1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved infected?

Discussion in 'Malware and Virus Removal' started by dodopie, 2017/04/29.

Page 1 of 2
  1. 2017/04/29
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Hi, I had downloaded a $$ saving software called honey and then this computer started running real slow both in itself and online. I removed it and it still ran so slow so I tried system restore but it is still so slow. I hope you can help
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-04-2017
    Ran by Tori (administrator) on TORI-PC (29-04-2017 16:24:33)
    Running from C:\Users\Tori\Desktop
    Loaded Profiles: Tori (Available Profiles: IUSR_NMPR & Tori)
    Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (Dropbox, Inc.) C:\WINDOWS\System32\DbxSvc.exe
    () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehrecvr.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehsched.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    (Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
    () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    (Conexant Systems, Inc.) C:\WINDOWS\System32\drivers\XAudio.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe
    (AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
    (Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    (Realtek Semiconductor) C:\WINDOWS\RtHDVCpl.exe
    (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
    (Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
    (Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxsrvc.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Logitech Inc.) C:\Program Files\Logitech\Logitech Vid\Vid.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
    (NETGEAR) C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    () C:\Program Files\NETGEAR\WNA1100\WNA1100.exe
    (Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
    () C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    (Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    (Yahoo! Inc.) C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
    (Hewlett-Packard Company) C:\hp\KBD\kbd.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [hpsysdrv] => c:\hp\support\hpsysdrv.exe [65536 2006-09-28] (Hewlett-Packard Company)
    HKLM\...\Run: [KBD] => C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
    HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-11-15] (Intel Corporation)
    HKLM\...\Run: [CCUTRAYICON] => FactoryMode
    HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-10-14] (Hewlett-Packard)
    HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
    HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4390912 2007-03-01] (Realtek Semiconductor)
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1311312 2010-06-25] (Logitech, Inc.)
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-04] (AVAST Software)
    HKLM\...\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [28344536 2017-04-26] (Dropbox, Inc.)
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
    HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
    HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
    HKLM\...\RunOnce: [Launcher] => C:\Windows\SMINST\launcher.exe [44168 2007-03-07] (soft thinks)
    HKLM\...\Policies\Explorer: [MemCheckBoxInRunDlg] 1
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Logitech Vid] => C:\Program Files\Logitech\Logitech Vid\Vid.exe [5458704 2009-07-16] (Logitech Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\RunOnce: [Adobe Speed Launcher] => 1493491491
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [221184 2008-01-19] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-04-26] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2017-04-04] (AVAST Software)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2012-03-17]
    ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WN111v2 Smart Wizard.lnk [2013-08-18]
    ShortcutTarget: NETGEAR WN111v2 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WN111v2\WN111v2.exe (NETGEAR)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Smart Wizard.lnk [2016-06-07]
    ShortcutTarget: NETGEAR WNA1100 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WNA1100\WNA1100.exe ()
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk [2007-04-21]
    ShortcutTarget: Snapfish Media Detector.lnk -> C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe ()
    Startup: C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2009-10-31]
    ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{2E0AA886-5EBF-401D-B070-6204C97B6624}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{435B15BB-F8C5-4712-9E94-F75174A18D50}: [DhcpNameServer] 208.59.247.45 208.59.247.46
    Tcpip\..\Interfaces\{5D2835A6-C339-499D-A5C8-A58D50CBC840}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{7F33EFC5-70C0-4B52-B39A-8F7FCDA6A7AD}: [DhcpNameServer] 75.114.81.1 75.114.81.2
    Tcpip\..\Interfaces\{FE880611-5A3F-4E43-8528-9B371CDA42BE}: [DhcpNameServer] 65.32.5.111 65.32.5.112

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=8
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
    SearchScopes: HKLM -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=HVDUS7
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> DefaultScope {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=chr-tyc-inbox
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://www.bing.com/search?FORM=UP94DF&PC=UP94&dt=072313&q={searchTerms}&src=IE-SearchBox
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-02-12] (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-04-04] (AVAST Software)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-12] (Oracle Corporation)
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

    FireFox:
    ========
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: (Microsoft .NET Framework Assistant) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-10-22] [not signed]
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2017-03-10]
    FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
    FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2017-03-10]
    FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-12] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-12] (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @real.com/nppl3260;version=6.0.11.2571 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprjplug;version=1.0.2.2629 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 -> C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll [2006-03-31] (RealNetworks, Inc.)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
    FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

    Chrome:
    =======
    CHR Profile: C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default [2017-04-29]
    CHR Extension: (Ebates Cash Back) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\chhjbpecpncaggjpdakmflnfcopglcmi [2017-04-07]
    CHR Extension: (Avast Online Security) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-04-06]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
    CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation) [File not signed]
    R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5758120 2017-04-04] (AVAST Software s.r.o.)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-04] (AVAST Software)
    S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42288 2017-04-26] (Dropbox, Inc.)
    R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] () [File not signed]
    R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [139264 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 IAANTMON; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [81920 2006-11-15] (Intel Corporation) [File not signed]
    S3 IDriverT; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
    S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation) [File not signed]
    S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 jswpsapi; C:\Program Files\NETGEAR\WNA1100\jswpsapi.exe [960992 2010-03-22] (Atheros Communications, Inc.)
    R2 LightScribeService; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
    S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-09-01] () [File not signed]
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [3303888 2017-01-20] (Malwarebytes)
    S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation) [File not signed]
    R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
    R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
    S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
    R2 WSWNA1100; C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe [266240 2010-08-04] () [File not signed]

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [255184 2017-04-04] (AVAST Software s.r.o.)
    R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [148208 2017-04-04] (AVAST Software s.r.o.)
    R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [267528 2017-04-04] (AVAST Software s.r.o.)
    R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [41176 2017-04-04] (AVAST Software s.r.o.)
    S3 aswHdsKe; C:\Windows\system32\drivers\aswHdsKe.sys [73656 2017-04-29] (AVAST Software)
    S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34136 2017-04-04] (AVAST Software)
    R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [31064 2017-04-04] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107928 2017-04-28] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [60760 2017-04-04] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [62152 2017-04-04] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [764064 2017-04-04] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [472760 2017-04-28] (AVAST Software)
    R3 aswStmXP; C:\Windows\system32\drivers\aswStmXP.sys [184208 2017-04-04] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [279800 2017-04-04] (AVAST Software)
    R3 athur; C:\Windows\System32\DRIVERS\athur.sys [1439744 2010-10-10] (Atheros Communications, Inc.)
    S3 DNIMp50; C:\Windows\System32\Drivers\DNIMp50.sys [21504 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    S3 DNISp50; C:\Windows\System32\Drivers\DNISp50.sys [20480 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2017-02-12] (GFI Software)
    S3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE2500vista.sys [1073216 2011-03-30] (Broadcom Corporation)
    R3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25752 2009-10-07] ()
    S3 LVUSBSta; C:\Windows\System32\drivers\lvusbsta.sys [41248 2006-12-15] (Logitech Inc.)
    R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [220088 2017-04-29] (Malwarebytes)
    S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [64288 2017-04-19] (Malwarebytes)
    R1 SBRE; C:\Windows\system32\drivers\SBREDrv.sys [101720 2011-11-01] (Sunbelt Software)
    R0 SCMNdisP; C:\Windows\System32\DRIVERS\scmndisp.sys [21728 2007-01-19] (Windows (R) Codename Longhorn DDK provider)
    S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)
    S3 WN111v2; C:\Windows\System32\DRIVERS\WN111v2v.sys [453120 2009-01-13] (Atheros Communications, Inc.)
    U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
    S3 dbx; system32\DRIVERS\dbx.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-04-29 16:24 - 2017-04-29 16:25 - 00022273 _____ C:\Users\Tori\Desktop\FRST.txt
    2017-04-29 16:24 - 2017-04-29 16:24 - 00000000 ____D C:\FRST
    2017-04-29 16:16 - 2017-04-29 16:23 - 01768448 _____ (Farbar) C:\Users\Tori\Desktop\FRST.exe
    2017-04-29 14:39 - 2017-04-29 10:56 - 00073656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys
    2017-04-27 01:27 - 2017-04-27 01:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
    2017-04-27 01:24 - 2017-04-27 01:24 - 00000000 ____D C:\ProgramData\SWCUTemp
    2017-04-26 14:02 - 2017-04-26 14:02 - 00042288 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
    2017-04-19 18:21 - 2017-04-19 18:21 - 00161216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
    2017-04-19 18:20 - 2017-04-29 14:42 - 00220088 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2017-04-19 18:20 - 2017-04-19 18:22 - 00064288 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
    2017-04-19 18:20 - 2017-04-19 18:20 - 00039360 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2017-04-19 18:20 - 2017-04-19 18:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2017-04-19 18:20 - 2017-04-19 18:20 - 00000000 ____D C:\ProgramData\Malwarebytes
    2017-04-19 18:20 - 2017-03-22 11:02 - 00059904 _____ C:\Windows\system32\Drivers\mbae.sys
    2017-04-19 18:11 - 2017-04-19 18:17 - 60107896 _____ (Malwarebytes ) C:\Users\Tori\Downloads\mb3-setup-consumer-3.0.6.1469-10103.exe
    2017-04-19 15:18 - 2017-04-19 15:18 - 00118190 _____ C:\Users\Tori\Documents\USPS - Welcome to PO Boxes Online.pdf
    2017-04-17 20:12 - 2017-04-17 19:06 - 00003294 _____ C:\Users\Tori\Documents\JRT.txt
    2017-04-12 17:57 - 2017-04-12 17:57 - 00009728 _____ C:\Users\Tori\Documents\april Jerry.wps
    2017-04-12 12:18 - 2017-04-12 12:18 - 00153940 _____ C:\Users\Tori\Downloads\2016TaxReturn.PDF
    2017-04-09 20:33 - 2017-04-09 20:33 - 00145064 _____ C:\Windows\Minidump\Mini040917-01.dmp
    2017-04-04 13:06 - 2017-04-04 13:05 - 00330256 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
    2017-04-03 09:48 - 2017-04-03 09:48 - 00001901 _____ C:\Users\Tori\Desktop\Google Chrome.lnk
    2017-04-03 09:47 - 2017-04-03 09:47 - 00000459 _____ C:\Users\Tori\Desktop\**** - Shortcut.lnk

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-04-29 16:21 - 2015-12-01 12:47 - 00000892 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
    2017-04-29 15:29 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    2017-04-29 15:29 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    2017-04-29 15:21 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\inf
    2017-04-29 15:21 - 2006-11-02 06:33 - 00778466 _____ C:\Windows\system32\PerfStringBackup.INI
    2017-04-29 14:49 - 2015-12-01 12:51 - 00000000 ___RD C:\Users\Tori\Dropbox
    2017-04-29 14:44 - 2007-04-21 07:29 - 00000000 ____D C:\Windows\SMINST
    2017-04-29 14:43 - 2015-12-01 12:47 - 00000888 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
    2017-04-29 14:42 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2017-04-29 14:42 - 2006-11-02 08:37 - 00000000 ___RD C:\Users\Public\Recorded TV
    2017-04-29 14:40 - 2006-11-02 09:01 - 00032556 _____ C:\Windows\Tasks\SCHEDLGU.TXT
    2017-04-28 14:28 - 2017-02-16 15:12 - 00001280 _____ C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2017-04-28 13:07 - 2015-11-20 16:57 - 00472760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
    2017-04-28 13:07 - 2015-11-20 16:57 - 00107928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
    2017-04-27 14:17 - 2017-03-25 15:45 - 00000000 ___RD C:\Users\Tori\Documents\****
    2017-04-27 01:28 - 2015-12-01 12:47 - 00000000 ____D C:\Program Files\Dropbox
    2017-04-22 19:10 - 2010-08-23 00:18 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
    2017-04-13 11:21 - 2016-07-09 12:16 - 00000000 _____ C:\Windows\system32\last.dump
    2017-04-11 13:49 - 2013-06-29 13:04 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
    2017-04-11 13:49 - 2013-06-29 13:04 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
    2017-04-11 13:49 - 2007-04-21 06:54 - 00000000 ____D C:\Windows\system32\Macromed
    2017-04-11 13:12 - 2015-09-29 12:39 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs
    2017-04-09 20:37 - 2015-11-20 17:10 - 00349254 _____ C:\Windows\ntbtlog.txt
    2017-04-09 20:33 - 2014-08-20 19:28 - 324821857 _____ C:\Windows\MEMORY.DMP
    2017-04-09 20:33 - 2010-06-05 15:08 - 00000000 ____D C:\Windows\Minidump
    2017-04-04 13:06 - 2015-11-20 16:57 - 00279800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
    2017-04-04 13:06 - 2015-11-20 16:57 - 00184208 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStmXP.sys
    2017-04-04 13:06 - 2015-11-20 16:57 - 00062152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
    2017-04-04 13:06 - 2015-11-20 16:57 - 00060760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
    2017-04-04 13:06 - 2015-11-20 16:57 - 00034136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
    2017-04-04 13:05 - 2017-02-10 08:37 - 00267528 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswblogx.sys
    2017-04-04 13:05 - 2017-02-10 08:37 - 00255184 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdriverx.sys
    2017-04-04 13:05 - 2017-02-10 08:37 - 00148208 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidshx.sys
    2017-04-04 13:05 - 2017-02-10 08:37 - 00041176 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbunivx.sys
    2017-04-04 13:05 - 2016-05-13 17:47 - 00031064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
    2017-04-04 13:05 - 2015-11-20 16:57 - 00764064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
    2017-03-30 18:03 - 2016-08-29 17:52 - 00166912 _____ C:\Users\Tori\Documents\beach house.wps

    ==================== Files in the root of some directories =======

    2017-02-16 15:12 - 2017-04-28 14:28 - 0001280 _____ () C:\Users\Tori\AppData\Roaming\wklnhst.dat

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2017-04-29 14:50

    ==================== End of FRST.txt ============================
     
    dodopie,
    #1
  2. 2017/04/29
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-04-2017
    Ran by Tori (29-04-2017 16:26:19)
    Running from C:\Users\Tori\Desktop
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) (2009-10-20 17:03:37)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1137620820-469648318-63125674-500 - Administrator - Disabled)
    Guest (S-1-5-21-1137620820-469648318-63125674-501 - Limited - Enabled)
    IUSR_NMPR (S-1-5-21-1137620820-469648318-63125674-1000 - Limited - Disabled) => C:\Users\IUSR_NMPR
    Tori (S-1-5-21-1137620820-469648318-63125674-1001 - Administrator - Enabled) => C:\Users\Tori

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
    AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    2600 (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    2600_Help (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    2600Trb (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
    Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
    Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
    Adobe AIR (HKLM\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
    Adobe Flash Player 25 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 25.0.0.148 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
    AIO_CDB_ProductContext (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    AIO_CDB_Software (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    AiO_Scan (Version: 43.0.217.000 - Hewlett-Packard) Hidden
    AIO_Scan (Version: 82.0.173.000 - Hewlett-Packard) Hidden
    AndroChef Java Decompiler (HKLM\...\{8DC30045-8565-492C-A6C4-30DEFF1169DE}) (Version: 1.0.0.12 - Atanas Neshkov)
    Avast Free Antivirus (HKLM\...\Avast Antivirus) (Version: 17.3.2291 - AVAST Software)
    BufferChm (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version: - )
    Cards_Calendar_OrderGift_DoMorePlugout (Version: 1.00.0000 - Hewlett-Packard) Hidden
    Copy (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Destination Component (Version: 100.0.0.0 - Hewlett-Packard) Hidden
    DeviceDiscovery (Version: 100.0.190.000 - Hewlett-Packard) Hidden
    DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_ProductContext (Version: 100.0.215.000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_Software (Version: 100.0.206.000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_Software_Min (Version: 100.0.213.000 - Hewlett-Packard) Hidden
    DocProc (Version: 10.0.0.0 - Hewlett-Packard) Hidden
    Dropbox (HKLM\...\Dropbox) (Version: 24.4.17 - Dropbox, Inc.)
    Dropbox Update Helper (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
    EE Full (HKLM\...\{C087A7EF-E572-4A39-B7EE-B1391B12D516}) (Version: 1.0.0.0 - )
    Enhanced Multimedia Keyboard Solution (HKLM\...\KBD) (Version: - Hewlett-Packard)
    eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
    Extension Changer (HKLM\...\Extension Changer) (Version: 0.5 - Yehia A.Salam)
    Fax (Version: 82.0.188.000 - Hewlett-Packard) Hidden
    Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
    Google Earth (HKLM\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
    Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.33.5 - Google Inc.) Hidden
    GPBaseService (Version: 100.0.187.000 - Hewlett-Packard) Hidden
    Hardware Diagnostic Tools (HKLM\...\PC-Doctor 5 for Windows) (Version: 5.00.4424.15 - PC-Doctor, Inc.)
    HP Advisor (HKLM\...\{73A43E42-3658-4DD9-8551-FACDA3632538}) (Version: 3.1.9152.3107 - Hewlett-Packard)
    HP Customer Experience Enhancements (HKLM\...\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}) (Version: 5.1.0.2264 - Hewlett-Packard)
    HP Customer Participation Program 10.0 (HKLM\...\HPExtendedCapabilities) (Version: 10.0 - HP)
    HP Deskjet F4200 All-In-One Driver Software 10.0 Rel .3 (HKLM\...\{AE9A67F9-ADF1-4a44-BAB5-C1DB302B37A2}) (Version: 10.0 - HP)
    HP Easy Setup - Frontend (HKLM\...\{40F7AED3-0C7D-4582-99F6-484A515C73F2}) (Version: 5.1.0.2269 - Hewlett-Packard)
    HP Imaging Device Functions 10.0 (HKLM\...\HP Imaging Device Functions) (Version: 10.0 - HP)
    HP On-Screen Cap/Num/Scroll Lock Indicator (HKLM\...\OsdMaestro) (Version: - Hewlett-Packard)
    HP Photosmart C4400 All-In-One Driver Software 10.0 Rel .3 (HKLM\...\{FF1F4E8E-A833-4c4b-A14A-45D5B841B5D8}) (Version: 10.0 - HP)
    HP Photosmart Essential (HKLM\...\{EB21A812-671B-4D08-B974-2A347F0D8F70}) (Version: 1.12.0.46 - HP)
    HP Photosmart Essential 2.5 (HKLM\...\HP Photosmart Essential) (Version: 2.5 - HP)
    HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B (HKLM\...\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}) (Version: 8.0 - HP)
    HP Smart Web Printing (HKLM\...\HP Smart Web Printing) (Version: 3.5 - HP)
    HP Solution Center 10.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 10.0 - HP)
    HP Update (HKLM\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
    HPPhotoSmartPhotobookWebPack1 (Version: 1.00.0000 - Hewlett-Packard) Hidden
    HPProductAssistant (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    HPSSupply (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
    Intel(R) Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - )
    Intel® Viiv™ Software (HKLM\...\Intel(R) Configuration Center) (Version: 1.6.361.6 - Intel Corporation)
    Java 8 Update 121 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
    LG PC Suite (HKLM\...\LG PC Suite) (Version: 5.3.25.20150529 - LG Electronics)
    LG United Mobile Drivers (HKLM\...\{4DE95ED9-0A29-4C4F-8463-35857CF9BA36}) (Version: 3.14.1 - LG Electronics)
    LightScribe 1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
    Logitech Legacy USB Camera Driver Package (HKLM\...\legacyqcam_10.50) (Version: 10.50.1091 - )
    Logitech SetPoint 6.15 (HKLM\...\SP6) (Version: 6.15.25 - Logitech)
    Logitech Vid (HKLM\...\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}) (Version: 1.10.1009 - Logitech Inc.)
    Logitech Webcam Software (HKLM\...\{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}) (Version: 12.10.1113 - Logitech Inc.)
    Malwarebytes version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
    MarketResearch (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (HKLM\...\{90120000-00B2-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Works (HKLM\...\{6D52C408-B09A-4520-9B18-475B81D393F1}) (Version: 08.05.0818 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    muvee autoProducer 6.0 (HKLM\...\{6AF49698-949A-4C89-9B31-041D2CCB5FBD}) (Version: 6.00.050 - muvee Technologies)
    My HP Games (HKLM\...\WildTangent hpdesktop Master Uninstall) (Version: HPCMPQ1701 - WildTangent)
    NETGEAR WNA1100 N150 Wireless USB Adapter (HKLM\...\{A2AE9709-283B-4B48-AA34-729C070A62FB}) (Version: 1.0.0.133 - NETGEAR)
    OCR Software by I.R.I.S. 10.0 (HKLM\...\HPOCR) (Version: 10.0 - HP)
    OpenOffice 4.0.1 (HKLM\...\{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}) (Version: 4.01.9714 - Apache Software Foundation)
    PanoStandAlone (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_ProductContext (Version: 100.0.215.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_Software (Version: 100.0.206.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_Software_Min (Version: 100.0.213.000 - Hewlett-Packard) Hidden
    PSSWCORE (Version: 2.02.0000 - Hewlett-Packard) Hidden
    Python 2.4.3 (HKLM\...\{75E71ADD-042C-4F30-BFAC-A9EC42351313}) (Version: 2.4.3150 - Martin v. Löwis)
    RangeMax Wireless-N USB Adapter WN111v2 (HKLM\...\InstallShield_{1C0E9C6B-D4D5-4D3C-8A10-F10A3E7BEEA5}) (Version: 2.00.0000 - NETGEAR)
    RealPlayer (HKLM\...\RealPlayer 6.0) (Version: - RealNetworks)
    Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5789 - Realtek Semiconductor Corp.)
    Rhapsody (HKLM\...\Rhapsody) (Version: - )
    Rhapsody Player Engine (HKLM\...\{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}) (Version: 1.0.604 - RealNetworks)
    Roxio Creator Audio (HKLM\...\{83FFCFC7-88C6-41c6-8752-958A45325C82}) (Version: 3.4.0 - Roxio)
    Roxio Creator Basic v9 (HKLM\...\{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}) (Version: 3.4.0 - Roxio)
    Roxio Creator Copy (HKLM\...\{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}) (Version: 3.4.0 - Roxio)
    Roxio Creator Data (HKLM\...\{0D397393-9B50-4c52-84D5-77E344289F87}) (Version: 3.4.0 - Roxio)
    Roxio Creator EasyArchive (HKLM\...\{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}) (Version: 3.4.0 - Roxio)
    Roxio Creator Tools (HKLM\...\{0394CDC8-FABD-4ed8-B104-03393876DFDF}) (Version: 3.4.0 - Roxio)
    Roxio Express Labeler 3 (HKLM\...\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 3.2.1 - Roxio)
    Roxio MyDVD Basic v9 (HKLM\...\{938B1CD7-7C60-491E-AA90-1F1888168240}) (Version: 9.0.559 - Roxio)
    RTC Client API v1.2 (HKLM\...\{44CDBD1B-89FB-4E02-8319-2A4C550F664A}) (Version: 1.2.0000 - Microsoft)
    SafeZone Stable 1.48.2066.120 (Version: 1.48.2066.120 - Avast Software) Hidden
    Scan (Version: 10.1.0.0 - Hewlett-Packard) Hidden
    Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 10.0 - HP)
    SmartWebPrintingOC (Version: 100.0.189.000 - Hewlett-Packard) Hidden
    Snapfish Media Detector (HKLM\...\{4EF6FDB0-3B11-4820-9860-8E08E9965195}) (Version: 1.7.0.15 - HP Snapfish)
    Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1) (Version: 7.74.00 - Conexant Systems)
    SolutionCenter (Version: 100.0.175.000 - Hewlett-Packard) Hidden
    Status (Version: 100.0.175.000 - Hewlett-Packard) Hidden
    Toolbox (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Toolbox (Version: 82.0.173.000 - Hewlett-Packard) Hidden
    TrayApp (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    UnloadSupport (Version: 10.0.0 - Hewlett-Packard) Hidden
    VideoToolkit01 (Version: 100.0.128.000 - Hewlett-Packard) Hidden
    Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
    WebReg (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    WN111v2 (Version: 2.00.0000 - NETGEAR) Hidden
    Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
    Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - Yahoo! Inc.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 -> C:\Windows\system32\mswinsck.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 -> C:\Windows\system32\mswinsck.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{32E26FD9-F435-4A20-A561-35D4B987CFDC}\InprocServer32 -> c:\programdata\webex\924\atucfobj.dll (WebEx Communications Inc.)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE3-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6352-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6353-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6354-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6355-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6356-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6357-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6359-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> C:\Windows\system32\urlmon.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {60BEC739-0380-410D-B334-C30E1582211E} - System32\Tasks\{82BFA003-5420-4828-BFD6-DE291CBA9854} => pcalua.exe -a E:\AOLSETUP.EXE -d E:\
    Task: {7135123C-9783-4EF9-BC16-FE69210353A9} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-04-04] (AVAST Software)
    Task: {87D9FB2E-A7B4-4030-8E8E-6F9AF41DFAE5} - System32\Tasks\SafeZone scheduled Autoupdate 1463521888 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-12] (Avast Software)
    Task: {87EB81E7-622A-47D7-8791-778D87482306} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {9D9D408E-5E19-4E7E-9E7E-E3251ACFE470} - System32\Tasks\{446F2DB2-C365-478F-BB1C-F9855EA21D4F} => pcalua.exe -a "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" -d "C:\Program Files\HP\Digital Imaging\bin" -c -inst "#Hewlett-Packard#HP Photosmart 2600 series#1278605344" -d "HP Photosmart 2600 series"
    Task: {B1E95ABF-FD81-4AA4-A721-E85EFB97EEA6} - System32\Tasks\{DE1E14F6-5C0B-4325-ACD5-6529E07DEA9E} => pcalua.exe -a E:\setup.exe -d E:\
    Task: {BEFAF415-CC21-44C0-A50B-AE6EFBC43069} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-11] (Adobe Systems Incorporated)
    Task: {C2E3D536-DBA7-41F2-A56E-5B208E233C3B} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
    Task: {CD4C578E-AB63-4F8A-9C5E-3DA54FB93F13} - System32\Tasks\{17CB9E1B-FB64-4438-8EAF-820620F944C5} => pcalua.exe -a E:\SETUP.EXE -d E:\
    Task: {D4DCE6C6-38FC-4DBA-BF94-8D9965609BF1} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
    Task: {EE3AFF7D-09AC-4C27-845E-FCE758B530FE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
    Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2017-04-04 13:05 - 2017-04-04 13:05 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
    2017-04-29 10:56 - 2017-04-29 10:56 - 06026480 _____ () C:\Program Files\AVAST Software\Avast\defs\17042900\algo.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00653520 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00230632 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll
    2006-09-03 13:32 - 2006-09-03 13:32 - 00208896 _____ () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    2016-06-07 12:48 - 2010-08-04 14:44 - 00266240 _____ () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    2016-06-07 12:48 - 2010-03-10 14:50 - 00360448 _____ () C:\Program Files\NETGEAR\WNA1100\WifiLib.dll
    2017-04-19 18:20 - 2017-03-22 10:24 - 01736992 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
    2005-06-24 11:13 - 2005-06-24 11:13 - 00407552 _____ () C:\Program Files\Extension Changer\extcontext.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00134920 _____ () c:\Program Files\AVAST Software\Avast\vaarclient.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00230632 _____ () c:\Program Files\AVAST Software\Avast\StreamBack.dll
    2009-10-14 14:36 - 2009-10-14 14:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    2017-04-27 01:26 - 2017-04-26 13:59 - 00870720 _____ () C:\Program Files\Dropbox\Client\dropbox_watchdog.dll
    2017-04-27 01:27 - 2017-03-28 19:54 - 00035792 _____ () C:\Program Files\Dropbox\Client\_multiprocessing.pyd
    2017-04-27 01:27 - 2017-03-28 19:54 - 00100296 _____ () C:\Program Files\Dropbox\Client\_ctypes.pyd
    2017-04-27 01:27 - 2017-03-28 19:54 - 00018888 _____ () C:\Program Files\Dropbox\Client\select.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00019776 _____ () C:\Program Files\Dropbox\Client\tornado.speedups.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00020824 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
    2017-04-27 01:27 - 2017-03-28 19:54 - 00123856 _____ () C:\Program Files\Dropbox\Client\_cffi_backend.pyd
    2017-04-27 01:27 - 2017-03-28 19:54 - 00694224 _____ () C:\Program Files\Dropbox\Client\unicodedata.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 01729360 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00020816 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
    2017-04-27 01:26 - 2017-03-28 19:54 - 00145864 _____ () C:\Program Files\Dropbox\Client\pyexpat.pyd
    2017-04-27 01:26 - 2017-03-28 19:54 - 00019408 _____ () C:\Program Files\Dropbox\Client\faulthandler.pyd
    2017-04-27 01:26 - 2017-03-28 19:54 - 00116688 _____ () C:\Program Files\Dropbox\Client\pywintypes27.dll
    2017-04-27 01:27 - 2017-03-28 19:56 - 00105928 _____ () C:\Program Files\Dropbox\Client\win32api.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00022864 _____ () C:\Program Files\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00060736 _____ () C:\Program Files\Dropbox\Client\psutil._psutil_windows.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00038712 _____ () C:\Program Files\Dropbox\Client\fastpath.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00024528 _____ () C:\Program Files\Dropbox\Client\win32event.pyd
    2017-04-27 01:26 - 2017-03-28 19:54 - 00392656 _____ () C:\Program Files\Dropbox\Client\pythoncom27.dll
    2017-04-27 01:26 - 2017-03-28 19:56 - 00020936 _____ () C:\Program Files\Dropbox\Client\mmapfile.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00116176 _____ () C:\Program Files\Dropbox\Client\win32security.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00392512 _____ () C:\Program Files\Dropbox\Client\win32com.shell.shell.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00124880 _____ () C:\Program Files\Dropbox\Client\win32file.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00026456 _____ () C:\Program Files\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32clipboard.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00175560 _____ () C:\Program Files\Dropbox\Client\win32gui.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00030160 _____ () C:\Program Files\Dropbox\Client\win32pipe.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00043472 _____ () C:\Program Files\Dropbox\Client\win32process.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00048592 _____ () C:\Program Files\Dropbox\Client\win32service.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00057808 _____ () C:\Program Files\Dropbox\Client\win32evtlog.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32profile.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00246608 _____ () C:\Program Files\Dropbox\Client\breakpad.client.windows.handler.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00027488 _____ () C:\Program Files\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
    2017-04-27 01:27 - 2017-03-28 19:55 - 00241104 _____ () C:\Program Files\Dropbox\Client\_jpegtran.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00022336 _____ () C:\Program Files\Dropbox\Client\cpuid.compiled._cpuid.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00025432 _____ () C:\Program Files\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00028616 _____ () C:\Program Files\Dropbox\Client\win32ts.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 01826104 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtCore.pyd
    2017-04-27 01:27 - 2017-03-28 19:54 - 00083912 _____ () C:\Program Files\Dropbox\Client\sip.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 01972024 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtGui.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 03928896 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWidgets.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00171336 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00042816 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebChannel.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00531264 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtNetwork.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00133432 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKit.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00224064 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00207680 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtPrintSupport.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00060880 _____ () C:\Program Files\Dropbox\Client\win32print.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00054608 _____ () C:\Program Files\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00022864 _____ () C:\Program Files\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00022872 _____ () C:\Program Files\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00021848 _____ () C:\Program Files\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00022872 _____ () C:\Program Files\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd
    2017-04-27 01:27 - 2017-03-28 19:56 - 00349128 _____ () C:\Program Files\Dropbox\Client\winxpgui.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00023896 _____ () C:\Program Files\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
    2017-04-27 01:26 - 2017-04-26 14:02 - 00025936 _____ () C:\Program Files\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
    2017-04-27 01:26 - 2017-03-28 19:52 - 00036296 _____ () C:\Program Files\Dropbox\Client\librsync.dll
    2017-04-27 01:26 - 2017-04-26 14:02 - 00084288 _____ () C:\Program Files\Dropbox\Client\dropbox_sqlite_ext.dll
    2017-04-27 01:27 - 2017-04-26 14:02 - 00030536 _____ () C:\Program Files\Dropbox\Client\wind3d11.compiled._wind3d11.pyd
    2017-04-27 01:26 - 2017-03-28 20:00 - 00017864 _____ () C:\Program Files\Dropbox\Client\libEGL.dll
    2017-04-27 01:26 - 2017-03-28 20:00 - 01631184 _____ () C:\Program Files\Dropbox\Client\libGLESv2.dll
    2017-04-27 01:26 - 2017-03-28 20:00 - 14419408 _____ () C:\Program Files\Dropbox\Client\opengl32sw.dll
    2017-04-27 01:26 - 2017-04-26 14:02 - 00357688 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQml.pyd
    2017-04-27 01:27 - 2017-04-26 14:02 - 00026456 _____ () C:\Program Files\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
    2009-06-02 08:58 - 2009-06-02 08:58 - 02140944 _____ () C:\Program Files\Logitech\Logitech Vid\QtCore4.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 07704336 _____ () C:\Program Files\Logitech\Logitech Vid\QtGui4.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 00968976 _____ () C:\Program Files\Logitech\Logitech Vid\QtNetwork4.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 00475408 _____ () C:\Program Files\Logitech\Logitech Vid\QtOpenGL4.dll
    2009-06-02 08:59 - 2009-06-02 08:59 - 00363792 _____ () C:\Program Files\Logitech\Logitech Vid\QtXml4.dll
    2009-06-02 08:59 - 2009-06-02 08:59 - 00199952 _____ () C:\Program Files\Logitech\Logitech Vid\QtSql4.dll
    2009-06-02 08:59 - 2009-06-02 08:59 - 00027408 _____ () C:\Program Files\Logitech\Logitech Vid\SDL.dll
    2009-06-02 08:59 - 2009-06-02 08:59 - 11311888 _____ () C:\Program Files\Logitech\Logitech Vid\QtWebKit4.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 00291600 _____ () C:\Program Files\Logitech\Logitech Vid\phonon4.dll
    2009-06-02 09:00 - 2009-06-02 09:00 - 00028944 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
    2009-06-02 09:00 - 2009-06-02 09:00 - 00035088 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
    2009-06-02 09:00 - 2009-06-02 09:00 - 00138000 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
    2016-06-30 08:45 - 2016-06-30 08:45 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
    2016-06-07 12:48 - 2011-01-04 15:34 - 04545024 _____ () C:\Program Files\NETGEAR\WNA1100\WNA1100.exe
    2016-06-07 12:48 - 2009-08-28 16:50 - 00282624 _____ () C:\Program Files\NETGEAR\WNA1100\WifiSvcLib.dll
    2009-10-14 14:34 - 2009-10-14 14:34 - 00560472 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    2016-02-28 00:49 - 2012-05-25 05:25 - 00921600 _____ () C:\Program Files\Yahoo!\Messenger\yui.dll
    2016-09-06 20:44 - 2016-09-06 12:00 - 05197312 _____ () C:\Users\Tori\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libglesv2.dll
    2016-09-06 20:44 - 2016-09-06 12:00 - 00147456 _____ () C:\Users\Tori\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libegl.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE trusted site: HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\driversupport.com -> hxxp://apps.driversupport.com
    IE trusted site: HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\driversupport.com -> hxxps://apps.driversupport.com

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2006-11-02 06:23 - 2017-02-10 02:50 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

    127.0.0.1 localhost

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Tori\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    DNS Servers: 192.168.1.254
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [{7E08AE05-29F9-4FA2-A855-BC94B1812FEC}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe
    FirewallRules: [{8AD4B445-2665-49C1-868C-57B236CEDCA4}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe
    FirewallRules: [{CEE89B6C-00C8-4144-B5A6-0476047653A5}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    FirewallRules: [{43127B7F-6787-4AC9-98E9-5FB21C41FD6A}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    FirewallRules: [{92363EFE-3ED7-45D5-8406-56DA8AEEF7E2}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    FirewallRules: [{1FBA613B-8DB4-4AC4-B1BF-F0D97D0E2198}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    FirewallRules: [{25C42470-733A-44AA-9C25-08180AF8F86B}] => (Allow) LPort=9442
    FirewallRules: [{E5C1C5C6-E862-46F7-9566-D884DD2BFAC3}] => (Allow) LPort=1900
    FirewallRules: [{E4CE3B3A-59B8-4E11-8F2A-7993F4B86185}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{6485DC41-213D-4A8D-AA8B-551F99D23BE9}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{12619514-D9E8-4900-9E4D-ECDF93F13427}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{944880D9-B475-483D-BC04-009A3F5E2CE7}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{DE12E2DE-87E7-44F8-B3EE-2959C4DB6C77}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{D51E78BF-818E-445C-943E-B27861212FF5}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{92CFE1BD-98CD-48CC-8F4B-3C89317682AA}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{9E4547A2-D64F-40E5-B488-DB594050B014}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{D91AB1FB-C3A3-4C12-B4CB-03FCC5D9B2CC}] => (Allow) LPort=80
    FirewallRules: [{3D4D1636-B373-4D9A-979E-1F56EB31AF31}] => (Allow) LPort=80
    FirewallRules: [{03104623-B954-49BE-9D4C-702CE859704F}] => (Allow) LPort=80
    FirewallRules: [TCP Query User{01EB243C-E9F8-4B10-A42E-67F4C1C2B088}C:\program files\yahoo!\messenger\yahoomessenger.exe] => (Block) C:\program files\yahoo!\messenger\yahoomessenger.exe
    FirewallRules: [UDP Query User{57D3BE13-369B-4FAF-AC8C-776CEDA4C67B}C:\program files\yahoo!\messenger\yahoomessenger.exe] => (Block) C:\program files\yahoo!\messenger\yahoomessenger.exe
    FirewallRules: [TCP Query User{D5EF77F1-E966-48A9-ADE8-56B930510E4A}C:\program files\logitech\logitech vid\vid.exe] => (Block) C:\program files\logitech\logitech vid\vid.exe
    FirewallRules: [UDP Query User{67E147EE-488D-4F1F-BC40-D55FAE320043}C:\program files\logitech\logitech vid\vid.exe] => (Block) C:\program files\logitech\logitech vid\vid.exe
    FirewallRules: [{732C57C5-D5B5-4C3D-8948-E1EA0162E1D0}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{C10344C7-ABFF-4BD4-9EFF-7669EB75C1E9}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{75DE061E-26E1-4887-B05F-9496091CBE79}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{6CB0275C-8CEF-4FBB-B5E9-98BC592FC41F}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{830A844F-BD25-45CD-A2BC-F725B73F2D05}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{281B09ED-0AD5-4D5E-90C5-00FC4998C848}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{7BFAB5B2-3AEE-41C0-9D8A-F834B9437422}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{A0B5A194-3773-4FF7-8269-F68144160961}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{109B5621-110B-4C60-B0B0-A396DE293AD4}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{B91F2D9F-CA09-45A4-B597-2C2E7BAAA4B7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{C97A52B4-08D3-43C6-8DAF-B11FF6EE4475}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{055F6980-8CBE-466C-B366-2993401E8580}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{07721B83-175D-4895-99C0-663F782A0499}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{63D32969-17FC-4164-9623-9921FBCE106E}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{6B8CB9A2-DADF-4F30-9741-71E6709147D6}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{6EE3A0B2-3BE4-49D2-9B75-24F6D74F69B5}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{3C84CCB4-82E3-43EB-97FE-B8ADBD396FD8}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{BA5BB4D8-8411-472E-8A11-967F4475C850}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{ED35A362-A609-4AC8-8F2F-62A05A414EBA}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{7F314E9E-753D-4699-ADB0-7CF44FC7F91F}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{427B9501-4991-4E3D-878A-19B46AB2B95B}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    FirewallRules: [{E046F771-B7FC-4B47-BDB3-206CC6F761D2}] => (Allow) LPort=50308
    FirewallRules: [{5221F830-B378-42AE-842F-C42C7E374B70}] => (Allow) LPort=3479
    FirewallRules: [{853AA996-5145-4CF9-9509-BFFE56E09C35}] => (Allow) C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe
    FirewallRules: [{4A0F71C4-4023-4A71-9CF9-16BDFA55CE5F}] => (Allow) C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe
    FirewallRules: [{2E7AB4BB-99CB-4CD7-9254-5167FAFC7DBF}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
    FirewallRules: [{1ACF1982-B5AF-4265-B4FC-2B18427B1266}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{CFF6D1F2-4B1C-4E61-B665-968498FB0F6B}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{7EC01A6D-F50B-4A51-BB7C-26E58F6682AF}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{E293C848-7B13-47E7-8242-3C6A1C6E191C}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{35907039-A8F4-408E-B76C-B35093EC679D}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{B6626F49-6218-446E-B906-0F96F9FEFB75}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{D4E4C272-0350-4204-ABFB-1F6CAC497A90}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{0661BF77-2F77-4D15-8E76-C0C08A69C358}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{3D0D28AC-0258-4C4E-8531-5F7C90FADBAC}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{6884201E-DA8B-4152-82D8-1F628CF4B0E7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{8881BA11-F95F-4894-B5A5-8D9BC2D457F7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{535423E9-C220-46BD-AFC8-1967A844B235}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{3E1B3056-85A0-441A-BBE1-8FCEDD6E5AF7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{61CFB5E2-86B2-4D1E-8E57-17064959FD75}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{11E41D8A-D121-44B1-AE66-F76FCB674933}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{AEFA4582-DB14-417A-B2EC-1FA8B110C278}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{F5A72B58-3252-4EE0-AA3B-23FB1366CDF7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{6896DD4D-5DDB-4A55-B347-A649C19ECF87}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{AF94A0C9-4660-4CAE-B9BB-45E55EF716E0}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{611D8009-6374-4AA1-BCB6-67136478A6A2}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{A4DCC555-D8AD-45B5-88F7-2D603B858CD6}] => (Allow) C:\Program Files\Logitech\Logitech Vid\Vid.exe
    FirewallRules: [{1E4A59A2-9901-4BBD-AFB4-1EF430F7D2EF}] => (Allow) C:\Program Files\Logitech\Logitech Vid\Vid.exe
    FirewallRules: [{F9E4A84D-D51E-4C6D-BA44-0C3F41E88C06}] => (Allow) C:\Program Files\Dropbox\Client\Dropbox.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\EarthLink TotalAccess\TaskPanl.exe] => Enabled:Earthlink

    ==================== Restore Points =========================

    20-03-2017 20:15:15 Scheduled Checkpoint
    22-03-2017 17:09:07 Scheduled Checkpoint
    23-03-2017 03:00:11 Windows Update
    24-03-2017 00:00:09 Scheduled Checkpoint
    25-03-2017 00:00:31 Scheduled Checkpoint
    26-03-2017 04:12:18 Scheduled Checkpoint
    27-03-2017 00:00:10 Scheduled Checkpoint
    29-03-2017 01:54:35 Scheduled Checkpoint
    29-03-2017 22:06:10 Scheduled Checkpoint
    31-03-2017 01:12:42 Scheduled Checkpoint
    01-04-2017 00:00:11 Scheduled Checkpoint
    02-04-2017 14:56:04 Scheduled Checkpoint
    04-04-2017 00:00:06 Scheduled Checkpoint
    04-04-2017 16:35:43 Scheduled Checkpoint
    06-04-2017 00:00:08 Scheduled Checkpoint
    07-04-2017 00:00:09 Scheduled Checkpoint
    08-04-2017 00:00:09 Scheduled Checkpoint
    09-04-2017 00:00:11 Scheduled Checkpoint
    09-04-2017 21:12:10 Scheduled Checkpoint
    11-04-2017 00:00:11 Scheduled Checkpoint
    12-04-2017 00:00:11 Scheduled Checkpoint
    17-04-2017 02:21:30 Scheduled Checkpoint
    17-04-2017 19:00:10 JRT Pre-Junkware Removal

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (04/13/2017 11:21:52 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application svchost.exe_RpcSs, version 6.0.6001.18000, time stamp 0x47918b89, faulting module ntdll.dll, version 6.0.6002.19623, time stamp 0x56ec3707, exception code 0xc0000005, fault offset 0x0003dd0d,
    process id 0x408, application start time 0x01d2b467a0613359.

    Error: (04/09/2017 08:35:36 PM) (Source: EventSystem) (EventID: 4609) (User: )
    Description: The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043c from line 45 of d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

    Error: (03/19/2017 03:21:32 AM) (Source: Perflib) (EventID: 1008) (User: )
    Description: The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    Error: (03/19/2017 03:21:31 AM) (Source: Perflib) (EventID: 1010) (User: )
    Description: The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

    Error: (03/11/2017 04:18:43 AM) (Source: Perflib) (EventID: 1008) (User: )
    Description: The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    Error: (03/11/2017 04:18:42 AM) (Source: Perflib) (EventID: 1010) (User: )
    Description: The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

    Error: (03/10/2017 02:07:11 PM) (Source: DbxSvc) (EventID: 270) (User: )
    Description: (-2145452013) The system could not find the filter specified.

    Error: (03/10/2017 02:01:38 PM) (Source: DbxSvc) (EventID: 320) (User: )
    Description: (-2147024894) The system cannot find the file specified.

    Error: (02/27/2017 06:02:10 PM) (Source: DbxSvc) (EventID: 270) (User: )
    Description: (-2145452013) The system could not find the filter specified.

    Error: (02/23/2017 04:18:18 AM) (Source: Perflib) (EventID: 1008) (User: )
    Description: The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.


    System errors:
    =============
    Error: (04/29/2017 02:44:04 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    i8042prt

    Error: (04/29/2017 02:44:04 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The HP CUE DeviceDiscovery Service service hung on starting.

    Error: (04/29/2017 02:42:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Parallel port driver service failed to start due to the following error:
    The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

    Error: (04/29/2017 02:39:50 PM) (Source: DCOM) (EventID: 10010) (User: )
    Description: The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

    Error: (04/29/2017 03:03:07 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

    Error: (04/29/2017 02:53:52 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    i8042prt

    Error: (04/29/2017 02:53:52 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The HP CUE DeviceDiscovery Service service hung on starting.

    Error: (04/29/2017 02:53:27 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Parallel port driver service failed to start due to the following error:
    The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

    Error: (04/29/2017 02:51:45 AM) (Source: EventLog) (EventID: 6008) (User: )
    Description: The previous system shutdown at 2:49:53 AM on 4/29/2017 was unexpected.

    Error: (04/27/2017 12:31:58 PM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.


    CodeIntegrity:
    ===================================
    Date: 2017-04-29 16:26:07.505
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:26:06.615
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:26:05.442
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:26:04.427
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:26:03.325
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\MBAMChameleon.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:26:01.980
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\MBAMChameleon.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:26:00.928
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\MBAMChameleon.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:26:00.012
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\MBAMChameleon.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:25:21.712
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2017-04-29 16:25:20.810
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
    Percentage of memory in use: 77%
    Total physical RAM: 2037.77 MB
    Available physical RAM: 450.3 MB
    Total Virtual: 4316.76 MB
    Available Virtual: 1920.38 MB

    ==================== Drives ================================

    Drive c: (HP) (Fixed) (Total:289.26 GB) (Free:186.53 GB) NTFS ==>[drive with boot components (obtained from BCD)]
    Drive d: (Recovery) (Fixed) (Total:8.83 GB) (Free:1 GB) NTFS ==>[system with boot components (obtained from drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 298.1 GB) (Disk ID: 1549F232)
    Partition 1: (Active) - (Size=289.3 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=8.8 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
    dodopie,
    #2


  3. to hide this advert.

  4. 2017/04/29
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===============================

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2
    • Close all the running programs
    • Double click on downloaded setup.exe file to install the program.
    • Click on Start Scan button.
    • Click on another Start Scan button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    [​IMG] Please download Malwarebytes to your desktop.
    • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
    • Then click Finish.
    • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
    • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
    • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
    • Restart your computer when prompted to do so.
    • The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.
    [​IMG] Please download AdwCleaner by Xplode and save to your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
      Vista/Windows 7/8 users right-click and select Run As Administrator
    • The tool will start to update the database if one is required.
    • Click on the Scan button.
    • AdwCleaner will begin...be patient as the scan may take some time to complete.
    • After the scan has finished, click on the Logfile button.
    • A window will open which lists the logs of your scans.
    • Click on the Scan tab.
    • Double-click the most recent scan which will be at the top of the list....the log will appear.
    • Review the results...see note below
    • After reviewing the log, click on the Clean button.
    • Press OK when asked to close all programs and follow the onscreen prompts.
    • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
    • After rebooting, a logfile report (AdwCleaner[CX].txt) will open automatically (where the largest value of X represents the most recent report).
    • To open a Cleaning log, launch AdwareClearer, click on the Logfile button, click on the Cleaning tab and double-click the log at the top of the list.
    • Copy and paste the contents of AdwCleaner[CX].txt in your next reply.
    • A copy of all logfiles are saved to C:\AdwCleaner.
    -- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name or entry that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on and uncheck any items you want to keep.


    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
    broni,
    #3
  5. 2017/04/30
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    The first time I ran rogue killer it ran but said it crashed. So I ran it again and it was running then went to a blue screen saying windows was shut down to prevent further damage to system so I restarted in safe mode and ran it and it finished, this is the report. Also I noticed that the driver button was turned off while this scan ran.
    RogueKiller V12.10.6.0 [Apr 24 2017] (Free) by Adlice Software
    mail : Contact - Adlice Software
    Feedback : Adlice forum - Home
    Website : RogueKiller Anti-Malware Free Download - Official Website
    Blog : Downloads - Adlice Software

    Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
    Started in : Safe mode with network support
    User : Tori [Administrator]
    Started from : C:\Program Files\RogueKiller\RogueKiller.exe
    Mode : Delete -- Date : 04/30/2017 14:20:55 (Duration : 00:34:25)

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 3 ¤¤¤
    [PUP.BrowsingProtection] HKEY_USERS\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Ad-Aware Browsing Protection -> Deleted
    [PUP.Gen0] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {853AA996-5145-4CF9-9509-BFFE56E09C35} : v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe|Name=Sunshine PC|Edge=FALSE| [x] -> Deleted
    [PUP.Gen0] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {4A0F71C4-4023-4A71-9CF9-16BDFA55CE5F} : v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files\Sunshine\Sunshine PC\SunshinePC.exe|Name=Sunshine PC|Edge=FALSE| [x] -> Deleted

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000035f]) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: SAMSUNG HD320KJ +++++
    --- User ---
    [MBR] 0f59b3acc8c4a3dbadffb3a6717afd9f
    [BSP] 2552b2d2227b2ea2b3c92a526a1a6f5d : HP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 296198 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 606614400 | Size: 9044 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: Generic- Compact Flash USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )

    +++++ PhysicalDrive2: Generic- SM/xD-Picture USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )

    +++++ PhysicalDrive3: Generic- SD/MMC USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )

    +++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )
     
    dodopie,
    #4
  6. 2017/04/30
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    ran malware and it found nothing but when it started running slow the other day I ran it and it found over 100 items. here is the report from today
    Malwarebytes
    www.malwarebytes.com

    -Log Details-
    Scan Date: 4/30/17
    Scan Time: 3:19 PM
    Logfile: mb.txt
    Administrator: Yes

    -Software Information-
    Version: 3.0.6.1469
    Components Version: 1.0.103
    Update Package Version: 1.0.1840
    License: Free

    -System Information-
    OS: Windows Vista Service Pack 2
    CPU: x86
    File System: NTFS
    User: Tori-PC\Tori

    -Scan Summary-
    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 300543
    Time Elapsed: 17 min, 35 sec

    -Scan Options-
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    -Scan Details-
    Process: 0
    (No malicious items detected)

    Module: 0
    (No malicious items detected)

    Registry Key: 0
    (No malicious items detected)

    Registry Value: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Data Stream: 0
    (No malicious items detected)

    Folder: 0
    (No malicious items detected)

    File: 0
    (No malicious items detected)

    Physical Sector: 0
    (No malicious items detected)


    (end)
     
    dodopie,
    #5
  7. 2017/04/30
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    after running this scan this computer seems to be running faster.
    # AdwCleaner v6.045 - Logfile created 30/04/2017 at 16:13:22
    # Updated on 28/03/2017 by Malwarebytes
    # Database : 2017-03-28.2 [Local]
    # Operating System : Windows Vista (TM) Home Premium Service Pack 2 (X86)
    # Username : Tori - TORI-PC
    # Running from : C:\Users\Tori\Desktop\AdwCleaner (1).exe
    # Mode: Clean
    # Support : Customer Support & Help Center



    ***** [ Services ] *****



    ***** [ Folders ] *****



    ***** [ Files ] *****



    ***** [ DLL ] *****



    ***** [ WMI ] *****



    ***** [ Shortcuts ] *****



    ***** [ Scheduled Tasks ] *****



    ***** [ Registry ] *****



    ***** [ Web browsers ] *****

    [-] [C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
    [-] [C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com


    *************************

    :: "Tracing" keys deleted
    :: Winsock settings cleared

    *************************

    C:\AdwCleaner\AdwCleaner[C0].txt - [996 Bytes] - [30/04/2017 16:13:22]
    C:\AdwCleaner\AdwCleaner[S0].txt - [1320 Bytes] - [30/04/2017 16:07:38]

    ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1141 Bytes] ##########
     
    dodopie,
    #6
  8. 2017/05/01
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    ran junkware and it froze up so re ran it and got the blue screen warning so I ran it in safe mode.
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.1.3 (04.10.2017)
    Operating System: Windows Vista (TM) Home Premium x86
    Ran by Tori (Limited) on Sun 04/30/2017 at 20:01:16.59
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 0




    Registry: 0





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Sun 04/30/2017 at 20:03:08.45
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
    dodopie,
    #7
  9. 2017/05/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: Metadefender Endpoint Management
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: Downloading RKill
    iExplore.exe (renamed rKill.exe): Downloading RKill

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
    broni,
    #8
  10. 2017/05/02
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    i ran combofix and when this computer restarted it had a box i think from combofix then it went to bluescreen so i restarted and got this
    Problem signature:
    Problem Event Name: BlueScreen
    OS Version: 6.0.6002.2.2.0.768.3
    Locale ID: 1033

    Additional information about the problem:
    BCCode: 77
    BCP1: 00000001
    BCP2: 00000000
    BCP3: 00000000
    BCP4: 8B777C70
    OS Version: 6_0_6002
    Service Pack: 2_0
    Product: 768_1

    Files that help describe the problem:
    C:\WINDOWS\Minidump\Mini050217-01.dmp
    C:\Users\Tori\AppData\Local\temp\WER-156063-0.sysdata.xml
    C:\Users\Tori\AppData\Local\temp\WER2C8B.tmp.version.txt

    Read our privacy statement:
    Privacy Statement for the Microsoft Error Reporting Service
     
    dodopie,
    #9
  11. 2017/05/02
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    ok finally got combofix to run and this is the report. Computer is still taking a long time to load pages, I keep getting the message box that says page has become unresponsive and to choose to kill or wait. I just wait and it finally loads.
    ComboFix 17-04-16.01 - Tori 05/02/2017 12:23:43.3.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.896 [GMT -4:00]
    Running from: c:\users\Tori\Downloads\ComboFix.exe
    AV: Avast Antivirus *Disabled/Updated* {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
    SP: Avast Antivirus *Disabled/Updated* {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    c:\windows\TEMP\logishrd\LVPrcInj01.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2017-04-02 to 2017-05-02 )))))))))))))))))))))))))))))))
    .
    .
    2017-05-02 16:35 . 2017-05-02 16:35 -------- d-----w- c:\users\Tori\AppData\Local\temp
    2017-05-02 16:35 . 2017-05-02 16:35 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
    2017-05-02 16:35 . 2017-05-02 16:35 -------- d-----w- c:\users\Public\AppData\Local\temp
    2017-05-02 16:35 . 2017-05-02 16:35 -------- d-----w- c:\users\IUSR_NMPR\AppData\Local\temp
    2017-05-02 16:35 . 2017-05-02 16:35 -------- d-----w- c:\users\Default\AppData\Local\temp
    2017-05-02 16:12 . 2017-05-02 16:12 -------- d-----w- c:\programdata\SWCUTemp
    2017-05-02 03:21 . 2017-05-02 03:21 -------- d-----w- C:\$AV_ASW
    2017-05-02 02:00 . 2017-05-02 02:00 -------- d-----w- c:\users\Tori\AppData\Local\CrashDumps
    2017-04-29 21:51 . 2017-04-30 17:17 -------- d-----w- c:\program files\RogueKiller
    2017-04-29 20:24 . 2017-04-29 20:29 -------- d-----w- C:\FRST
    2017-04-29 18:39 . 2017-04-29 14:56 73656 ----a-w- c:\windows\system32\drivers\aswHdsKe.sys
    2017-04-26 18:02 . 2017-04-26 18:02 42288 ----a-w- c:\windows\system32\DbxSvc.exe
    2017-04-19 22:21 . 2017-04-19 22:21 161216 ----a-w- c:\windows\system32\drivers\MBAMChameleon.sys
    2017-04-19 22:20 . 2017-04-19 22:22 64288 ----a-w- c:\windows\system32\drivers\mwac.sys
    2017-04-19 22:20 . 2017-04-19 22:20 39360 ----a-w- c:\windows\system32\drivers\mbam.sys
    2017-04-19 22:20 . 2017-05-02 15:16 220088 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2017-04-19 22:20 . 2017-03-22 15:02 59904 ----a-w- c:\windows\system32\drivers\mbae.sys
    2017-04-19 22:20 . 2017-04-19 22:20 -------- d-----w- c:\programdata\Malwarebytes
    2017-04-04 17:06 . 2017-04-04 17:05 330256 ----a-w- c:\windows\system32\aswBoot.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2017-04-30 18:20 . 2017-02-09 02:26 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2017-04-28 17:07 . 2015-11-20 20:57 472760 ----a-w- c:\windows\system32\drivers\aswsp.sys
    2017-04-28 17:07 . 2015-11-20 20:57 107928 ----a-w- c:\windows\system32\drivers\aswmonflt.sys
    2017-04-11 17:49 . 2013-06-29 17:04 802904 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2017-04-11 17:49 . 2013-06-29 17:04 144472 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2017-04-04 17:06 . 2015-11-20 20:57 184208 ----a-w- c:\windows\system32\drivers\aswStmXP.sys
    2017-04-04 17:06 . 2015-11-20 20:57 62152 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
    2017-04-04 17:06 . 2015-11-20 20:57 60760 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2017-04-04 17:06 . 2015-11-20 20:57 34136 ----a-w- c:\windows\system32\drivers\aswHwid.sys
    2017-04-04 17:06 . 2015-11-20 20:57 279800 ----a-w- c:\windows\system32\drivers\aswVmm.sys
    2017-04-04 17:05 . 2016-05-13 21:47 31064 ----a-w- c:\windows\system32\drivers\aswKbd.sys
    2017-04-04 17:05 . 2015-11-20 20:57 764064 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2017-04-04 17:05 . 2017-02-10 12:37 41176 ----a-w- c:\windows\system32\drivers\aswbunivx.sys
    2017-04-04 17:05 . 2017-02-10 12:37 267528 ----a-w- c:\windows\system32\drivers\aswblogx.sys
    2017-04-04 17:05 . 2017-02-10 12:37 255184 ----a-w- c:\windows\system32\drivers\aswbidsdriverx.sys
    2017-04-04 17:05 . 2017-02-10 12:37 148208 ----a-w- c:\windows\system32\drivers\aswbidshx.sys
    2017-03-22 17:47 . 2017-03-22 17:47 35432 ----a-w- c:\windows\system32\drivers\dbx-stable.sys
    2017-03-22 17:47 . 2017-03-22 17:47 35432 ----a-w- c:\windows\system32\drivers\dbx-dev.sys
    2017-03-22 17:47 . 2017-03-22 17:47 35432 ----a-w- c:\windows\system32\drivers\dbx-canary.sys
    2017-02-12 16:07 . 2017-02-12 16:07 44424 ----a-w- c:\windows\system32\sbbd.exe
    2017-02-12 16:07 . 2013-06-29 16:39 13560 ----a-w- c:\windows\system32\drivers\gfibto.sys
    2017-02-12 06:23 . 2015-11-20 20:40 95808 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
    2017-02-11 16:54 . 2017-03-19 07:23 504320 ----a-w- c:\windows\system32\usp10.dll
    2017-02-11 16:53 . 2017-03-19 07:23 299520 ----a-w- c:\windows\system32\gdi32.dll
    2017-02-11 16:16 . 2017-03-19 07:23 160768 ----a-w- c:\windows\system32\d3d10_1.dll
    2017-02-11 16:16 . 2017-03-19 07:23 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
    2017-02-11 16:16 . 2017-03-19 07:23 189952 ----a-w- c:\windows\system32\d3d10core.dll
    2017-02-11 16:16 . 2017-03-19 07:23 1029120 ----a-w- c:\windows\system32\d3d10.dll
    2017-02-11 15:35 . 2017-03-19 07:23 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
    2017-02-11 15:34 . 2017-03-19 07:23 486912 ----a-w- c:\windows\system32\d3d10level9.dll
    2017-02-11 15:25 . 2017-03-19 07:23 682496 ----a-w- c:\windows\system32\d2d1.dll
    2017-02-11 15:23 . 2017-03-23 07:00 2048 ----a-w- c:\windows\system32\tzres.dll
    2017-02-11 15:23 . 2017-03-19 07:23 802304 ----a-w- c:\windows\system32\FntCache.dll
    2017-02-11 15:23 . 2017-03-19 07:23 1073152 ----a-w- c:\windows\system32\DWrite.dll
    2017-02-11 15:22 . 2017-03-19 07:24 304640 ----a-w- c:\windows\system32\drivers\srv.sys
    2017-02-09 17:11 . 2017-03-19 07:25 3610856 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2017-02-09 17:11 . 2017-03-19 07:25 3558120 ----a-w- c:\windows\system32\ntoskrnl.exe
    2017-02-09 17:04 . 2017-03-19 07:23 215040 ----a-w- c:\windows\system32\icm32.dll
    2017-02-09 15:33 . 2017-03-19 07:22 2074112 ----a-w- c:\windows\system32\win32k.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt01]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt02]
    @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt03]
    @="{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt04]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt05]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt06]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt07]
    @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt08]
    @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt09]
    @="{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt10]
    @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
    2017-04-26 17:56 230728 ----a-w- c:\program files\Dropbox\Client\DropboxExt.16.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00asw]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2017-04-04 17:05 1208704 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Logitech Vid"="c:\program files\Logitech\Logitech Vid\Vid.exe" [2009-07-16 5458704]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2012-05-25 6595928]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CCUTRAYICON"="FactoryMode" [X]
    "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
    "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-11-15 151552]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
    "LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 4390912]
    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-25 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-25 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-25 133656]
    "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvLaunch.exe" [2017-04-04 213824]
    "Dropbox"="c:\program files\Dropbox\Client\Dropbox.exe" [2017-04-26 28344536]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2016-12-13 587288]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-03 1021128]
    "Malwarebytes TrayApp"="c:\program files\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe" [2017-01-20 2780112]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-07 44168]
    .
    c:\users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111v2.exe [2009-3-25 1724416]
    NETGEAR WNA1100 Smart Wizard.lnk - c:\program files\NETGEAR\WNA1100\WNA1100.exe [2016-6-7 4545024]
    Snapfish Media Detector.lnk - c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe [2007-3-2 1441792]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "SoftwareSASGeneration"= 1 (0x1)
    "EnableSecureUIAPath"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "MemCheckBoxInRunDlg"= 1 (0x1)
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveTrack"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1137620820-469648318-63125674-1001]
    "EnableNotifications"=dword:00000001
    "EnableNotificationsRef"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2016-04-07 17:08 1106072 ----a-w- c:\program files\Google\Chrome\Application\49.0.2623.112\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2017-05-02 c:\windows\Tasks\DropboxUpdateTaskMachineCore.job
    - c:\program files\Dropbox\Update\DropboxUpdate.exe [2015-12-01 20:52]
    .
    2017-05-02 c:\windows\Tasks\DropboxUpdateTaskMachineUA.job
    - c:\program files\Dropbox\Update\DropboxUpdate.exe [2015-12-01 20:52]
    .
    .
    ------- Supplementary Scan -------
    .
    mStart Page = hxxp://www.yahoo.com/?ilc=8
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    Trusted Zone: driversupport.com\apps
    TCP: DhcpNameServer = 192.168.1.254
    .
    - - - - ORPHANS REMOVED - - - -
    .
    SafeBoot-WudfPf
    SafeBoot-WudfRd
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2017-05-02 12:35
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2017-05-02 12:38:29
    ComboFix-quarantined-files.txt 2017-05-02 16:38
    .
    Pre-Run: 200,958,169,088 bytes free
    Post-Run: 200,930,242,560 bytes free
    .
    - - End Of File - - 1218355C56DB32072BC08174337083B6
    8913823FF508CCF109DB74B636C301DA
     
    dodopie,
    #10
  12. 2017/05/02
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Which browser is affected?
    Did you check some other browser to see if it has same issue?

    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

    • Double click to run it.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
    broni,
    #11
  13. 2017/05/03
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    ok it made these logs before it finished and is stuck showing "Scanning Application error"
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 30-04-2017
    Ran by Tori (administrator) on TORI-PC (03-05-2017 08:01:26)
    Running from C:\Users\Tori\Desktop
    Loaded Profiles: Tori (Available Profiles: IUSR_NMPR & Tori)
    Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehrecvr.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehsched.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    (Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe
    (Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    (Realtek Semiconductor) C:\WINDOWS\RtHDVCpl.exe
    (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
    (Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxsrvc.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (Logitech Inc.) C:\Program Files\Logitech\Logitech Vid\Vid.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    (NETGEAR) C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
    (Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    () C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
    (Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    (Yahoo! Inc.) C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
    (Hewlett-Packard Company) C:\hp\KBD\kbd.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    (AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
    (Dropbox, Inc.) C:\WINDOWS\System32\DbxSvc.exe
    (Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
    (Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [hpsysdrv] => c:\hp\support\hpsysdrv.exe [65536 2006-09-28] (Hewlett-Packard Company)
    HKLM\...\Run: [KBD] => C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
    HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-11-15] (Intel Corporation)
    HKLM\...\Run: [CCUTRAYICON] => FactoryMode
    HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-10-14] (Hewlett-Packard)
    HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
    HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4390912 2007-03-01] (Realtek Semiconductor)
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1311312 2010-06-25] (Logitech, Inc.)
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-04] (AVAST Software)
    HKLM\...\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [28432392 2017-05-01] (Dropbox, Inc.)
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
    HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
    HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
    HKLM\...\RunOnce: [Launcher] => C:\Windows\SMINST\launcher.exe [44168 2007-03-07] (soft thinks)
    HKLM\...\Policies\Explorer: [MemCheckBoxInRunDlg] 1
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Logitech Vid] => C:\Program Files\Logitech\Logitech Vid\Vid.exe [5458704 2009-07-16] (Logitech Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [221184 2008-01-19] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2017-04-04] (AVAST Software)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2012-03-17]
    ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WN111v2 Smart Wizard.lnk [2013-08-18]
    ShortcutTarget: NETGEAR WN111v2 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WN111v2\WN111v2.exe (NETGEAR)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Smart Wizard.lnk [2016-06-07]
    ShortcutTarget: NETGEAR WNA1100 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WNA1100\WNA1100.exe ()
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk [2007-04-21]
    ShortcutTarget: Snapfish Media Detector.lnk -> C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe ()
    Startup: C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2009-10-31]
    ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{2E0AA886-5EBF-401D-B070-6204C97B6624}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{435B15BB-F8C5-4712-9E94-F75174A18D50}: [DhcpNameServer] 208.59.247.45 208.59.247.46
    Tcpip\..\Interfaces\{5D2835A6-C339-499D-A5C8-A58D50CBC840}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{7F33EFC5-70C0-4B52-B39A-8F7FCDA6A7AD}: [DhcpNameServer] 75.114.81.1 75.114.81.2
    Tcpip\..\Interfaces\{FE880611-5A3F-4E43-8528-9B371CDA42BE}: [DhcpNameServer] 65.32.5.111 65.32.5.112

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=8
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
    SearchScopes: HKLM -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&amp;entrypoint={referrer:source?}&amp;FORM=HVDUS7
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> DefaultScope {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=chr-tyc-inbox
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://www.bing.com/search?FORM=UP94DF&PC=UP94&dt=072313&q={searchTerms}&src=IE-SearchBox
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-02-12] (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-04-04] (AVAST Software)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-12] (Oracle Corporation)
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

    FireFox:
    ========
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: (Microsoft .NET Framework Assistant) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-10-22] [not signed]
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2017-03-10]
    FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
    FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2017-03-10]
    FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-12] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-12] (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @real.com/nppl3260;version=6.0.11.2571 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprjplug;version=1.0.2.2629 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 -> C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll [2006-03-31] (RealNetworks, Inc.)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
    FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

    Chrome:
    =======
    CHR Profile: C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default [2017-05-03]
    CHR Extension: (Ebates Cash Back) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\chhjbpecpncaggjpdakmflnfcopglcmi [2017-04-07]
    CHR Extension: (Avast Online Security) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-04-06]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
    CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation) [File not signed]
    R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5758120 2017-04-04] (AVAST Software s.r.o.)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-04] (AVAST Software)
    S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42288 2017-05-01] (Dropbox, Inc.)
    R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] () [File not signed]
    R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [139264 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 IAANTMON; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [81920 2006-11-15] (Intel Corporation) [File not signed]
    S3 IDriverT; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
    S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation) [File not signed]
    S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 jswpsapi; C:\Program Files\NETGEAR\WNA1100\jswpsapi.exe [960992 2010-03-22] (Atheros Communications, Inc.)
    R2 LightScribeService; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
    S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-09-01] () [File not signed]
    S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [3303888 2017-01-20] (Malwarebytes)
    S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation) [File not signed]
    R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
    R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
    S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
    R2 WSWNA1100; C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe [266240 2010-08-04] () [File not signed]

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [255184 2017-04-04] (AVAST Software s.r.o.)
    R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [148208 2017-04-04] (AVAST Software s.r.o.)
    R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [267528 2017-04-04] (AVAST Software s.r.o.)
    R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [41176 2017-04-04] (AVAST Software s.r.o.)
    S3 aswHdsKe; C:\Windows\system32\drivers\aswHdsKe.sys [73656 2017-04-29] (AVAST Software)
    S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34136 2017-04-04] (AVAST Software)
    R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [31064 2017-04-04] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107928 2017-04-28] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [60760 2017-04-04] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [62152 2017-04-04] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [764064 2017-04-04] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [472760 2017-04-28] (AVAST Software)
    R3 aswStmXP; C:\Windows\system32\drivers\aswStmXP.sys [184208 2017-04-04] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [279800 2017-04-04] (AVAST Software)
    R3 athur; C:\Windows\System32\DRIVERS\athur.sys [1439744 2010-10-10] (Atheros Communications, Inc.)
    S3 DNIMp50; C:\Windows\System32\Drivers\DNIMp50.sys [21504 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    S3 DNISp50; C:\Windows\System32\Drivers\DNISp50.sys [20480 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2017-02-12] (GFI Software)
    S3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE2500vista.sys [1073216 2011-03-30] (Broadcom Corporation)
    R3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25752 2009-10-07] ()
    S3 LVUSBSta; C:\Windows\System32\drivers\lvusbsta.sys [41248 2006-12-15] (Logitech Inc.)
    S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [64288 2017-04-19] (Malwarebytes)
    R1 SBRE; C:\Windows\system32\drivers\SBREDrv.sys [101720 2011-11-01] (Sunbelt Software)
    R0 SCMNdisP; C:\Windows\System32\DRIVERS\scmndisp.sys [21728 2007-01-19] (Windows (R) Codename Longhorn DDK provider)
    U3 TrueSight; C:\WINDOWS\System32\drivers\TrueSight.sys [24688 2017-04-30] ()
    S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)
    S3 WN111v2; C:\Windows\System32\DRIVERS\WN111v2v.sys [453120 2009-01-13] (Atheros Communications, Inc.)
    U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
    R3 catchme; \??\C:\Users\Tori\AppData\Local\Temp\catchme.sys [X] <==== ATTENTION
    S3 dbx; system32\DRIVERS\dbx.sys [X]
    U3 mbr; \??\C:\Users\Tori\AppData\Local\Temp\mbr.sys [X] <==== ATTENTION

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-05-03 08:01 - 2017-05-03 08:01 - 00022264 _____ C:\Users\Tori\Desktop\FRST.txt
    2017-05-03 07:58 - 2017-05-03 08:00 - 01768960 _____ (Farbar) C:\Users\Tori\Desktop\FRST.exe
    2017-05-02 14:02 - 2017-05-02 14:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
    2017-05-02 12:38 - 2017-05-02 12:38 - 00015790 _____ C:\ComboFix.txt
    2017-05-02 12:19 - 2017-05-02 12:38 - 00000000 ____D C:\ComboFix
    2017-05-02 12:12 - 2017-05-02 12:12 - 00000000 ____D C:\ProgramData\SWCUTemp
    2017-05-02 10:08 - 2017-05-02 10:08 - 00000838 _____ C:\Users\Tori\Desktop\ComboFix - Shortcut.lnk
    2017-05-02 10:07 - 2017-05-02 10:07 - 05659609 ____R (Swearware) C:\Users\Tori\Downloads\ComboFix.exe
    2017-05-02 09:13 - 2017-05-02 09:13 - 00145064 _____ C:\Windows\Minidump\Mini050217-01.dmp
    2017-05-01 23:21 - 2017-05-01 23:21 - 00000000 ____D C:\$AV_ASW
    2017-05-01 22:53 - 2011-06-26 02:45 - 00256000 _____ C:\Windows\PEV.exe
    2017-05-01 22:53 - 2010-11-07 13:20 - 00208896 _____ C:\Windows\MBR.exe
    2017-05-01 22:53 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00098816 _____ C:\Windows\sed.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00080412 _____ C:\Windows\grep.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00068096 _____ C:\Windows\zip.exe
    2017-05-01 22:08 - 2017-05-02 10:59 - 00000680 _____ C:\Users\Tori\AppData\Local\d3d9caps.dat
    2017-05-01 22:00 - 2017-05-02 12:38 - 00000000 ____D C:\Qoobox
    2017-05-01 22:00 - 2017-05-01 22:00 - 00000000 ____D C:\Users\Tori\AppData\Local\CrashDumps
    2017-05-01 20:43 - 2017-05-01 20:43 - 00320898 _____ C:\Users\Tori\Downloads\archive (2).zip
    2017-05-01 17:42 - 2017-05-01 17:42 - 00320898 _____ C:\Users\Tori\Downloads\archive (1).zip
    2017-05-01 17:41 - 2017-05-01 17:42 - 00320898 _____ C:\Users\Tori\Downloads\archive.zip
    2017-05-01 12:19 - 2017-05-01 12:19 - 00219044 _____ C:\Users\Tori\Desktop\tori (3).pdf
    2017-05-01 10:49 - 2017-05-01 10:49 - 00042288 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
    2017-04-30 20:03 - 2017-04-30 20:03 - 00000564 _____ C:\Users\Tori\Desktop\JRT.txt
    2017-04-30 19:55 - 2017-04-30 19:56 - 00145064 _____ C:\Windows\Minidump\Mini043017-02.dmp
    2017-04-30 16:21 - 2017-04-30 16:22 - 01663672 _____ (Malwarebytes) C:\Users\Tori\Desktop\JRT (1).exe
    2017-04-30 16:02 - 2017-04-30 16:04 - 04089296 _____ C:\Users\Tori\Desktop\AdwCleaner (1).exe
    2017-04-30 15:44 - 2017-04-30 15:44 - 00001095 _____ C:\Users\Tori\Desktop\mb.txt
    2017-04-30 14:12 - 2017-04-30 14:12 - 00145064 _____ C:\Windows\Minidump\Mini043017-01.dmp
    2017-04-30 13:17 - 2017-04-30 13:17 - 00000802 _____ C:\Users\Public\Desktop\RogueKiller.lnk
    2017-04-29 17:51 - 2017-04-30 13:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
    2017-04-29 17:51 - 2017-04-30 13:17 - 00000000 ____D C:\Program Files\RogueKiller
    2017-04-29 17:11 - 2017-04-29 17:27 - 35357840 _____ (Adlice Software ) C:\Users\Tori\Desktop\setup.exe
    2017-04-29 16:24 - 2017-05-02 22:44 - 00000000 ____D C:\FRST
    2017-04-29 14:39 - 2017-04-29 10:56 - 00073656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys
    2017-04-19 18:21 - 2017-04-19 18:21 - 00161216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
    2017-04-19 18:20 - 2017-05-02 11:16 - 00220088 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2017-04-19 18:20 - 2017-04-19 18:22 - 00064288 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
    2017-04-19 18:20 - 2017-04-19 18:20 - 00039360 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2017-04-19 18:20 - 2017-04-19 18:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2017-04-19 18:20 - 2017-04-19 18:20 - 00000000 ____D C:\ProgramData\Malwarebytes
    2017-04-19 18:20 - 2017-03-22 11:02 - 00059904 _____ C:\Windows\system32\Drivers\mbae.sys
    2017-04-19 18:11 - 2017-04-19 18:17 - 60107896 _____ (Malwarebytes ) C:\Users\Tori\Downloads\mb3-setup-consumer-3.0.6.1469-10103.exe
    2017-04-19 15:18 - 2017-04-19 15:18 - 00118190 _____ C:\Users\Tori\Documents\USPS - Welcome to PO Boxes Online.pdf
    2017-04-17 20:12 - 2017-04-17 19:06 - 00003294 _____ C:\Users\Tori\Documents\JRT.txt
    2017-04-12 17:57 - 2017-04-12 17:57 - 00009728 _____ C:\Users\Tori\Documents\april Jerry.wps
    2017-04-12 12:18 - 2017-04-12 12:18 - 00153940 _____ C:\Users\Tori\Downloads\2016TaxReturn.PDF
    2017-04-09 20:33 - 2017-04-09 20:33 - 00145064 _____ C:\Windows\Minidump\Mini040917-01.dmp
    2017-04-04 13:06 - 2017-04-04 13:05 - 00330256 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
    2017-04-03 09:48 - 2017-04-03 09:48 - 00001901 _____ C:\Users\Tori\Desktop\Google Chrome.lnk
    2017-04-03 09:47 - 2017-04-03 09:47 - 00000459 _____ C:\Users\Tori\Desktop\**** - Shortcut.lnk

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-05-03 07:21 - 2015-12-01 12:47 - 00000892 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
    2017-05-03 07:15 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    2017-05-03 07:15 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    2017-05-02 18:21 - 2015-12-01 12:47 - 00000888 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
    2017-05-02 14:41 - 2017-03-25 15:45 - 00000000 ___RD C:\Users\Tori\Documents\****
    2017-05-02 14:02 - 2015-12-01 12:51 - 00000000 ___RD C:\Users\Tori\Dropbox
    2017-05-02 14:02 - 2015-12-01 12:47 - 00000000 ____D C:\Program Files\Dropbox
    2017-05-02 12:35 - 2006-11-02 06:23 - 00000215 _____ C:\Windows\system.ini
    2017-05-02 12:11 - 2007-04-21 07:29 - 00000000 ____D C:\Windows\SMINST
    2017-05-02 11:15 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2017-05-02 11:15 - 2006-11-02 08:37 - 00000000 ___RD C:\Users\Public\Recorded TV
    2017-05-02 11:14 - 2006-11-02 09:01 - 00032556 _____ C:\Windows\Tasks\SCHEDLGU.TXT
    2017-05-02 09:13 - 2014-08-20 19:28 - 256312161 _____ C:\Windows\MEMORY.DMP
    2017-05-02 09:13 - 2010-06-05 15:08 - 00000000 ____D C:\Windows\Minidump
    2017-05-01 23:10 - 2017-02-09 22:21 - 00000000 ____D C:\Windows\erdnt
    2017-05-01 18:10 - 2015-01-13 20:25 - 05048522 _____ C:\Users\Tori\Downloads\006.mp4
    2017-04-30 19:57 - 2015-11-20 17:10 - 00455878 _____ C:\Windows\ntbtlog.txt
    2017-04-30 16:13 - 2017-02-12 12:09 - 00000000 ____D C:\AdwCleaner
    2017-04-30 14:20 - 2017-02-08 22:26 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
    2017-04-29 15:21 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\inf
    2017-04-29 15:21 - 2006-11-02 06:33 - 00778466 _____ C:\Windows\system32\PerfStringBackup.INI
    2017-04-28 14:28 - 2017-02-16 15:12 - 00001280 _____ C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2017-04-28 13:07 - 2015-11-20 16:57 - 00472760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
    2017-04-28 13:07 - 2015-11-20 16:57 - 00107928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
    2017-04-22 19:10 - 2010-08-23 00:18 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
    2017-04-13 11:21 - 2016-07-09 12:16 - 00000000 _____ C:\Windows\system32\last.dump
    2017-04-11 13:49 - 2013-06-29 13:04 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
    2017-04-11 13:49 - 2013-06-29 13:04 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
    2017-04-11 13:49 - 2007-04-21 06:54 - 00000000 ____D C:\Windows\system32\Macromed
    2017-04-11 13:12 - 2015-09-29 12:39 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs
    2017-04-04 13:06 - 2015-11-20 16:57 - 00279800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
    2017-04-04 13:06 - 2015-11-20 16:57 - 00184208 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStmXP.sys
    2017-04-04 13:06 - 2015-11-20 16:57 - 00062152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
    2017-04-04 13:06 - 2015-11-20 16:57 - 00060760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
    2017-04-04 13:06 - 2015-11-20 16:57 - 00034136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
    2017-04-04 13:05 - 2017-02-10 08:37 - 00267528 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswblogx.sys
    2017-04-04 13:05 - 2017-02-10 08:37 - 00255184 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdriverx.sys
    2017-04-04 13:05 - 2017-02-10 08:37 - 00148208 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidshx.sys
    2017-04-04 13:05 - 2017-02-10 08:37 - 00041176 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbunivx.sys
    2017-04-04 13:05 - 2016-05-13 17:47 - 00031064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
    2017-04-04 13:05 - 2015-11-20 16:57 - 00764064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

    ==================== Files in the root of some directories =======

    2017-02-16 15:12 - 2017-04-28 14:28 - 0001280 _____ () C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2017-05-01 22:08 - 2017-05-02 10:59 - 0000680 _____ () C:\Users\Tori\AppData\Local\d3d9caps.dat

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
     
    dodopie,
    #12
  14. 2017/05/03
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 30-04-2017
    Ran by Tori (03-05-2017 08:02:21)
    Running from C:\Users\Tori\Desktop
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) (2009-10-20 17:03:37)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1137620820-469648318-63125674-500 - Administrator - Disabled)
    Guest (S-1-5-21-1137620820-469648318-63125674-501 - Limited - Enabled)
    IUSR_NMPR (S-1-5-21-1137620820-469648318-63125674-1000 - Limited - Disabled) => C:\Users\IUSR_NMPR
    Tori (S-1-5-21-1137620820-469648318-63125674-1001 - Administrator - Enabled) => C:\Users\Tori

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
    AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    2600 (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    2600_Help (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    2600Trb (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
    Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
    Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
    Adobe AIR (HKLM\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
    Adobe Flash Player 25 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 25.0.0.148 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
    AIO_CDB_ProductContext (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    AIO_CDB_Software (Version: 82.0.242.000 - Hewlett-Packard) Hidden
    AiO_Scan (Version: 43.0.217.000 - Hewlett-Packard) Hidden
    AIO_Scan (Version: 82.0.173.000 - Hewlett-Packard) Hidden
    AndroChef Java Decompiler (HKLM\...\{8DC30045-8565-492C-A6C4-30DEFF1169DE}) (Version: 1.0.0.12 - Atanas Neshkov)
    Avast Free Antivirus (HKLM\...\Avast Antivirus) (Version: 17.3.2291 - AVAST Software)
    BufferChm (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version: - )
    Cards_Calendar_OrderGift_DoMorePlugout (Version: 1.00.0000 - Hewlett-Packard) Hidden
    Copy (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Destination Component (Version: 100.0.0.0 - Hewlett-Packard) Hidden
    DeviceDiscovery (Version: 100.0.190.000 - Hewlett-Packard) Hidden
    DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_ProductContext (Version: 100.0.215.000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_Software (Version: 100.0.206.000 - Hewlett-Packard) Hidden
    DJ_AIO_03_F4200_Software_Min (Version: 100.0.213.000 - Hewlett-Packard) Hidden
    DocProc (Version: 10.0.0.0 - Hewlett-Packard) Hidden
    Dropbox (HKLM\...\Dropbox) (Version: 25.4.28 - Dropbox, Inc.)
    Dropbox Update Helper (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
    EE Full (HKLM\...\{C087A7EF-E572-4A39-B7EE-B1391B12D516}) (Version: 1.0.0.0 - )
    Enhanced Multimedia Keyboard Solution (HKLM\...\KBD) (Version: - Hewlett-Packard)
    eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
    Extension Changer (HKLM\...\Extension Changer) (Version: 0.5 - Yehia A.Salam)
    Fax (Version: 82.0.188.000 - Hewlett-Packard) Hidden
    Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
    Google Earth (HKLM\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
    Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.33.5 - Google Inc.) Hidden
    GPBaseService (Version: 100.0.187.000 - Hewlett-Packard) Hidden
    Hardware Diagnostic Tools (HKLM\...\PC-Doctor 5 for Windows) (Version: 5.00.4424.15 - PC-Doctor, Inc.)
    HP Advisor (HKLM\...\{73A43E42-3658-4DD9-8551-FACDA3632538}) (Version: 3.1.9152.3107 - Hewlett-Packard)
    HP Customer Experience Enhancements (HKLM\...\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}) (Version: 5.1.0.2264 - Hewlett-Packard)
    HP Customer Participation Program 10.0 (HKLM\...\HPExtendedCapabilities) (Version: 10.0 - HP)
    HP Deskjet F4200 All-In-One Driver Software 10.0 Rel .3 (HKLM\...\{AE9A67F9-ADF1-4a44-BAB5-C1DB302B37A2}) (Version: 10.0 - HP)
    HP Easy Setup - Frontend (HKLM\...\{40F7AED3-0C7D-4582-99F6-484A515C73F2}) (Version: 5.1.0.2269 - Hewlett-Packard)
    HP Imaging Device Functions 10.0 (HKLM\...\HP Imaging Device Functions) (Version: 10.0 - HP)
    HP On-Screen Cap/Num/Scroll Lock Indicator (HKLM\...\OsdMaestro) (Version: - Hewlett-Packard)
    HP Photosmart C4400 All-In-One Driver Software 10.0 Rel .3 (HKLM\...\{FF1F4E8E-A833-4c4b-A14A-45D5B841B5D8}) (Version: 10.0 - HP)
    HP Photosmart Essential (HKLM\...\{EB21A812-671B-4D08-B974-2A347F0D8F70}) (Version: 1.12.0.46 - HP)
    HP Photosmart Essential 2.5 (HKLM\...\HP Photosmart Essential) (Version: 2.5 - HP)
    HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B (HKLM\...\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}) (Version: 8.0 - HP)
    HP Smart Web Printing (HKLM\...\HP Smart Web Printing) (Version: 3.5 - HP)
    HP Solution Center 10.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 10.0 - HP)
    HP Update (HKLM\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
    HPPhotoSmartPhotobookWebPack1 (Version: 1.00.0000 - Hewlett-Packard) Hidden
    HPProductAssistant (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    HPSSupply (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
    Intel(R) Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - )
    Intel® Viiv™ Software (HKLM\...\Intel(R) Configuration Center) (Version: 1.6.361.6 - Intel Corporation)
    Java 8 Update 121 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
    LG PC Suite (HKLM\...\LG PC Suite) (Version: 5.3.25.20150529 - LG Electronics)
    LG United Mobile Drivers (HKLM\...\{4DE95ED9-0A29-4C4F-8463-35857CF9BA36}) (Version: 3.14.1 - LG Electronics)
    LightScribe 1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
    Logitech Legacy USB Camera Driver Package (HKLM\...\legacyqcam_10.50) (Version: 10.50.1091 - )
    Logitech SetPoint 6.15 (HKLM\...\SP6) (Version: 6.15.25 - Logitech)
    Logitech Vid (HKLM\...\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}) (Version: 1.10.1009 - Logitech Inc.)
    Logitech Webcam Software (HKLM\...\{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}) (Version: 12.10.1113 - Logitech Inc.)
    Malwarebytes version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
    MarketResearch (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (HKLM\...\{90120000-00B2-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Works (HKLM\...\{6D52C408-B09A-4520-9B18-475B81D393F1}) (Version: 08.05.0818 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    muvee autoProducer 6.0 (HKLM\...\{6AF49698-949A-4C89-9B31-041D2CCB5FBD}) (Version: 6.00.050 - muvee Technologies)
    My HP Games (HKLM\...\WildTangent hpdesktop Master Uninstall) (Version: HPCMPQ1701 - WildTangent)
    NETGEAR WNA1100 N150 Wireless USB Adapter (HKLM\...\{A2AE9709-283B-4B48-AA34-729C070A62FB}) (Version: 1.0.0.133 - NETGEAR)
    OCR Software by I.R.I.S. 10.0 (HKLM\...\HPOCR) (Version: 10.0 - HP)
    OpenOffice 4.0.1 (HKLM\...\{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}) (Version: 4.01.9714 - Apache Software Foundation)
    PanoStandAlone (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_ProductContext (Version: 100.0.215.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_Software (Version: 100.0.206.000 - Hewlett-Packard) Hidden
    PS_AIO_03_C4400_Software_Min (Version: 100.0.213.000 - Hewlett-Packard) Hidden
    PSSWCORE (Version: 2.02.0000 - Hewlett-Packard) Hidden
    Python 2.4.3 (HKLM\...\{75E71ADD-042C-4F30-BFAC-A9EC42351313}) (Version: 2.4.3150 - Martin v. Löwis)
    RangeMax Wireless-N USB Adapter WN111v2 (HKLM\...\InstallShield_{1C0E9C6B-D4D5-4D3C-8A10-F10A3E7BEEA5}) (Version: 2.00.0000 - NETGEAR)
    RealPlayer (HKLM\...\RealPlayer 6.0) (Version: - RealNetworks)
    Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5789 - Realtek Semiconductor Corp.)
    Rhapsody (HKLM\...\Rhapsody) (Version: - )
    Rhapsody Player Engine (HKLM\...\{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}) (Version: 1.0.604 - RealNetworks)
    RogueKiller version 12.10.6.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.10.6.0 - Adlice Software)
    Roxio Creator Audio (HKLM\...\{83FFCFC7-88C6-41c6-8752-958A45325C82}) (Version: 3.4.0 - Roxio)
    Roxio Creator Basic v9 (HKLM\...\{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}) (Version: 3.4.0 - Roxio)
    Roxio Creator Copy (HKLM\...\{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}) (Version: 3.4.0 - Roxio)
    Roxio Creator Data (HKLM\...\{0D397393-9B50-4c52-84D5-77E344289F87}) (Version: 3.4.0 - Roxio)
    Roxio Creator EasyArchive (HKLM\...\{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}) (Version: 3.4.0 - Roxio)
    Roxio Creator Tools (HKLM\...\{0394CDC8-FABD-4ed8-B104-03393876DFDF}) (Version: 3.4.0 - Roxio)
    Roxio Express Labeler 3 (HKLM\...\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 3.2.1 - Roxio)
    Roxio MyDVD Basic v9 (HKLM\...\{938B1CD7-7C60-491E-AA90-1F1888168240}) (Version: 9.0.559 - Roxio)
    RTC Client API v1.2 (HKLM\...\{44CDBD1B-89FB-4E02-8319-2A4C550F664A}) (Version: 1.2.0000 - Microsoft)
    SafeZone Stable 1.48.2066.120 (Version: 1.48.2066.120 - Avast Software) Hidden
    Scan (Version: 10.1.0.0 - Hewlett-Packard) Hidden
    Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 10.0 - HP)
    SmartWebPrintingOC (Version: 100.0.189.000 - Hewlett-Packard) Hidden
    Snapfish Media Detector (HKLM\...\{4EF6FDB0-3B11-4820-9860-8E08E9965195}) (Version: 1.7.0.15 - HP Snapfish)
    Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1) (Version: 7.74.00 - Conexant Systems)
    SolutionCenter (Version: 100.0.175.000 - Hewlett-Packard) Hidden
    Status (Version: 100.0.175.000 - Hewlett-Packard) Hidden
    Toolbox (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    Toolbox (Version: 82.0.173.000 - Hewlett-Packard) Hidden
    TrayApp (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    UnloadSupport (Version: 10.0.0 - Hewlett-Packard) Hidden
    VideoToolkit01 (Version: 100.0.128.000 - Hewlett-Packard) Hidden
    Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
    WebReg (Version: 100.0.170.000 - Hewlett-Packard) Hidden
    WN111v2 (Version: 2.00.0000 - NETGEAR) Hidden
    Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
    Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - Yahoo! Inc.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 -> C:\Windows\system32\mswinsck.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 -> C:\Windows\system32\mswinsck.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{32E26FD9-F435-4A20-A561-35D4B987CFDC}\InprocServer32 -> c:\programdata\webex\924\atucfobj.dll (WebEx Communications Inc.)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE3-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6352-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6353-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6354-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6355-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6356-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6357-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{586A6359-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> C:\Windows\system32\urlmon.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\InprocServer32 -> C:\Windows\system32\comdlg32.ocx (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1137620820-469648318-63125674-1001_Classes\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {60BEC739-0380-410D-B334-C30E1582211E} - System32\Tasks\{82BFA003-5420-4828-BFD6-DE291CBA9854} => pcalua.exe -a E:\AOLSETUP.EXE -d E:\
    Task: {7135123C-9783-4EF9-BC16-FE69210353A9} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-04-04] (AVAST Software)
    Task: {87D9FB2E-A7B4-4030-8E8E-6F9AF41DFAE5} - System32\Tasks\SafeZone scheduled Autoupdate 1463521888 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-12] (Avast Software)
    Task: {87EB81E7-622A-47D7-8791-778D87482306} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {9D9D408E-5E19-4E7E-9E7E-E3251ACFE470} - System32\Tasks\{446F2DB2-C365-478F-BB1C-F9855EA21D4F} => pcalua.exe -a "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" -d "C:\Program Files\HP\Digital Imaging\bin" -c -inst "#Hewlett-Packard#HP Photosmart 2600 series#1278605344" -d "HP Photosmart 2600 series"
    Task: {B1E95ABF-FD81-4AA4-A721-E85EFB97EEA6} - System32\Tasks\{DE1E14F6-5C0B-4325-ACD5-6529E07DEA9E} => pcalua.exe -a E:\setup.exe -d E:\
    Task: {BEFAF415-CC21-44C0-A50B-AE6EFBC43069} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-11] (Adobe Systems Incorporated)
    Task: {C2E3D536-DBA7-41F2-A56E-5B208E233C3B} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
    Task: {CD4C578E-AB63-4F8A-9C5E-3DA54FB93F13} - System32\Tasks\{17CB9E1B-FB64-4438-8EAF-820620F944C5} => pcalua.exe -a E:\SETUP.EXE -d E:\
    Task: {D4DCE6C6-38FC-4DBA-BF94-8D9965609BF1} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
    Task: {EE3AFF7D-09AC-4C27-845E-FCE758B530FE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
    Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2017-04-04 13:05 - 2017-04-04 13:05 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00653520 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00230632 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll
    2017-05-03 07:42 - 2017-05-03 07:42 - 06028528 _____ () C:\Program Files\AVAST Software\Avast\defs\17050300\algo.dll
    2006-09-03 13:32 - 2006-09-03 13:32 - 00208896 _____ () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    2016-06-07 12:48 - 2010-08-04 14:44 - 00266240 _____ () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    2016-06-07 12:48 - 2010-03-10 14:50 - 00360448 _____ () C:\Program Files\NETGEAR\WNA1100\WifiLib.dll
    2009-10-14 14:36 - 2009-10-14 14:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    2016-06-30 08:45 - 2016-06-30 08:45 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 02140944 _____ () C:\Program Files\Logitech\Logitech Vid\QtCore4.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 07704336 _____ () C:\Program Files\Logitech\Logitech Vid\QtGui4.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 00968976 _____ () C:\Program Files\Logitech\Logitech Vid\QtNetwork4.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 00475408 _____ () C:\Program Files\Logitech\Logitech Vid\QtOpenGL4.dll
    2009-06-02 08:59 - 2009-06-02 08:59 - 00363792 _____ () C:\Program Files\Logitech\Logitech Vid\QtXml4.dll
    2009-06-02 08:59 - 2009-06-02 08:59 - 00199952 _____ () C:\Program Files\Logitech\Logitech Vid\QtSql4.dll
    2009-06-02 08:59 - 2009-06-02 08:59 - 00027408 _____ () C:\Program Files\Logitech\Logitech Vid\SDL.dll
    2009-06-02 08:59 - 2009-06-02 08:59 - 11311888 _____ () C:\Program Files\Logitech\Logitech Vid\QtWebKit4.dll
    2009-06-02 08:58 - 2009-06-02 08:58 - 00291600 _____ () C:\Program Files\Logitech\Logitech Vid\phonon4.dll
    2009-06-02 09:00 - 2009-06-02 09:00 - 00028944 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
    2009-06-02 09:00 - 2009-06-02 09:00 - 00035088 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
    2009-06-02 09:00 - 2009-06-02 09:00 - 00138000 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
    2009-10-14 14:34 - 2009-10-14 14:34 - 00560472 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    2016-02-28 00:49 - 2012-05-25 05:25 - 00921600 _____ () C:\Program Files\Yahoo!\Messenger\yui.dll
    2005-06-24 11:13 - 2005-06-24 11:13 - 00407552 _____ () C:\Program Files\Extension Changer\extcontext.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00134920 _____ () c:\Program Files\AVAST Software\Avast\vaarclient.dll
    2017-04-04 13:05 - 2017-04-04 13:05 - 00230632 _____ () c:\Program Files\AVAST Software\Avast\StreamBack.dll
    2017-05-02 14:02 - 2017-05-01 10:44 - 00870720 _____ () C:\Program Files\Dropbox\Client\dropbox_watchdog.dll
    2017-04-27 01:27 - 2017-04-12 19:43 - 00035792 _____ () C:\Program Files\Dropbox\Client\_multiprocessing.pyd
    2017-04-27 01:27 - 2017-04-12 19:43 - 00100296 _____ () C:\Program Files\Dropbox\Client\_ctypes.pyd
    2017-04-27 01:27 - 2017-04-12 19:43 - 00018888 _____ () C:\Program Files\Dropbox\Client\select.pyd
    2017-04-27 01:27 - 2017-05-01 10:48 - 00019776 _____ () C:\Program Files\Dropbox\Client\tornado.speedups.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00020824 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
    2017-04-27 01:27 - 2017-04-12 19:44 - 00123856 _____ () C:\Program Files\Dropbox\Client\_cffi_backend.pyd
    2017-04-27 01:27 - 2017-04-12 19:43 - 00694224 _____ () C:\Program Files\Dropbox\Client\unicodedata.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 01729360 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00020816 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
    2017-05-02 14:02 - 2017-04-12 19:43 - 00145864 _____ () C:\Program Files\Dropbox\Client\pyexpat.pyd
    2017-05-02 14:02 - 2017-04-12 19:44 - 00019408 _____ () C:\Program Files\Dropbox\Client\faulthandler.pyd
    2017-05-02 14:02 - 2017-04-12 19:43 - 00116688 _____ () C:\Program Files\Dropbox\Client\pywintypes27.dll
    2017-04-27 01:27 - 2017-04-12 19:46 - 00105928 _____ () C:\Program Files\Dropbox\Client\win32api.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00022864 _____ () C:\Program Files\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00060736 _____ () C:\Program Files\Dropbox\Client\psutil._psutil_windows.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00038712 _____ () C:\Program Files\Dropbox\Client\fastpath.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00024528 _____ () C:\Program Files\Dropbox\Client\win32event.pyd
    2017-05-02 14:02 - 2017-04-12 19:43 - 00392656 _____ () C:\Program Files\Dropbox\Client\pythoncom27.dll
    2017-05-02 14:02 - 2017-04-12 19:46 - 00020936 _____ () C:\Program Files\Dropbox\Client\mmapfile.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00116176 _____ () C:\Program Files\Dropbox\Client\win32security.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00392512 _____ () C:\Program Files\Dropbox\Client\win32com.shell.shell.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00124880 _____ () C:\Program Files\Dropbox\Client\win32file.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00026456 _____ () C:\Program Files\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32clipboard.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00175560 _____ () C:\Program Files\Dropbox\Client\win32gui.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00030160 _____ () C:\Program Files\Dropbox\Client\win32pipe.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00043472 _____ () C:\Program Files\Dropbox\Client\win32process.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00048592 _____ () C:\Program Files\Dropbox\Client\win32service.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00057808 _____ () C:\Program Files\Dropbox\Client\win32evtlog.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32profile.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00246608 _____ () C:\Program Files\Dropbox\Client\breakpad.client.windows.handler.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00027488 _____ () C:\Program Files\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
    2017-04-27 01:27 - 2017-04-12 19:45 - 00241104 _____ () C:\Program Files\Dropbox\Client\_jpegtran.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00022336 _____ () C:\Program Files\Dropbox\Client\cpuid.compiled._cpuid.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00025432 _____ () C:\Program Files\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00028616 _____ () C:\Program Files\Dropbox\Client\win32ts.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 01826104 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtCore.pyd
    2017-04-27 01:27 - 2017-04-12 19:44 - 00083912 _____ () C:\Program Files\Dropbox\Client\sip.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 01972024 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtGui.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 03928896 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWidgets.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00171336 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00042816 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebChannel.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00531264 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtNetwork.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00133432 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKit.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00224064 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00207680 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtPrintSupport.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00060880 _____ () C:\Program Files\Dropbox\Client\win32print.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00054608 _____ () C:\Program Files\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00022864 _____ () C:\Program Files\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00022872 _____ () C:\Program Files\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00021848 _____ () C:\Program Files\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00022872 _____ () C:\Program Files\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd
    2017-04-27 01:27 - 2017-04-12 19:46 - 00349128 _____ () C:\Program Files\Dropbox\Client\winxpgui.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00023896 _____ () C:\Program Files\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
    2017-05-02 14:02 - 2017-05-01 10:48 - 00025936 _____ () C:\Program Files\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
    2017-05-02 14:02 - 2017-04-12 19:37 - 00036296 _____ () C:\Program Files\Dropbox\Client\librsync.dll
    2017-05-02 14:02 - 2017-05-01 10:48 - 00084288 _____ () C:\Program Files\Dropbox\Client\dropbox_sqlite_ext.dll
    2017-05-02 14:02 - 2017-04-12 19:50 - 00017864 _____ () C:\Program Files\Dropbox\Client\libEGL.dll
    2017-05-02 14:02 - 2017-04-12 19:50 - 01631184 _____ () C:\Program Files\Dropbox\Client\libGLESv2.dll
    2017-05-02 14:02 - 2017-04-12 19:50 - 14419408 _____ () C:\Program Files\Dropbox\Client\opengl32sw.dll
    2017-05-02 14:02 - 2017-05-01 10:48 - 00357688 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQml.pyd
    2017-04-27 01:27 - 2017-05-01 10:49 - 00026456 _____ () C:\Program Files\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
    2016-09-06 20:44 - 2016-09-06 12:00 - 05197312 _____ () C:\Users\Tori\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libglesv2.dll
    2016-09-06 20:44 - 2016-09-06 12:00 - 00147456 _____ () C:\Users\Tori\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libegl.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\Users\Tori\Downloads\006.mp4:TOC.WMV [130]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)

    HKLM\...\cmdfile\DefaultIcon: %SystemRoot%\System32\imageres.dll,-68 <===== ATTENTION

    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE trusted site: HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\driversupport.com -> hxxp://apps.driversupport.com
    IE trusted site: HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\driversupport.com -> hxxps://apps.driversupport.com

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2006-11-02 06:23 - 2017-05-02 12:11 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts

    127.0.0.1 localhost

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Tori\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    DNS Servers: 192.168.1.254
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [{7E08AE05-29F9-4FA2-A855-BC94B1812FEC}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe
    FirewallRules: [{8AD4B445-2665-49C1-868C-57B236CEDCA4}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe
    FirewallRules: [{CEE89B6C-00C8-4144-B5A6-0476047653A5}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    FirewallRules: [{43127B7F-6787-4AC9-98E9-5FB21C41FD6A}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    FirewallRules: [{92363EFE-3ED7-45D5-8406-56DA8AEEF7E2}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    FirewallRules: [{1FBA613B-8DB4-4AC4-B1BF-F0D97D0E2198}] => (Allow) C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    FirewallRules: [{25C42470-733A-44AA-9C25-08180AF8F86B}] => (Allow) LPort=9442
    FirewallRules: [{E5C1C5C6-E862-46F7-9566-D884DD2BFAC3}] => (Allow) LPort=1900
    FirewallRules: [{E4CE3B3A-59B8-4E11-8F2A-7993F4B86185}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{6485DC41-213D-4A8D-AA8B-551F99D23BE9}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{12619514-D9E8-4900-9E4D-ECDF93F13427}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{944880D9-B475-483D-BC04-009A3F5E2CE7}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{DE12E2DE-87E7-44F8-B3EE-2959C4DB6C77}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{D51E78BF-818E-445C-943E-B27861212FF5}] => (Allow) C:\Program Files\earthlink totalaccess\TaskPanl.exe
    FirewallRules: [{92CFE1BD-98CD-48CC-8F4B-3C89317682AA}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{9E4547A2-D64F-40E5-B488-DB594050B014}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    FirewallRules: [{D91AB1FB-C3A3-4C12-B4CB-03FCC5D9B2CC}] => (Allow) LPort=80
    FirewallRules: [{3D4D1636-B373-4D9A-979E-1F56EB31AF31}] => (Allow) LPort=80
    FirewallRules: [{03104623-B954-49BE-9D4C-702CE859704F}] => (Allow) LPort=80
    FirewallRules: [TCP Query User{01EB243C-E9F8-4B10-A42E-67F4C1C2B088}C:\program files\yahoo!\messenger\yahoomessenger.exe] => (Block) C:\program files\yahoo!\messenger\yahoomessenger.exe
    FirewallRules: [UDP Query User{57D3BE13-369B-4FAF-AC8C-776CEDA4C67B}C:\program files\yahoo!\messenger\yahoomessenger.exe] => (Block) C:\program files\yahoo!\messenger\yahoomessenger.exe
    FirewallRules: [TCP Query User{D5EF77F1-E966-48A9-ADE8-56B930510E4A}C:\program files\logitech\logitech vid\vid.exe] => (Block) C:\program files\logitech\logitech vid\vid.exe
    FirewallRules: [UDP Query User{67E147EE-488D-4F1F-BC40-D55FAE320043}C:\program files\logitech\logitech vid\vid.exe] => (Block) C:\program files\logitech\logitech vid\vid.exe
    FirewallRules: [{732C57C5-D5B5-4C3D-8948-E1EA0162E1D0}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{C10344C7-ABFF-4BD4-9EFF-7669EB75C1E9}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{75DE061E-26E1-4887-B05F-9496091CBE79}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{6CB0275C-8CEF-4FBB-B5E9-98BC592FC41F}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{830A844F-BD25-45CD-A2BC-F725B73F2D05}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{281B09ED-0AD5-4D5E-90C5-00FC4998C848}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{7BFAB5B2-3AEE-41C0-9D8A-F834B9437422}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{A0B5A194-3773-4FF7-8269-F68144160961}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{109B5621-110B-4C60-B0B0-A396DE293AD4}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{B91F2D9F-CA09-45A4-B597-2C2E7BAAA4B7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{C97A52B4-08D3-43C6-8DAF-B11FF6EE4475}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{055F6980-8CBE-466C-B366-2993401E8580}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{07721B83-175D-4895-99C0-663F782A0499}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{63D32969-17FC-4164-9623-9921FBCE106E}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{6B8CB9A2-DADF-4F30-9741-71E6709147D6}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{6EE3A0B2-3BE4-49D2-9B75-24F6D74F69B5}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{3C84CCB4-82E3-43EB-97FE-B8ADBD396FD8}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{BA5BB4D8-8411-472E-8A11-967F4475C850}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{ED35A362-A609-4AC8-8F2F-62A05A414EBA}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{7F314E9E-753D-4699-ADB0-7CF44FC7F91F}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{427B9501-4991-4E3D-878A-19B46AB2B95B}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    FirewallRules: [{E046F771-B7FC-4B47-BDB3-206CC6F761D2}] => (Allow) LPort=50308
    FirewallRules: [{5221F830-B378-42AE-842F-C42C7E374B70}] => (Allow) LPort=3479
    FirewallRules: [{2E7AB4BB-99CB-4CD7-9254-5167FAFC7DBF}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
    FirewallRules: [{1ACF1982-B5AF-4265-B4FC-2B18427B1266}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{CFF6D1F2-4B1C-4E61-B665-968498FB0F6B}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{7EC01A6D-F50B-4A51-BB7C-26E58F6682AF}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{E293C848-7B13-47E7-8242-3C6A1C6E191C}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{35907039-A8F4-408E-B76C-B35093EC679D}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{B6626F49-6218-446E-B906-0F96F9FEFB75}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe
    FirewallRules: [{D4E4C272-0350-4204-ABFB-1F6CAC497A90}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{0661BF77-2F77-4D15-8E76-C0C08A69C358}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe
    FirewallRules: [{3D0D28AC-0258-4C4E-8531-5F7C90FADBAC}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{6884201E-DA8B-4152-82D8-1F628CF4B0E7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{8881BA11-F95F-4894-B5A5-8D9BC2D457F7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{535423E9-C220-46BD-AFC8-1967A844B235}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe
    FirewallRules: [{3E1B3056-85A0-441A-BBE1-8FCEDD6E5AF7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{61CFB5E2-86B2-4D1E-8E57-17064959FD75}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{11E41D8A-D121-44B1-AE66-F76FCB674933}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{AEFA4582-DB14-417A-B2EC-1FA8B110C278}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
    FirewallRules: [{F5A72B58-3252-4EE0-AA3B-23FB1366CDF7}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{6896DD4D-5DDB-4A55-B347-A649C19ECF87}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{AF94A0C9-4660-4CAE-B9BB-45E55EF716E0}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{611D8009-6374-4AA1-BCB6-67136478A6A2}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{A4DCC555-D8AD-45B5-88F7-2D603B858CD6}] => (Allow) C:\Program Files\Logitech\Logitech Vid\Vid.exe
    FirewallRules: [{1E4A59A2-9901-4BBD-AFB4-1EF430F7D2EF}] => (Allow) C:\Program Files\Logitech\Logitech Vid\Vid.exe
    FirewallRules: [{BEBCEF90-B260-44DC-8906-39703021E218}] => (Allow) C:\Program Files\Dropbox\Client\Dropbox.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\EarthLink TotalAccess\TaskPanl.exe] => Enabled:Earthlink

    ==================== Restore Points =========================

    24-03-2017 00:00:09 Scheduled Checkpoint
    25-03-2017 00:00:31 Scheduled Checkpoint
    26-03-2017 04:12:18 Scheduled Checkpoint
    27-03-2017 00:00:10 Scheduled Checkpoint
    29-03-2017 01:54:35 Scheduled Checkpoint
    29-03-2017 22:06:10 Scheduled Checkpoint
    31-03-2017 01:12:42 Scheduled Checkpoint
    01-04-2017 00:00:11 Scheduled Checkpoint
    02-04-2017 14:56:04 Scheduled Checkpoint
    04-04-2017 00:00:06 Scheduled Checkpoint
    04-04-2017 16:35:43 Scheduled Checkpoint
    06-04-2017 00:00:08 Scheduled Checkpoint
    07-04-2017 00:00:09 Scheduled Checkpoint
    08-04-2017 00:00:09 Scheduled Checkpoint
    09-04-2017 00:00:11 Scheduled Checkpoint
    09-04-2017 21:12:10 Scheduled Checkpoint
    11-04-2017 00:00:11 Scheduled Checkpoint
    12-04-2017 00:00:11 Scheduled Checkpoint
    17-04-2017 02:21:30 Scheduled Checkpoint
    17-04-2017 19:00:10 JRT Pre-Junkware Removal
    30-04-2017 16:52:38 JRT Pre-Junkware Removal
    30-04-2017 18:12:00 JRT Pre-Junkware Removal

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
     
    dodopie,
    #13
  15. 2017/05/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You didn't answer my questions:
     
    broni,
    #14
  16. 2017/05/06
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    Both chrome and explorer
     
    dodopie,
    #15
  17. 2017/05/06
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Also...second log from FRST is incomplete.
    There is more after this line:

    "Application errors:"
     
    broni,
    #16
  18. 2017/05/07
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    there was nothing after application errors. the two logs were made before the scan finished and the scan got stuck and was just blinking. I just deleted and redownloaded a fresh one so Ill run it and post the two logs.
     
    dodopie,
    #17
  19. 2017/05/07
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    its running but stuck again with "Application Errors 11769594 flashing in the scan box and it already generated this note i'm posting now, I will let it run and hope it will finish.
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-05-2017
    Ran by Tori (administrator) on TORI-PC (07-05-2017 13:01:45)
    Running from C:\Users\Tori\Desktop
    Loaded Profiles: Tori (Available Profiles: IUSR_NMPR & Tori)
    Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    () C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehrecvr.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehsched.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    (Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe
    (Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
    (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    (Realtek Semiconductor) C:\WINDOWS\RtHDVCpl.exe
    (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
    (Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxsrvc.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (Logitech Inc.) C:\Program Files\Logitech\Logitech Vid\Vid.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    (NETGEAR) C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
    (Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    () C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
    (Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    (Yahoo! Inc.) C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
    (Hewlett-Packard Company) C:\hp\KBD\kbd.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    (AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
    (Dropbox, Inc.) C:\WINDOWS\System32\DbxSvc.exe
    (Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
    (Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [hpsysdrv] => c:\hp\support\hpsysdrv.exe [65536 2006-09-28] (Hewlett-Packard Company)
    HKLM\...\Run: [KBD] => C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
    HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-11-15] (Intel Corporation)
    HKLM\...\Run: [CCUTRAYICON] => FactoryMode
    HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-10-14] (Hewlett-Packard)
    HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
    HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4390912 2007-03-01] (Realtek Semiconductor)
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1311312 2010-06-25] (Logitech, Inc.)
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-04] (AVAST Software)
    HKLM\...\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [28432392 2017-05-01] (Dropbox, Inc.)
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
    HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
    HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
    HKLM\...\RunOnce: [Launcher] => C:\Windows\SMINST\launcher.exe [44168 2007-03-07] (soft thinks)
    HKLM\...\Policies\Explorer: [MemCheckBoxInRunDlg] 1
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Logitech Vid] => C:\Program Files\Logitech\Logitech Vid\Vid.exe [5458704 2009-07-16] (Logitech Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [221184 2008-01-19] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.16.0.dll [2017-05-01] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2017-04-04] (AVAST Software)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2012-03-17]
    ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WN111v2 Smart Wizard.lnk [2013-08-18]
    ShortcutTarget: NETGEAR WN111v2 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WN111v2\WN111v2.exe (NETGEAR)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Smart Wizard.lnk [2016-06-07]
    ShortcutTarget: NETGEAR WNA1100 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WNA1100\WNA1100.exe ()
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk [2007-04-21]
    ShortcutTarget: Snapfish Media Detector.lnk -> C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe ()
    Startup: C:\Users\Tori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2009-10-31]
    ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{2E0AA886-5EBF-401D-B070-6204C97B6624}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{435B15BB-F8C5-4712-9E94-F75174A18D50}: [DhcpNameServer] 208.59.247.45 208.59.247.46
    Tcpip\..\Interfaces\{5D2835A6-C339-499D-A5C8-A58D50CBC840}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{7F33EFC5-70C0-4B52-B39A-8F7FCDA6A7AD}: [DhcpNameServer] 75.114.81.1 75.114.81.2
    Tcpip\..\Interfaces\{FE880611-5A3F-4E43-8528-9B371CDA42BE}: [DhcpNameServer] 65.32.5.111 65.32.5.112

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=8
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1137620820-469648318-63125674-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
    SearchScopes: HKLM -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&amp;entrypoint={referrer:source?}&amp;FORM=HVDUS7
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> DefaultScope {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {2C40DD69-2213-4AA6-9E37-F1F67240C861} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=chr-tyc-inbox
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {3605AE4A-2792-45A7-8532-C258E1EFEBF4} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-1137620820-469648318-63125674-1001 -> {68B8192C-6966-4ED4-A788-4E9E918DB520} URL = hxxp://www.bing.com/search?FORM=UP94DF&PC=UP94&dt=072313&q={searchTerms}&src=IE-SearchBox
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-02-12] (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-04-04] (AVAST Software)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-12] (Oracle Corporation)
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

    FireFox:
    ========
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: (Microsoft .NET Framework Assistant) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-10-22] [not signed]
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2017-03-10]
    FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
    FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2017-03-10]
    FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-12] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-12] (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @real.com/nppl3260;version=6.0.11.2571 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprjplug;version=1.0.2.2629 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll [2007-04-21] (RealNetworks, Inc.)
    FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 -> C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll [2006-03-31] (RealNetworks, Inc.)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
    FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

    Chrome:
    =======
    CHR Profile: C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default [2017-05-07]
    CHR Extension: (Ebates Cash Back) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\chhjbpecpncaggjpdakmflnfcopglcmi [2017-05-04]
    CHR Extension: (Avast Online Security) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-04-06]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Tori\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
    CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation) [File not signed]
    R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5758120 2017-04-04] (AVAST Software s.r.o.)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-04] (AVAST Software)
    S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
    R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42288 2017-05-01] (Dropbox, Inc.)
    R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] () [File not signed]
    R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [139264 2007-11-06] (Hewlett-Packard Co.) [File not signed]
    R2 IAANTMON; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [81920 2006-11-15] (Intel Corporation) [File not signed]
    S3 IDriverT; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
    S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation) [File not signed]
    S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 jswpsapi; C:\Program Files\NETGEAR\WNA1100\jswpsapi.exe [960992 2010-03-22] (Atheros Communications, Inc.)
    R2 LightScribeService; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
    S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-09-01] () [File not signed]
    S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [3303888 2017-01-20] (Malwarebytes)
    S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation) [File not signed]
    R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
    R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
    S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation) [File not signed]
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
    R2 WSWNA1100; C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe [266240 2010-08-04] () [File not signed]

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [255184 2017-04-04] (AVAST Software s.r.o.)
    R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [148208 2017-04-04] (AVAST Software s.r.o.)
    R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [267528 2017-04-04] (AVAST Software s.r.o.)
    R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [41176 2017-04-04] (AVAST Software s.r.o.)
    S3 aswHdsKe; C:\Windows\system32\drivers\aswHdsKe.sys [73656 2017-04-29] (AVAST Software)
    S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34136 2017-04-04] (AVAST Software)
    R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [31064 2017-04-04] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107928 2017-04-28] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [60760 2017-04-04] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [62152 2017-04-04] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [764064 2017-04-04] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [472760 2017-04-28] (AVAST Software)
    R3 aswStmXP; C:\Windows\system32\drivers\aswStmXP.sys [184208 2017-04-04] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [279800 2017-04-04] (AVAST Software)
    R3 athur; C:\Windows\System32\DRIVERS\athur.sys [1439744 2010-10-10] (Atheros Communications, Inc.)
    S3 DNIMp50; C:\Windows\System32\Drivers\DNIMp50.sys [21504 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    S3 DNISp50; C:\Windows\System32\Drivers\DNISp50.sys [20480 2006-11-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
    R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2017-02-12] (GFI Software)
    S3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE2500vista.sys [1073216 2011-03-30] (Broadcom Corporation)
    R3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25752 2009-10-07] ()
    S3 LVUSBSta; C:\Windows\System32\drivers\lvusbsta.sys [41248 2006-12-15] (Logitech Inc.)
    S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [64288 2017-04-19] (Malwarebytes)
    R1 SBRE; C:\Windows\system32\drivers\SBREDrv.sys [101720 2011-11-01] (Sunbelt Software)
    R0 SCMNdisP; C:\Windows\System32\DRIVERS\scmndisp.sys [21728 2007-01-19] (Windows (R) Codename Longhorn DDK provider)
    U3 TrueSight; C:\WINDOWS\System32\drivers\TrueSight.sys [24688 2017-04-30] ()
    S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)
    S3 WN111v2; C:\Windows\System32\DRIVERS\WN111v2v.sys [453120 2009-01-13] (Atheros Communications, Inc.)
    U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
    R3 catchme; \??\C:\Users\Tori\AppData\Local\Temp\catchme.sys [X]
    S3 dbx; system32\DRIVERS\dbx.sys [X]
    U3 mbr; \??\C:\Users\Tori\AppData\Local\Temp\mbr.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-05-07 13:01 - 2017-05-07 13:02 - 00022301 _____ C:\Users\Tori\Desktop\FRST.txt
    2017-05-07 12:58 - 2017-05-07 12:58 - 01769984 _____ (Farbar) C:\Users\Tori\Desktop\FRST.exe
    2017-05-03 18:02 - 2017-05-03 18:02 - 00320898 _____ C:\Users\Tori\Downloads\archive (3).zip
    2017-05-02 14:02 - 2017-05-02 14:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
    2017-05-02 12:38 - 2017-05-02 12:38 - 00015790 _____ C:\ComboFix.txt
    2017-05-02 12:19 - 2017-05-02 12:38 - 00000000 ____D C:\ComboFix
    2017-05-02 12:12 - 2017-05-02 12:12 - 00000000 ____D C:\ProgramData\SWCUTemp
    2017-05-02 10:08 - 2017-05-02 10:08 - 00000838 _____ C:\Users\Tori\Desktop\ComboFix - Shortcut.lnk
    2017-05-02 10:07 - 2017-05-02 10:07 - 05659609 ____R (Swearware) C:\Users\Tori\Downloads\ComboFix.exe
    2017-05-02 09:13 - 2017-05-02 09:13 - 00145064 _____ C:\Windows\Minidump\Mini050217-01.dmp
    2017-05-01 23:21 - 2017-05-01 23:21 - 00000000 ____D C:\$AV_ASW
    2017-05-01 22:53 - 2011-06-26 02:45 - 00256000 _____ C:\Windows\PEV.exe
    2017-05-01 22:53 - 2010-11-07 13:20 - 00208896 _____ C:\Windows\MBR.exe
    2017-05-01 22:53 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00098816 _____ C:\Windows\sed.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00080412 _____ C:\Windows\grep.exe
    2017-05-01 22:53 - 2000-08-30 20:00 - 00068096 _____ C:\Windows\zip.exe
    2017-05-01 22:08 - 2017-05-02 10:59 - 00000680 _____ C:\Users\Tori\AppData\Local\d3d9caps.dat
    2017-05-01 22:00 - 2017-05-05 13:43 - 00000000 ____D C:\Users\Tori\AppData\Local\CrashDumps
    2017-05-01 22:00 - 2017-05-02 12:38 - 00000000 ____D C:\Qoobox
    2017-05-01 20:43 - 2017-05-01 20:43 - 00320898 _____ C:\Users\Tori\Downloads\archive (2).zip
    2017-05-01 17:42 - 2017-05-01 17:42 - 00320898 _____ C:\Users\Tori\Downloads\archive (1).zip
    2017-05-01 17:41 - 2017-05-01 17:42 - 00320898 _____ C:\Users\Tori\Downloads\archive.zip
    2017-05-01 10:49 - 2017-05-01 10:49 - 00042288 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
    2017-04-30 20:03 - 2017-04-30 20:03 - 00000564 _____ C:\Users\Tori\Desktop\JRT.txt
    2017-04-30 19:55 - 2017-04-30 19:56 - 00145064 _____ C:\Windows\Minidump\Mini043017-02.dmp
    2017-04-30 16:21 - 2017-04-30 16:22 - 01663672 _____ (Malwarebytes) C:\Users\Tori\Desktop\JRT (1).exe
    2017-04-30 16:02 - 2017-04-30 16:04 - 04089296 _____ C:\Users\Tori\Desktop\AdwCleaner (1).exe
    2017-04-30 15:44 - 2017-04-30 15:44 - 00001095 _____ C:\Users\Tori\Desktop\mb.txt
    2017-04-30 14:12 - 2017-04-30 14:12 - 00145064 _____ C:\Windows\Minidump\Mini043017-01.dmp
    2017-04-30 13:17 - 2017-04-30 13:17 - 00000802 _____ C:\Users\Public\Desktop\RogueKiller.lnk
    2017-04-29 17:51 - 2017-04-30 13:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
    2017-04-29 17:51 - 2017-04-30 13:17 - 00000000 ____D C:\Program Files\RogueKiller
    2017-04-29 17:11 - 2017-04-29 17:27 - 35357840 _____ (Adlice Software ) C:\Users\Tori\Desktop\setup.exe
    2017-04-29 16:24 - 2017-05-02 22:44 - 00000000 ____D C:\FRST
    2017-04-29 14:39 - 2017-04-29 10:56 - 00073656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys
    2017-04-19 18:21 - 2017-04-19 18:21 - 00161216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
    2017-04-19 18:20 - 2017-05-02 11:16 - 00220088 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2017-04-19 18:20 - 2017-04-19 18:22 - 00064288 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
    2017-04-19 18:20 - 2017-04-19 18:20 - 00039360 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2017-04-19 18:20 - 2017-04-19 18:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2017-04-19 18:20 - 2017-04-19 18:20 - 00000000 ____D C:\ProgramData\Malwarebytes
    2017-04-19 18:20 - 2017-03-22 11:02 - 00059904 _____ C:\Windows\system32\Drivers\mbae.sys
    2017-04-19 18:11 - 2017-04-19 18:17 - 60107896 _____ (Malwarebytes ) C:\Users\Tori\Downloads\mb3-setup-consumer-3.0.6.1469-10103.exe
    2017-04-19 15:18 - 2017-04-19 15:18 - 00118190 _____ C:\Users\Tori\Documents\USPS - Welcome to PO Boxes Online.pdf
    2017-04-17 20:12 - 2017-04-17 19:06 - 00003294 _____ C:\Users\Tori\Documents\JRT.txt
    2017-04-12 17:57 - 2017-04-12 17:57 - 00009728 _____ C:\Users\Tori\Documents\april Jerry.wps
    2017-04-12 12:18 - 2017-04-12 12:18 - 00153940 _____ C:\Users\Tori\Downloads\2016TaxReturn.PDF
    2017-04-09 20:33 - 2017-04-09 20:33 - 00145064 _____ C:\Windows\Minidump\Mini040917-01.dmp

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-05-07 12:21 - 2015-12-01 12:47 - 00000892 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
    2017-05-07 11:16 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    2017-05-07 11:16 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    2017-05-06 18:21 - 2015-12-01 12:47 - 00000888 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
    2017-05-05 23:07 - 2017-03-25 15:45 - 00000000 ___RD C:\Users\Tori\Documents\****
    2017-05-03 18:34 - 2015-09-29 12:39 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs
    2017-05-02 14:02 - 2015-12-01 12:51 - 00000000 ___RD C:\Users\Tori\Dropbox
    2017-05-02 14:02 - 2015-12-01 12:47 - 00000000 ____D C:\Program Files\Dropbox
    2017-05-02 12:35 - 2006-11-02 06:23 - 00000215 _____ C:\Windows\system.ini
    2017-05-02 12:11 - 2007-04-21 07:29 - 00000000 ____D C:\Windows\SMINST
    2017-05-02 11:15 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2017-05-02 11:15 - 2006-11-02 08:37 - 00000000 ___RD C:\Users\Public\Recorded TV
    2017-05-02 11:14 - 2006-11-02 09:01 - 00032556 _____ C:\Windows\Tasks\SCHEDLGU.TXT
    2017-05-02 09:13 - 2014-08-20 19:28 - 256312161 _____ C:\Windows\MEMORY.DMP
    2017-05-02 09:13 - 2010-06-05 15:08 - 00000000 ____D C:\Windows\Minidump
    2017-05-01 23:10 - 2017-02-09 22:21 - 00000000 ____D C:\Windows\erdnt
    2017-05-01 18:10 - 2015-01-13 20:25 - 05048522 _____ C:\Users\Tori\Downloads\006.mp4
    2017-04-30 19:57 - 2015-11-20 17:10 - 00455878 _____ C:\Windows\ntbtlog.txt
    2017-04-30 16:13 - 2017-02-12 12:09 - 00000000 ____D C:\AdwCleaner
    2017-04-30 14:20 - 2017-02-08 22:26 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
    2017-04-29 15:21 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\inf
    2017-04-29 15:21 - 2006-11-02 06:33 - 00778466 _____ C:\Windows\system32\PerfStringBackup.INI
    2017-04-28 14:28 - 2017-02-16 15:12 - 00001280 _____ C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2017-04-28 13:07 - 2015-11-20 16:57 - 00472760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
    2017-04-28 13:07 - 2015-11-20 16:57 - 00107928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
    2017-04-22 19:10 - 2010-08-23 00:18 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
    2017-04-13 11:21 - 2016-07-09 12:16 - 00000000 _____ C:\Windows\system32\last.dump
    2017-04-11 13:49 - 2013-06-29 13:04 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
    2017-04-11 13:49 - 2013-06-29 13:04 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
    2017-04-11 13:49 - 2007-04-21 06:54 - 00000000 ____D C:\Windows\system32\Macromed

    ==================== Files in the root of some directories =======

    2017-02-16 15:12 - 2017-04-28 14:28 - 0001280 _____ () C:\Users\Tori\AppData\Roaming\wklnhst.dat
    2017-05-01 22:08 - 2017-05-02 10:59 - 0000680 _____ () C:\Users\Tori\AppData\Local\d3d9caps.dat

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
     
    dodopie,
    #18
  20. 2017/05/07
    dodopie Contributing Member

    dodopie Well-Known Member Thread Starter

    Joined:
    2010/12/26
    Messages:
    458
    Likes Received:
    2
    its still running and stalled at the same place. I tried IE again it seems to be normal speed but chrome still very very slow
     
    dodopie,
    #19
  21. 2017/05/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

    Then...

    Reset Chrome...
    Click on "Customize and control Google Chrome":
    [​IMG]
    Click "Settings" then "Show advanced settings" at the bottom of the screen.
    Click "Reset browser settings" button.
    Restart Chrome.

    If the above didn't help....

    Reinstall Chrome...
    If you want to save your bookmarks...
    How to Backup Bookmarks in Google Chrome
    If you want to save your passwords as well see here: Backup & Restore Google Chrome Passwords in Windows 10/8/7
    • Close all Chrome windows and tabs.
    • Go to the Start menu > Control Panel. (Windows 8 users: Learn how to access the Control Panel)
    • Click Programs and Features.
    • Double-click Google Chrome.
    • Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, by selecting the "Also delete your browsing data" checkbox.
    Install fresh copy.
     

    Attached Files:

    broni,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...