C:\ComboFix\PEV.exe
(Farbar) C:\Users\jerry\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AvgUi] => C:\Program Files\AVG\Framework\Common\avguirnx.exe [220944 2016-12-06] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\Framework\Common\avguirnx.exe [220944 2016-12-06] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6266880 2008-07-02] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2008-06-25] (Realtek Semiconductor Corp.)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1298456 2015-04-20] (CANON INC.)
HKU\S-1-5-21-4103279818-402611227-566158514-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6868696 2016-08-26] (Piriform Ltd)
HKU\S-1-5-21-4103279818-402611227-566158514-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [50599552 2016-02-10] (Skype Technologies S.A.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{79014BAE-3FE6-48B6-8DA3-FF4DE66098F4}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4103279818-402611227-566158514-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://us.search.yahoo.com/?fr=hp-dt&type=bestsearch_US_HomePage
HKU\S-1-5-21-4103279818-402611227-566158514-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-4103279818-402611227-566158514-1000 -> DefaultScope {42AB4FD8-C833-46E4-8226-26D2A1E7EC01} URL = hxxp://us.search.yahoo.com/search?fr=ds-dt&type=bestsearch_US_DefaultSearchEngine&p={searchTerms}
SearchScopes: HKU\S-1-5-21-4103279818-402611227-566158514-1000 -> {42AB4FD8-C833-46E4-8226-26D2A1E7EC01} URL = hxxp://us.search.yahoo.com/search?fr=ds-dt&type=bestsearch_US_DefaultSearchEngine&p={searchTerms}
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\jerry\AppData\Roaming\Mozilla\Firefox\Profiles\ihec866e.default-1466429628943 [2017-02-02]
FF Homepage: Mozilla\Firefox\Profiles\ihec866e.default-1466429628943 -> hxxps://www.yahoo.com/
FF Extension: (Ebates Cash Back) - C:\Users\jerry\AppData\Roaming\Mozilla\Firefox\Profiles\ihec866e.default-1466429628943\Extensions\{35d6291e-1d4b-f9b4-c52f-77e6410d1326}.xpi [2017-01-16]
FF Extension: (Adblock Plus) - C:\Users\jerry\AppData\Roaming\Mozilla\Firefox\Profiles\ihec866e.default-1466429628943\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]
FF Extension: (Diagnostics) - C:\Users\jerry\AppData\Roaming\Mozilla\Firefox\Profiles\ihec866e.default-1466429628943\features\{79222159-bad3-4418-8d6a-827d740907b7}\diagnostics@mozilla.org.xpi [2017-02-01]
FF Extension: (Send HSTS Priming Requests) - C:\Users\jerry\AppData\Roaming\Mozilla\Firefox\Profiles\ihec866e.default-1466429628943\features\{79222159-bad3-4418-8d6a-827d740907b7}\hsts-priming@mozilla.org.xpi [2017-02-01]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-12-25] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-27] ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AVGIDSAgent; C:\Program Files\AVG\Av\avgidsagent.exe [4154016 2017-01-09] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files\AVG\Framework\Common\avgsvcx.exe [935184 2016-12-06] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\Av\avgwdsvcx.exe [603288 2017-01-09] (AVG Technologies CZ, s.r.o.)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-20] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 ahcix86s; C:\Windows\System32\DRIVERS\ahcix86s.sys [129552 2008-08-06] (AMD Technologies Inc.)
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [134912 2016-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [259328 2016-11-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [207616 2016-10-05] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-11-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [244992 2016-11-30] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [287008 2016-02-16] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [197376 2016-09-26] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [47360 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [231680 2016-07-27] (AVG Technologies CZ, s.r.o.)
R0 Avgunivx; C:\Windows\System32\DRIVERS\avgunivx.sys [65280 2016-06-20] (AVG Technologies CZ, s.r.o.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2017-01-31] (Malwarebytes)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-20] (Microsoft Corporation)
U3 catchme; \??\C:\Users\jerry\AppData\Local\Temp\catchme.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files\TurboYourPC\Service.sys [X]
U3 mbr; \??\C:\ComboFix\mbr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-02 20:02 - 2017-02-02 21:11 - 00000000 ___SD C:\ComboFix
2017-02-02 20:00 - 2017-02-02 19:59 - 05659775 ____R (Swearware) C:\Users\jerry\Desktop\ComboFix.exe
2017-02-01 21:53 - 2017-02-01 21:53 - 00000000 ____D C:\Qoobox
2017-02-01 21:53 - 2011-06-26 01:45 - 00256000 _____ C:\Windows\PEV.exe
2017-02-01 21:53 - 2010-11-07 12:20 - 00208896 _____ C:\Windows\MBR.exe
2017-02-01 21:53 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2017-02-01 21:53 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2017-02-01 21:53 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2017-02-01 21:53 - 2000-08-30 19:00 - 00098816 _____ C:\Windows\sed.exe
2017-02-01 21:53 - 2000-08-30 19:00 - 00080412 _____ C:\Windows\grep.exe
2017-02-01 21:53 - 2000-08-30 19:00 - 00068096 _____ C:\Windows\zip.exe
2017-02-01 21:51 - 2017-02-02 20:02 - 00000000 ___SD C:\32788R22FWJFW
2017-02-01 08:50 - 2017-02-01 08:50 - 00003347 _____ C:\Users\jerry\Desktop\JRT.txt
2017-02-01 08:45 - 2017-02-01 08:45 - 01663040 _____ (Malwarebytes) C:\Users\jerry\Downloads\JRT.exe
2017-01-31 23:08 - 2017-02-01 08:24 - 00000000 ____D C:\AdwCleaner
2017-01-31 23:05 - 2017-01-31 23:06 - 03988944 _____ C:\Users\jerry\Downloads\AdwCleaner.exe
2017-01-31 21:20 - 2017-01-31 21:20 - 00000844 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2017-01-31 21:20 - 2017-01-31 21:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-01-31 21:20 - 2017-01-31 21:20 - 00000000 ____D C:\Program Files\RogueKiller
2017-01-31 21:11 - 2017-01-31 21:14 - 34821984 _____ (Adlice Software ) C:\Users\jerry\Downloads\setup.exe
2017-01-31 18:24 - 2017-01-31 18:25 - 01762816 _____ (Farbar) C:\Users\jerry\Downloads\FRST(1).exe
2017-01-30 17:02 - 2017-01-30 17:02 - 00000374 _____ C:\Windows\Tasks\REGUtilities Task.job
2017-01-30 17:02 - 2017-01-30 17:02 - 00000000 ____D C:\ProgramData\REGUtilities
2017-01-30 17:00 - 2017-01-30 17:00 - 01425776 _____ (Tuneup System Software Pvt Ltd. ) C:\Users\jerry\Downloads\REGUtilities_1.9_Setup.exe
2017-01-30 16:56 - 2017-01-30 16:56 - 02282656 _____ (Seven Servos Software Pvt Ltd. ) C:\Users\jerry\Downloads\TechUtilities_setup_1.9.exe.part
2017-01-27 15:35 - 2017-01-27 19:47 - 00000000 ____D C:\Program Files\Mozilla Firefox(147)

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-02 21:20 - 2016-02-17 09:58 - 00009298 _____ C:\Users\jerry\Downloads\FRST.txt
2017-02-02 21:17 - 2014-12-25 08:00 - 00000000 ____D C:\ProgramData\MFAData
2017-02-02 21:15 - 2016-02-17 09:58 - 00000000 ____D C:\FRST
2017-02-02 21:12 - 2015-05-18 07:19 - 00000000 ____D C:\Users\jerry\AppData\Local\CrashDumps
2017-02-02 21:01 - 2006-11-02 07:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2017-02-02 21:01 - 2006-11-02 07:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2017-02-02 20:34 - 2015-12-13 10:33 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-02-02 20:01 - 2016-11-28 10:02 - 00000000 ____D C:\Users\jerry\AppData\LocalLow\Mozilla
2017-02-01 09:03 - 2016-02-19 21:38 - 00000000 ____D C:\Users\jerry\AppData\Roaming\Skype
2017-02-01 09:01 - 2006-11-02 07:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-02-01 09:00 - 2006-11-02 07:58 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-01-31 22:46 - 2014-12-26 19:52 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-31 21:21 - 2015-05-17 20:21 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-01-31 18:42 - 2016-02-17 09:59 - 00022094 _____ C:\Users\jerry\Downloads\Addition.txt
2017-01-30 10:29 - 2015-05-19 20:47 - 00000000 ____D C:\ProgramData\Sophos
2017-01-29 11:02 - 2015-12-14 00:01 - 00000735 _____ C:\Users\Public\Desktop\AVG.lnk
2017-01-29 11:02 - 2015-12-14 00:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
2017-01-29 10:35 - 2015-12-14 00:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2017-01-29 09:27 - 2015-10-26 17:13 - 00000000 ____D C:\Users\jerry\AppData\Local\AvgSetupLog
2017-01-29 09:24 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\inf
2017-01-29 09:24 - 2006-11-02 05:33 - 00758862 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-29 09:21 - 2014-12-25 14:38 - 00000000 ____D C:\Users\jerry\Desktop\2014 Lease Tim Harvy
2017-01-28 20:33 - 2016-01-24 21:43 - 00000000 ____D C:\Users\jerry\Desktop\heli
2017-01-28 20:33 - 2016-01-07 00:38 - 00000000 ____D C:\Users\jerry\Desktop\pics
2017-01-28 20:33 - 2015-12-10 06:58 - 00000000 ____D C:\Users\jerry\Desktop\Old Firefox Data
2017-01-28 19:17 - 2016-05-06 20:48 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-01-28 17:14 - 2016-05-06 20:48 - 00000862 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-01-28 17:14 - 2016-05-06 20:48 - 00000850 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-01-28 17:13 - 2016-10-21 18:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-01-28 17:06 - 2008-12-04 07:45 - 00000000 ____D C:\Windows\system32\Macromed
2017-01-27 22:36 - 2015-10-22 06:42 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2017-01-27 22:36 - 2015-10-22 06:42 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2017-01-27 21:14 - 2014-12-24 21:07 - 00000000 ____D C:\Users\jerry
2017-01-27 21:13 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\system32\Msdtc
2017-01-27 21:11 - 2006-11-02 05:22 - 44302336 _____ C:\Windows\system32\config\components_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 37486592 _____ C:\Windows\system32\config\software_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 18350080 _____ C:\Windows\system32\config\system_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2017-01-27 21:11 - 2006-11-02 05:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2017-01-27 21:02 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\system32\spool
2017-01-27 21:01 - 2016-02-19 21:38 - 00000000 ___RD C:\Program Files\Skype
2017-01-27 21:01 - 2016-02-19 21:34 - 00000000 ____D C:\ProgramData\Skype
2017-01-27 21:01 - 2016-02-09 12:06 - 00000000 ___HD C:\ProgramData\CanonIJScan
2017-01-27 21:01 - 2016-02-09 11:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2017-01-27 21:01 - 2016-02-09 11:55 - 00000000 ____D C:\Program Files\Canon
2017-01-27 21:01 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\registration

==================== Files in the root of some directories =======

2015-12-17 07:23 - 2015-12-17 07:23 - 0000000 _____ () C:\Users\jerry\AppData\Roaming\wklnhst.dat
2016-12-18 17:45 - 2016-12-18 17:45 - 0000680 _____ () C:\Users\jerry\AppData\Local\d3d9caps.dat
2016-01-09 10:11 - 2016-01-09 10:11 - 0003584 _____ () C:\Users\jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-02-02 21:18

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 29-01-2017
Ran by jerry (02-02-2017 21:27:47)
Running from C:\Users\jerry\Downloads
Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) (2014-12-25 04:58:30)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4103279818-402611227-566158514-500 - Administrator - Disabled)
Guest (S-1-5-21-4103279818-402611227-566158514-501 - Limited - Disabled)
jerry (S-1-5-21-4103279818-402611227-566158514-1000 - Administrator - Enabled) => C:\Users\jerry

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition (Disabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition (Disabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Mobility Center Plug-In (HKLM\...\{11316260-6666-467B-AC34-183FCB5D4335}) (Version: 3.0.3000 - Acer Inc.)
Adobe Flash Player 24 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 24.0.0.194 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 24.0.0.194 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
ATI Catalyst Install Manager (HKLM\...\{67A8747E-0517-75EF-244F-9E219C440107}) (Version: 3.0.682.0 - ATI Technologies, Inc.)
AVG (HKLM\...\AvgZen) (Version: 1.113.2.50020 - AVG Technologies)
AVG (Version: 16.141.7998 - AVG Technologies) Hidden
AVG 2016 (Version: 16.0.4756 - AVG Technologies) Hidden
AVG Protection (HKLM\...\AVG) (Version: 2016.141.7998 - AVG Technologies)
AVG Zen (Version: 1.113.1 - AVG Technologies) Hidden
Canon MP Navigator EX 4.0 (HKLM\...\MP Navigator EX 4.0) (Version: - )
Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version: - )
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.6.1 - Canon Inc.)
ccc-core-static (Version: 2008.0703.2236.38526 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.22 - Piriform)
FMW 1 (Version: 1.143.3 - AVG Technologies) Hidden
InterVideo WinDVD 8 (HKLM\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0-B9.574 - InterVideo Inc.)
InterVideo WinDVD 8 (Version: 8.0-B9.574 - InterVideo Inc.) Hidden
iPhone Backup Extractor (HKU\S-1-5-21-4103279818-402611227-566158514-1000\...\iPhone Backup Extractor) (Version: 6.0.5.768 - Reincubate Ltd)
iPhone Backup Extractor (Version: 6.0.5.768 - Reincubate Ltd) Hidden
LightScribe 1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Word 2000 (HKLM\...\{00170409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Works (HKLM\...\{6D52C408-B09A-4520-9B18-475B81D393F1}) (Version: 08.05.0818 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox 51.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 51.0.1 (x86 en-US)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 51.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5657 - Realtek Semiconductor Corp.)
RogueKiller version 12.9.6.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.9.6.0 - Adlice Software)
Skins (Version: 2008.0703.2236.38526 - ATI) Hidden
Skype™ 7.18 (HKLM\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.0.2.0 - Synaptics)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {2E839851-64A0-46DF-AE81-FCCB18DB1383} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-27] (Adobe Systems Incorporated)
Task: {3A445936-83FD-4657-9E0C-642CBB339A67} - System32\Tasks\REGUtilities Task => C:\Program Files\REGUtilities\REGUtilities.exe <==== ATTENTION
Task: {A7966D42-CBAF-44C5-857C-117C8C182EAC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {E69DD813-BDDA-4DE4-8657-B2133704CB52} - System32\Tasks\{C3ACDD59-0C4B-489B-9C4F-1A212A8EECF5} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=7.18.0.112&amp;LastError=-3
Task: {ED1459E4-D920-4BC1-91C7-F5231BE0E9B3} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-08-26] (Piriform Ltd)
Task: {FDF11D69-5BB6-4816-AACE-A6D537A2444E} - System32\Tasks\AVG EUpdate Task => avgsetupx.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\REGUtilities Task.job => C:\Program Files\REGUtilities\REGUtilities.exe -t C:\Program Files\REGUtilities\REGUtilities.exe <==== ATTENTION

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2008-12-04 06:05 - 2008-07-03 22:37 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2017-01-27 21:31 - 2017-01-27 21:30 - 48920064 _____ () C:\Program Files\AVG\UiDll\2623\libcef.dll
2008-12-04 08:14 - 2007-12-06 19:15 - 00110592 _____ () C:\Acer\Mobility Center\MobilityService.exe
2008-12-04 08:14 - 2007-11-27 18:08 - 00032768 _____ () C:\Acer\Mobility Center\MobilityInterface.dll
2017-02-02 20:02 - 2011-06-26 01:45 - 00256000 _____ () C:\ComboFix\PEV.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

HKLM\...\cmdfile\DefaultIcon: %SystemRoot%\System32\imageres.dll,-68 <===== ATTENTION

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 05:23 - 2006-09-18 16:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4103279818-402611227-566158514-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\jerry\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{BE1E1569-ADF3-41A9-AFE0-3FC8BE991B45}] => LPort=80
FirewallRules: [{7159459A-A8C5-4553-9438-3CCE6EAB70B8}] => LPort=80
FirewallRules: [{BCC31CF4-84BC-4C5B-B2E1-2ED8BCD49C5A}] => LPort=80
FirewallRules: [{F906CAAC-8DDC-4649-9D7C-EC061306C23A}] => C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{6855460D-A199-43C0-AE89-15D51F0FD8F5}] => C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{1D5EEB6A-9D2D-4A8D-A642-8A8F44023604}] => C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{070D6C14-EF15-42AB-911A-120A071C43BB}] => C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{29B0AD16-8FB2-42CA-A907-E77EEAD7AF2B}] => C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{87FB7EA3-705F-4CDD-87EE-993637BD74BB}] => C:\Program Files\Internet Explorer\iexplore.exe
FirewallRules: [{AD7643AB-98A6-46B5-8C9C-7978642AB843}] => C:\Program Files\Internet Explorer\iexplore.exe
FirewallRules: [{575321A2-C5AE-48D7-9EF4-F84527992757}] => C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{BB68C489-EF1D-4F36-A480-8CFDF8C17E93}] => C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{E854F8FA-3512-4EEF-9B81-8E8BB9D9C5A3}] => C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{6638745A-EC98-40AA-8336-C456CC02010A}] => C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{BB9CDCBE-DC76-4ADD-BF8F-A04AF833FF4C}] => C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{8F26D9C5-3156-4371-BBC4-2548174CE6EE}] => C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [TCP Query User{A6E575D2-4BE7-444E-A032-F2D7950751F5}C:\program files\free torrent opener\free torrent opener.exe] => C:\program files\free torrent opener\free torrent opener.exe
FirewallRules: [UDP Query User{8D168CB0-C15A-40B5-A6F7-8E7657E9D3B7}C:\program files\free torrent opener\free torrent opener.exe] => C:\program files\free torrent opener\free torrent opener.exe
FirewallRules: [{3AB13EA5-C06E-4ED0-87DC-293B0C572970}] => C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{1F5D30DC-58F5-4869-A35F-11BF401F1947}] => C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{835854F7-649A-44B3-9144-7533CD35B9B5}] => C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{2340A1CC-B5C8-4C46-983B-2154950B8F2C}] => C:\Program Files\AVG\Av\avgnsx.exe
FirewallRules: [{17066E2F-EF0D-440B-80F6-FE0A53D00163}] => C:\Program Files\AVG\Av\avgnsx.exe
FirewallRules: [{14D50BE1-150F-4903-B012-90FD6E8B3228}] => C:\Program Files\AVG\Av\avgemcx.exe
FirewallRules: [{D17364C8-D812-400E-8BC2-D7A17B6349A9}] => C:\Program Files\AVG\Av\avgemcx.exe

==================== Restore Points =========================

05-12-2016 13:12:35 Scheduled Checkpoint
06-12-2016 07:59:38 Scheduled Checkpoint
07-12-2016 12:05:27 Scheduled Checkpoint
08-12-2016 00:19:12 Scheduled Checkpoint
11-12-2016 17:04:50 Scheduled Checkpoint
27-01-2017 20:55:44 Restore Operation
30-01-2017 09:59:26 Removed Sophos Virus Removal Tool.
30-01-2017 10:03:29 Removed Sophos Virus Removal Tool.
30-01-2017 10:11:20 Installed Sophos Virus Removal Tool.
30-01-2017 10:28:32 Removed Sophos Virus Removal Tool.
01-02-2017 08:46:19 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/02/2017 08:42:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application PEV.exe, version 0.0.0.0, time stamp 0x4e06cfe8, faulting module PEV.exe, version 0.0.0.0, time stamp 0x4e06cfe8, exception code 0x40000015, fault offset 0x0008d1c0,
process id 0x7a0, application start time 0x01d27dbeba46ac90.

Error: (02/01/2017 09:44:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program CCleaner.exe version 5.22.0.5724 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: 1778
Start Time: 01d27cfdbe437560
Termination Time: 15642

Error: (02/01/2017 09:02:45 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/01/2017 08:59:30 AM) (Source: EventSystem) (EventID: 4621) (User: )
Description: The COM+ Event System could not remove the EventSystem.EventSubscription object {CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The HRESULT was 80070005.

Error: (02/01/2017 08:32:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/01/2017 08:28:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: The entry <C:\USERS\JERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\IHEC866E.DEFAULT-1466429628943\SAFEBROWSING> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Error: (02/01/2017 08:28:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: The entry <C:\USERS\JERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\IHEC866E.DEFAULT-1466429628943\SAFEBROWSING> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Error: (02/01/2017 08:28:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: The entry <C:\USERS\JERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\IHEC866E.DEFAULT-1466429628943\SAFEBROWSING> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Error: (02/01/2017 08:28:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: The entry <C:\USERS\JERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\IHEC866E.DEFAULT-1466429628943\SAFEBROWSING> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Error: (02/01/2017 08:28:09 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: The entry <C:\USERS\JERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\IHEC866E.DEFAULT-1466429628943\SAFEBROWSING> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)


System errors:
=============
Error: (02/02/2017 08:46:17 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (02/02/2017 08:19:21 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (02/02/2017 09:25:19 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (02/02/2017 09:00:06 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (02/01/2017 10:35:28 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (02/01/2017 10:10:24 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (02/01/2017 09:02:46 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.

Error: (02/01/2017 09:02:46 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.

Error: (02/01/2017 09:02:46 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Error: (02/01/2017 08:32:04 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
Access is denied.


CodeIntegrity:
===================================
Date: 2017-02-02 21:19:14.918
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgunivx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:19:13.277
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgunivx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:19:11.643
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgunivx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:19:09.972
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgunivx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:19:07.778
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgmfx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:19:06.135
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgmfx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:19:04.482
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgmfx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:19:02.851
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgmfx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:19:00.720
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-02-02 21:18:58.672
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD Athlon(tm) Processor 2650e
Percentage of memory in use: 44%
Total physical RAM: 2813.25 MB
Available physical RAM: 1555.09 MB
Total Virtual: 5867.05 MB
Available Virtual: 4337.47 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:69.52 GB) (Free:29.06 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:69.52 GB) (Free:64.72 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149.1 GB) (Disk ID: B63EE216)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=69.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=69.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

 

Fix result of Farbar Recovery Scan Tool (x86) Version: 29-01-2017
Ran by jerry (02-02-2017 22:59:05) Run:1
Running from C:\Users\jerry\Desktop
Loaded Profiles: jerry (Available Profiles: jerry)
Boot Mode: Normal

==============================================

fixlist content:
*****************
U3 catchme; \??\C:\Users\jerry\AppData\Local\Temp\catchme.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files\TurboYourPC\Service.sys [X]
U3 mbr; \??\C:\ComboFix\mbr.sys [X]
2015-12-17 07:23 - 2015-12-17 07:23 - 0000000 _____ () C:\Users\jerry\AppData\Roaming\wklnhst.dat
2016-12-18 17:45 - 2016-12-18 17:45 - 0000680 _____ () C:\Users\jerry\AppData\Local\d3d9caps.dat
2016-01-09 10:11 - 2016-01-09 10:11 - 0003584 _____ () C:\Users\jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Task: {3A445936-83FD-4657-9E0C-642CBB339A67} - System32\Tasks\REGUtilities Task => C:\Program Files\REGUtilities\REGUtilities.exe <==== ATTENTION
C:\Program Files\REGUtilities
Task: C:\Windows\Tasks\REGUtilities Task.job => C:\Program Files\REGUtilities\REGUtilities.exe -t C:\Program Files\REGUtilities\REGUtilities.exe <==== ATTENTION
HKLM\...\cmdfile\DefaultIcon: %SystemRoot%\System32\imageres.dll,-68 <===== ATTENTION

*****************

HKLM\System\CurrentControlSet\Services\catchme => key removed successfully.
catchme => service removed successfully.
HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0 => key removed successfully.
WinRing0_1_2_0 => service removed successfully.
HKLM\System\CurrentControlSet\Services\mbr => key removed successfully.
mbr => service removed successfully.
C:\Users\jerry\AppData\Roaming\wklnhst.dat => moved successfully
C:\Users\jerry\AppData\Local\d3d9caps.dat => moved successfully
C:\Users\jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3A445936-83FD-4657-9E0C-642CBB339A67} => key removed successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3A445936-83FD-4657-9E0C-642CBB339A67} => key removed successfully.
C:\Windows\System32\Tasks\REGUtilities Task => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\REGUtilities Task => key removed successfully.
"C:\Program Files\REGUtilities" => not found.
C:\Windows\Tasks\REGUtilities Task.job => moved successfully
HKLM\Software\Classes\cmdfile\DefaultIcon\\Default => value restored successfully

==== End of Fixlog 22:59:14 ====

 

Results of screen317's Security Check version 1.014 --- 12/23/15
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Firewall Disabled!
AVG AntiVirus Free Edition
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Adobe Flash Player 24.0.0.194
Adobe Reader XI
Mozilla Firefox (51.0.1)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 6 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

 

Farbar Service Scanner Version: 27-01-2016
Ran by jerry (administrator) on 03-02-2017 at 08:53:36
Running from "C:\Users\jerry\Desktop"
Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => File is digitally signed
C:\Windows\system32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\system32\dhcpcsvc.dll => File is digitally signed
C:\Windows\system32\Drivers\afd.sys => File is digitally signed
C:\Windows\system32\Drivers\tdx.sys => File is digitally signed
C:\Windows\system32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\system32\dnsrslvr.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\mpssvc.dll => File is digitally signed
C:\Windows\system32\bfe.dll => File is digitally signed
C:\Windows\system32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\system32\SDRSVC.dll => File is digitally signed
C:\Windows\system32\vssvc.exe => File is digitally signed
C:\Windows\system32\wscsvc.dll => File is digitally signed
C:\Windows\system32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\system32\wuaueng.dll => File is digitally signed
C:\Windows\system32\qmgr.dll => File is digitally signed
C:\Windows\system32\es.dll => File is digitally signed
C:\Windows\system32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\system32\ipnathlp.dll => File is digitally signed
C:\Windows\system32\iphlpsvc.dll => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed


**** End of log ****

 

Hi I downloaded sophos virus tool and tried to run it. Got to where it should of opened and ready to run but it never opened all day long.

 

found no infections

 

today i deleted and downloaded sophos and it ran, took about 4hr and found no problem