[RESOLVED] I suspect my PC has a virus or malware - Page 3
Page 3 of 4 FirstFirst 1234 LastLast
Results 31 to 45 of 54

Thread: [RESOLVED] I suspect my PC has a virus or malware

  1. #31
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    # AdwCleaner v3.309 - Report created 05/09/2014 at 09:22:20
    # Updated 02/09/2014 by Xplode
    # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username : Salina - JOHNSMARTIN-PC
    # Running from : C:\Users\Salina\Downloads\adwcleaner_3.309 (7).exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\ProgramData\Trusted Publisher
    Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
    Folder Deleted : C:\Users\Administrator\AppData\Local\torch
    Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
    Folder Deleted : C:\Users\Guest\AppData\Local\torch
    Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
    Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\torch
    Folder Deleted : C:\Users\Salina\AppData\Local\Chromatic Browser
    Folder Deleted : C:\Users\Salina\AppData\Local\torch
    File Deleted : C:\Users\Salina\AppData\Roaming\Mozilla\Firefox\Profiles\ksgzcgc5.default-1405450587902\searchplugins\Askcom.xml
    File Deleted : C:\Users\Salina\AppData\Roaming\Mozilla\Firefox\Profiles\ksgzcgc5.default-1405450587902\user.js

    ***** [ Scheduled Tasks ] *****

    Task Deleted : Driver Booster Scan
    Task Deleted : Driver Booster Update

    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{065C1A21-97F8-45FB-A9F0-861B60FACEC8}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3204358F-5904-46A6-841F-D6B5BE3EF4E3}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3AE67737-0E3E-44AA-AA5E-46A68BF017FF}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3EE5B726-044A-48D2-AA7B-049BD9A0F62A}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{60FBBE03-57FF-49D8-B38E-053D3F489825}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6A5182F1-C0B8-42B8-96CC-7F329CD46913}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6C153418-8E4D-4FAF-AF27-5201E38463A7}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A26A2F05-AC4D-4A1E-9531-9125F7309B78}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5D6240-7DF0-435D-9B9B-F8586A99DE86}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F343045E-E20A-46E1-82D8-9962C43EFC9E}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FBB360DC-CB6C-4D6A-808A-2C773151BFFF}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFD7DDAC-EC28-42A5-8D39-917B9078604B}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{49606DC7-976D-4030-A74E-9FB5C842FA68}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{49606DC7-976D-4030-A74E-9FB5C842FA68}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{49606DC7-976D-4030-A74E-9FB5C842FA68}
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    Key Deleted : HKCU\Software\RegisteredApplicationsEx
    Key Deleted : HKCU\Software\AppDataLow\Software\adawarebp
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.0.9
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.17239


    -\\ Mozilla Firefox v31.0 (x86 en-US)

    [ File : C:\Users\Salina\AppData\Roaming\Mozilla\Firefox\Profiles\ksgzcgc5.default-1405450587902\prefs.js ]

    Line Deleted : user_pref("extensions.jEQF.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumorobo.ne[...]
    Line Deleted : user_pref("extensions.sCC2noeEs9IE.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sum[...]

    -\\ Google Chrome v36.0.1985.143

    [ File : C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\preferences ]


    *************************

    AdwCleaner[R0].txt - [4758 octets] - [05/09/2014 09:10:21]
    AdwCleaner[S0].txt - [4459 octets] - [05/09/2014 09:22:20]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4519 octets] ##########
    Steve

  2. #32
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.1.3 (03.23.2014:1)
    OS: Windows 7 Home Premium x64
    Ran by Salina on Fri 09/05/2014 at 9:44:04.06
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys



    ~~~ Files



    ~~~ Folders

    Failed to delete: [Folder] "C:\Program Files (x86)\coupons"
    Successfully deleted: [Empty Folder] C:\Users\Salina\appdata\local\{881CB04C-E393-42B1-A846-064CFABFFD39}
    Successfully deleted: [Empty Folder] C:\Users\Salina\appdata\local\{FFF8C6A5-57B7-4192-B2B5-4844FF5F8535}



    ~~~ FireFox

    Successfully deleted the following from C:\Users\Salina\AppData\Roaming\mozilla\firefox\profiles\ksgzcgc5.default-1405450587902\prefs.js

    user_pref("extensions.sCC2noeEs9IE.url", "hxxp://getjpiproxy.info/sync2/?q=hfZ9ofV9CShEAen0rHnFrihTB6lKDzt4olljtNtVh7n0rjnEpdsFrjYFrHr5tMFHhd9Fqda4rdrFrjk9rjkMDMlGojUMAe4Uojn6
    Emptied folder: C:\Users\Salina\AppData\Roaming\mozilla\firefox\profiles\ksgzcgc5.default-1405450587902\minidumps [11 files]



    ~~~ Event Viewer Logs were cleared
    Steve

  3. #33
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 02
    Ran by Salina (administrator) on JOHNSMARTIN-PC on 05-09-2014 10:35:56
    Running from C:\Users\Salina\Downloads
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11
    Boot Mode: Normal

    The only official download link for FRST:
    Download link for 32-Bit version: http://www.bleepingcomputer.com/down...an-tool/dl/81/
    Download link for 64-Bit Version: http://www.bleepingcomputer.com/down...an-tool/dl/82/
    Download link from any site other than Bleeping Computer is unpermitted or outdated.
    See tutorial for FRST: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (IObit) C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe
    (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
    (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe
    (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    () C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
    (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
    () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    (Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe
    (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672152 2014-07-24] (Realtek Semiconductor)
    HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
    HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)
    HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1275608 2014-03-25] (COMODO)
    HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-14] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4144448 2010-11-10] (Dell, Inc.)
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
    HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
    HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421736 2012-03-27] (Apple Inc.)
    HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
    HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
    HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
    HKLM-x32\...\Run: [tvncontrol] => C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2327248 2014-07-25] (Comodo Security Solutions, Inc.)
    Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
    HKU\S-1-5-21-3913336790-2022505941-1720759447-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
    HKU\S-1-5-21-3913336790-2022505941-1720759447-1000\...\Run: [Advanced SystemCare 7] => C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
    ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start GeekBuddy.lnk
    ShortcutTarget: Start GeekBuddy.lnk -> C:\Program Files\COMODO\GeekBuddy\launcher.exe (Comodo Security Solutions, Inc.)
    ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
    BootExecute: autocheck autochk * SmartDefragBootTime.exe
    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
    StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
    BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
    BHO-x32: No Name -> {200F5C03-A4F0-A899-3AAD-C4F5AEA8470D} -> No File
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    BHO-x32: No Name -> {ACC780B0-906C-7AAD-64FF-51131513A55D} -> No File
    BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    BHO-x32: Advanced SystemCare Browser Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
    Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
    Tcpip\Parameters: [DhcpNameServer] 10.1.10.1
    Tcpip\..\Interfaces\{D94B12F3-6144-438C-8582-893D7A1E252C}: [NameServer] 156.154.70.22,156.154.71.22

    FireFox:
    ========
    FF ProfilePath: C:\Users\Salina\AppData\Roaming\Mozilla\Firefox\Profiles\ksgzcgc5.default-1405450587902
    FF Homepage: hxxp://xfinity.comcast.net/?cid=mtmh07152014
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin HKCU: @citrixonline.com/appdetectorplugin -> C:\Users\Salina\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
    FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Salina\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
    FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
    FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Salina\AppData\Roaming\Mozilla\Firefox\Profiles\ksgzcgc5.default-1405450587902\Extensions\ascsurfingprotection@iobit.com [2014-07-24]
    FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-10-21]
    FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

    Chrome:
    =======
    CHR HomePage: Default ->
    CHR Profile: C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-22]
    CHR Extension: (Google Drive) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-22]
    CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-24]
    CHR Extension: (YouTube) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-22]
    CHR Extension: (Google Search) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-22]
    CHR Extension: (Google Wallet) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22]
    CHR Extension: (Gmail) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-22]
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AdvancedSystemCareService7; C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
    R2 CLPSLauncher; C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe [70864 2014-07-25] (Comodo Security Solutions, Inc.)
    R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6817544 2014-04-16] (COMODO)
    S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2264280 2014-03-25] (COMODO)
    R2 CouponPrinterService; C:\Program Files (x86)\Coupons\CouponPrinterService.exe [177136 2014-04-28] (Coupons.com Inc.)
    S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-05-13] (WildTangent)
    R2 GeekBuddyRSP; C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2327248 2014-07-25] (Comodo Security Solutions, Inc.)
    R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
    S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
    R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
    R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
    S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
    S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
    R1 CFRMD; C:\Windows\System32\DRIVERS\CFRMD.sys [37976 2014-06-26] (Windows (R) Win 7 DDK provider) [File not signed]
    R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2014-04-16] (COMODO)
    R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [738472 2014-04-16] (COMODO)
    R1 HMD; C:\Windows\System32\DRIVERS\hmd.sys [14888 2014-06-26] ()
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
    R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-05] (Malwarebytes Corporation)
    R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
    R3 PaniniUSB; C:\Windows\System32\DRIVERS\PaniniUSB.sys [258304 2011-05-18] (Panini)
    R3 PaniniUSB; C:\Windows\SysWOW64\DRIVERS\PaniniUSB.sys [258304 2011-05-18] (Panini)
    S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
    R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
    U3 TrueSight; C:\Windows\SysWOW64\drivers\TrueSight.sys [33512 2014-09-03] ()
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]

    ==================== NetSvcs (Whitelisted) ===================
    Steve

  4. #34
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2014 02
    Ran by Salina at 2014-09-05 10:37:03
    Running from C:\Users\Salina\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)


    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
    Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
    Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
    Adobe Photoshop Elements 2.0 (HKLM-x32\...\Adobe Photoshop Elements 2.0) (Version: 2.0 - Adobe Systems, Inc.)
    Adobe Reader X (10.1.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
    Advanced SystemCare 7 (HKLM-x32\...\Advanced SystemCare 7_is1) (Version: 7.3.1 - IObit)
    Apple Application Support (HKLM-x32\...\{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}) (Version: 2.1.7 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}) (Version: 5.1.1.4 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden
    BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
    Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
    Catalyst Control Center Core Implementation (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    Catalyst Control Center Graphics Full Existing (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    Catalyst Control Center Graphics Full New (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    Catalyst Control Center Graphics Light (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    Catalyst Control Center Graphics Previews Common (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    Catalyst Control Center InstallProxy (x32 Version: 2009.0714.2132.36830 - ATI Technologies, Inc.) Hidden
    Catalyst Control Center Localization All (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    CCC Help Chinese Standard (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Chinese Traditional (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Czech (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Danish (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Dutch (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help English (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Finnish (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help French (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help German (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Greek (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Hungarian (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Italian (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Japanese (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Korean (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Norwegian (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Polish (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Portuguese (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Russian (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Spanish (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Swedish (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Thai (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    CCC Help Turkish (x32 Version: 2009.0714.2131.36830 - ATI) Hidden
    ccc-core-static (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    ccc-utility64 (Version: 2009.0714.2132.36830 - ATI) Hidden
    Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Citrix Online Launcher (HKLM-x32\...\{F17C3DC2-2ACA-4B0E-BDBF-ACE61B14E7CD}) (Version: 1.0.183 - Citrix)
    COMODO Antivirus (HKLM\...\{2736B6BD-31EC-4FC8-A48C-F0A5C914C0B6}) (Version: 7.0.55655.4142 - COMODO Security Solutions Inc.)
    Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    D4100 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
    D4100_Help (x32 Version: 82.0.233.000 - Hewlett-Packard) Hidden
    D7500 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
    Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell Inc.)
    Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell Inc.)
    Dell Digital Delivery (HKLM-x32\...\{2B25AEE3-D191-4735-870E-28743D727ED8}) (Version: 1.7.1002.0 - Dell Products, LP)
    Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
    Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
    Dell Marketplace Webslice IE8 (HKLM-x32\...\{CF67ED0C-F85D-4791-AED3-3FE882EDB45D}) (Version: 8.0 - Nextjump Inc)
    Dell MusicStage (HKLM-x32\...\{91AF2672-F5BC-42CF-8037-A9D2F92BBCC0}) (Version: 1.5.201.0 - Fingertapps)
    Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)
    Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.0.6 - Dell Inc.)
    Dell Stage (HKLM-x32\...\{FE182796-F6BA-486A-8590-89B7E8D1D60F}) (Version: 1.7.209.0 - Fingertapps)
    Dell VideoStage (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)
    Dell VideoStage (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden
    Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
    DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
    Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
    DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
    Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Driver Booster (HKLM-x32\...\Driver Booster_is1) (Version: 1.4 - IObit)
    eBay (HKLM-x32\...\{A8B88634-7F90-402F-B66A-86429755F6A5}) (Version: 1.4.0 - eBay Inc.)
    Escape Whisper Valley (TM) (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
    Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
    FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden
    File Association Helper (HKLM\...\{C168639F-5810-4EC8-B1E8-0251AA8A771C}) (Version: 1.2.225.65451 - WinZip Computing International, LLC)
    FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version: - )
    Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Final Drive Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
    FIS Panini Universal Driver (HKLM-x32\...\FIS Panini Universal Driver) (Version: 2012.2.0.0 - FIS)
    GeekBuddy (HKLM\...\{ADBA2296-BA0A-49C1-B3A1-67B0C95CB8AE}) (Version: 4.16.114 - Comodo Security Solutions Inc)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
    Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
    Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
    GoToAssist 8.0.0.514 (HKLM-x32\...\GoToAssist) (Version: - )
    GoToMeeting 6.4.0.1558 (HKCU\...\GoToMeeting) (Version: 6.4.0.1558 - CitrixOnline)
    GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
    HP Deskjet & Photosmart Printer Driver Software 13.0 Rel. A (HKLM\...\{4B97502B-795A-4E12-9A93-E824772156A7}) (Version: 13.0 - HP)
    HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
    HP Photosmart D7500 Printer Driver Software 13.0 Rel. 4 (HKLM\...\{2F478590-A2A6-43E3-A567-A89A5F38AAC4}) (Version: 13.0 - HP)
    HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
    HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
    HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
    HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
    HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
    HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
    HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
    HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    Internet Explorer (x32 Version: 8 - Microsoft Corporation) Hidden
    IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.2.10.2466 - IObit)
    iTunes (HKLM\...\{CF8FFD12-602B-422D-AF1D-511B411E7632}) (Version: 10.6.1.7 - Apple Inc.)
    Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.650 - Oracle)
    Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden
    Jewel Quest (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Jewel Quest Solitaire 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Luxor (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
    MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
    Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
    Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
    Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
    Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
    Mozilla Firefox 31.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 en-US)) (Version: 31.0 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
    MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
    MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
    Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Panini 4.0.2 Universal Installer (HKLM-x32\...\{68FF4E69-53DC-485C-ADD9-E56FF9A406F8}) (Version: 4.00.203 - Panini)
    Panini API 4.0.2 - Universal Installer (x32 Version: 4.00.203 - PANINI) Hidden
    Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
    PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
    Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
    PS_SF_04_D7500_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
    RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
    Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden
    Roxio BackOnTrack (x32 Version: 1.3.3 - Roxio) Hidden
    Roxio Burn (x32 Version: 1.8 - Roxio) Hidden
    Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
    Roxio Creator Starter (x32 Version: 1.0.439 - Roxio) Hidden
    Roxio Creator Starter (x32 Version: 5.0.0 - Roxio) Hidden
    Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden
    Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
    Samantha Swift (x32 Version: 2.2.0.95 - WildTangent) Hidden
    SF_CDA_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
    SF_CDA_Software (x32 Version: 130.0.396.000 - Hewlett-Packard) Hidden
    Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
    Skins (x32 Version: 2009.0714.2132.36830 - ATI) Hidden
    Skype Toolbars (HKLM-x32\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
    Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
    Slawdog Smart Shutdown (HKLM-x32\...\Slawdog Smart Shutdown) (Version: - )
    SlimCleaner (HKLM-x32\...\{6B8D6199-EE44-4FD7-813A-6D8C62C9B384}) (Version: 4.0.30878 - SlimWare Utilities, Inc.)
    Smart Defrag 3 (HKLM-x32\...\Smart Defrag 3_is1) (Version: 3.2 - IObit)
    SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
    SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
    Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
    Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
    Surfing Protection (HKLM-x32\...\IObit Surfing Protection_is1) (Version: 1.0 - IObit)
    Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
    TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
    TrustedID (HKLM-x32\...\{C16A92EF-017B-4839-9C75-FBADB5A1FA27}) (Version: 5.0 - TrustedID)
    UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
    Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
    Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95 - WildTangent) Hidden
    WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
    Wedding Dash - Ready, Aim, Love! (x32 Version: 2.2.0.95 - WildTangent) Hidden
    WildTangent Games (HKLM-x32\...\WildTangent dell Master Uninstall) (Version: 1.0.2.5 - WildTangent)
    WildTangent Games App (Dell Games) (x32 Version: 4.0.11.2 - WildTangent) Hidden
    Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
    Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
    Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
    Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
    Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
    Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    WinZip 18.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E3}) (Version: 18.5.11111 - WinZip Computing, S.L. )
    World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: 5.3.0.17128 - Blizzard Entertainment)
    Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-3913336790-2022505941-1720759447-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Salina\AppData\Local\Citrix\GoToMeeting\1350\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

    ==================== Restore Points =========================

    Could not list Restore Points. Check "winmgmt" service or repair WMI.


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2014-09-05 08:14 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 localhost

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {0660CC65-2407-4287-9622-8B937785B55E} - System32\Tasks\G2MUpdateTask-S-1-5-21-3913336790-2022505941-1720759447-1000 => C:\Users\Salina\AppData\Local\Citrix\GoToMeeting\1558\g2mupdate.exe [2014-08-22] (Citrix Online, a division of Citrix Systems, Inc.)
    Task: {11242432-687D-41AB-805D-DB94DC0FE1D0} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
    Task: {1CA27ED2-14F8-4EE9-9D38-2BC365867FD7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {1E9199E1-AF57-49CE-B6DD-B0E593723D95} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3913336790-2022505941-1720759447-1000Core => C:\Users\Salina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-09] (Facebook Inc.)
    Task: {23CCDDB0-C44B-4784-A487-6EBF6803191A} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
    Task: {23E527A5-9770-4B9C-8746-72EB8AC60B31} - System32\Tasks\SlimCleaner Run => C:\Program Files (x86)\SlimCleaner\SlimCleaner.exe [2013-07-10] (SlimWare Utilities, Inc.)
    Task: {28219C07-6FFC-4AE3-AB9C-D0D1A45F22A3} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe [2014-07-02] (IObit)
    Task: {2F9C2EBD-AD8A-463F-A6BA-37FC867C2381} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-04-16] (COMODO)
    Task: {59433E33-7C00-4DA2-848C-590D7F83A673} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3913336790-2022505941-1720759447-1000UA => C:\Users\Salina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-09] (Facebook Inc.)
    Task: {6FA27570-7398-4063-A014-1450D29119FC} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
    Task: {7DB99555-30B8-4FB6-8032-F89863AE297F} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-04-16] (COMODO)
    Task: {8612D399-650C-43AF-A592-DC973FF2203D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: {8ACEE742-A407-4774-B705-321D4E3A969A} - System32\Tasks\{6B1B63BE-AB93-4B9F-A9F8-0EF92A93A7E8} => C:\Program Files (x86)\Microsoft Office\OFFICE11\PROFLWIZ.EXE [2007-03-22] (Microsoft Corporation)
    Task: {9A0496A0-5D9B-4DC7-808E-50687E796ABC} - System32\Tasks\SmartDefrag3_Update => C:\Program Files (x86)\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-03] (IObit)
    Task: {A00B1138-E0E7-40FB-B12F-8751C1D94B6E} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-04-16] (COMODO)
    Task: {A9E16AC5-6273-4756-8601-ED711A9E4B82} - System32\Tasks\ASC7_SkipUac_Salina => C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASC.exe [2014-05-29] (IObit)
    Task: {ABBFE3CE-A5C3-4200-AA64-04DAE42E2CA1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-18] (Adobe Systems Incorporated)
    Task: {AEE465D8-4958-45F1-95D3-7184A61FEBEC} - System32\Tasks\Driver Booster SkipUAC (Salina) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2014-06-04] (IObit)
    Task: {D046FB8B-1ACB-428E-BF43-7633154112B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: {D89377C8-7A4E-4D99-97DE-805C9F2769B4} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
    Task: {DAC37CB5-9843-4096-935D-CC0D396B73CE} - System32\Tasks\Uninstaller_SkipUac_Administrator => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2014-05-06] (IObit)
    Task: {F97335FE-C21B-44CE-A374-B2FFEBFED95B} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-04-16] (COMODO)
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3913336790-2022505941-1720759447-1000Core.job => C:\Users\Salina\AppData\Local\Facebook\Update\FacebookUpdate.exe
    Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3913336790-2022505941-1720759447-1000UA.job => C:\Users\Salina\AppData\Local\Facebook\Update\FacebookUpdate.exe
    Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3913336790-2022505941-1720759447-1000.job => C:\Users\Salina\AppData\Local\Citrix\GoToMeeting\1558\g2mupdate.exe

    ==================== Loaded Modules (whitelisted) =============

    2011-09-29 02:54 - 2011-08-18 12:05 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
    2010-11-17 11:35 - 2010-11-17 11:35 - 00514544 _____ () C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
    2012-02-01 11:50 - 2012-02-01 11:50 - 00968048 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"

    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)


    ==================== Faulty Device Manager Devices =============

    Could not list Devices. Check "winmgmt" service or repair WMI.


    ==================== Event log errors: =========================

    Application errors:
    ==================

    System errors:
    =============

    Microsoft Office Sessions:
    =========================

    ==================== Memory info ===========================

    Processor: AMD Athlon(tm) II X2 250 Processor
    Percentage of memory in use: 50%
    Total physical RAM: 3838.98 MB
    Available physical RAM: 1900.73 MB
    Total Pagefile: 7676.13 MB
    Available Pagefile: 4821.47 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.82 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:450.91 GB) (Free:370.15 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 61810D7F)
    Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
    Partition 2: (Active) - (Size=14.8 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=450.9 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================
    Steve

  5. #35
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Uninstall Advanced SystemCare.
    Registry cleaners/optimizers are not recommended for several reasons:


    • Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

      The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
    • Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
    • Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
    • Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
    • The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".


    Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.





    You posted only half of FRST.txt log.
    Please post entire log.

  6. #36
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    Quote Originally Posted by Broni View Post
    Uninstall Advanced SystemCare.
    Registry cleaners/optimizers are not recommended for several reasons:


    • Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

      The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
    • Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
    • Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
    • Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
    • The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".


    Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.





    You posted only half of FRST.txt log.
    Please post entire log.
    I copied and pasted the whole thing. Will the log still be on the computer? I will do whatever you ask on Monday when I return to work.
    Steve

  7. #37
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Yes. It should be on your Desktop.

  8. #38
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    Broni is there a way I missed the second half of the FRST tex log? I copied and pasted the whole thing (I thought!)
    Steve

  9. #39
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    You won't know until you check

  10. #40
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    Broni, here it is again. I selected from top to bottom. Hopefully it is everything!!!!




    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 02
    Ran by Salina (administrator) on JOHNSMARTIN-PC on 05-09-2014 10:35:56
    Running from C:\Users\Salina\Downloads
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11
    Boot Mode: Normal

    The only official download link for FRST:
    Download link for 32-Bit version: http://www.bleepingcomputer.com/down...an-tool/dl/81/
    Download link for 64-Bit Version: http://www.bleepingcomputer.com/down...an-tool/dl/82/
    Download link from any site other than Bleeping Computer is unpermitted or outdated.
    See tutorial for FRST: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (IObit) C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe
    (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
    (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe
    (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    () C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
    (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
    () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    (Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe
    (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672152 2014-07-24] (Realtek Semiconductor)
    HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
    HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)
    HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1275608 2014-03-25] (COMODO)
    HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-14] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4144448 2010-11-10] (Dell, Inc.)
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
    HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
    HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421736 2012-03-27] (Apple Inc.)
    HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
    HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
    HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
    HKLM-x32\...\Run: [tvncontrol] => C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2327248 2014-07-25] (Comodo Security Solutions, Inc.)
    Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
    HKU\S-1-5-21-3913336790-2022505941-1720759447-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
    HKU\S-1-5-21-3913336790-2022505941-1720759447-1000\...\Run: [Advanced SystemCare 7] => C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
    ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start GeekBuddy.lnk
    ShortcutTarget: Start GeekBuddy.lnk -> C:\Program Files\COMODO\GeekBuddy\launcher.exe (Comodo Security Solutions, Inc.)
    ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
    BootExecute: autocheck autochk * SmartDefragBootTime.exe
    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
    StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
    BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
    BHO-x32: No Name -> {200F5C03-A4F0-A899-3AAD-C4F5AEA8470D} -> No File
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    BHO-x32: No Name -> {ACC780B0-906C-7AAD-64FF-51131513A55D} -> No File
    BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    BHO-x32: Advanced SystemCare Browser Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
    Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
    Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
    Tcpip\Parameters: [DhcpNameServer] 10.1.10.1
    Tcpip\..\Interfaces\{D94B12F3-6144-438C-8582-893D7A1E252C}: [NameServer] 156.154.70.22,156.154.71.22

    FireFox:
    ========
    FF ProfilePath: C:\Users\Salina\AppData\Roaming\Mozilla\Firefox\Profiles\ksgzcgc5.default-1405450587902
    FF Homepage: hxxp://xfinity.comcast.net/?cid=mtmh07152014
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin HKCU: @citrixonline.com/appdetectorplugin -> C:\Users\Salina\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
    FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Salina\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
    FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
    FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Salina\AppData\Roaming\Mozilla\Firefox\Profiles\ksgzcgc5.default-1405450587902\Extensions\ascsurfingprotection@iobit.com [2014-07-24]
    FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-10-21]
    FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

    Chrome:
    =======
    CHR HomePage: Default ->
    CHR Profile: C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-22]
    CHR Extension: (Google Drive) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-22]
    CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-24]
    CHR Extension: (YouTube) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-22]
    CHR Extension: (Google Search) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-22]
    CHR Extension: (Google Wallet) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22]
    CHR Extension: (Gmail) - C:\Users\Salina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-22]
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AdvancedSystemCareService7; C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
    R2 CLPSLauncher; C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe [70864 2014-07-25] (Comodo Security Solutions, Inc.)
    R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6817544 2014-04-16] (COMODO)
    S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2264280 2014-03-25] (COMODO)
    R2 CouponPrinterService; C:\Program Files (x86)\Coupons\CouponPrinterService.exe [177136 2014-04-28] (Coupons.com Inc.)
    S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-05-13] (WildTangent)
    R2 GeekBuddyRSP; C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2327248 2014-07-25] (Comodo Security Solutions, Inc.)
    R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
    S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
    R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
    R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
    S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
    S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
    Steve

  11. #41
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-09-05 10:36 - 2014-09-05 10:35 - 00019556 _____ () C:\Users\Salina\Downloads\FRST.txt
    2014-09-05 10:36 - 2014-09-05 10:35 - 00000000 ____D () C:\FRST
    2014-09-05 10:35 - 2014-09-05 10:34 - 02104832 _____ (Farbar) C:\Users\Salina\Downloads\FRST64.exe
    2014-09-05 10:32 - 2014-08-26 08:06 - 01474832 _____ () C:\Windows\system32\Drivers\sfi.dat
    2014-09-05 10:19 - 2014-09-05 10:19 - 00001398 _____ () C:\Users\Salina\Desktop\JRT.txt
    2014-09-05 10:13 - 2011-10-31 21:21 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3913336790-2022505941-1720759447-1000UA.job
    2014-09-05 10:13 - 2011-10-31 21:21 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3913336790-2022505941-1720759447-1000Core.job
    2014-09-05 10:05 - 2012-11-12 19:50 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-09-05 09:53 - 2014-06-23 09:48 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-09-05 09:50 - 2009-07-14 00:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-09-05 09:50 - 2009-07-14 00:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-09-05 09:46 - 2014-08-15 08:48 - 00000000 ____D () C:\Program Files (x86)\Coupons
    2014-09-05 09:46 - 2011-09-29 02:36 - 02036538 _____ () C:\Windows\WindowsUpdate.log
    2014-09-05 09:43 - 2011-09-29 02:54 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
    2014-09-05 09:42 - 2014-08-25 15:04 - 00002082 _____ () C:\Windows\setupact.log
    2014-09-05 09:42 - 2011-09-29 03:22 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
    2014-09-05 09:42 - 2011-09-29 03:22 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
    2014-09-05 09:42 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-09-05 09:39 - 2014-04-10 10:04 - 00000568 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3913336790-2022505941-1720759447-1000.job
    2014-09-05 09:31 - 2014-09-05 09:31 - 01016261 _____ (Thisisu) C:\Users\Salina\Downloads\JRT (1).exe
    2014-09-05 09:31 - 2014-09-05 09:31 - 00000000 ____D () C:\Windows\ERUNT
    2014-09-05 09:30 - 2014-09-05 09:30 - 01016261 _____ (Thisisu) C:\Users\Salina\Downloads\JRT.exe
    2014-09-05 09:24 - 2014-08-25 15:04 - 00711312 _____ () C:\Windows\PFRO.log
    2014-09-05 09:22 - 2014-09-05 09:07 - 00000000 ____D () C:\AdwCleaner
    2014-09-05 09:22 - 2011-11-26 14:46 - 00000000 ____D () C:\Users\Salina\AppData\Roaming\SoftGrid Client
    2014-09-05 09:07 - 2014-09-05 09:07 - 01370467 _____ () C:\Users\Salina\Downloads\adwcleaner_3.309 (7).exe
    2014-09-05 09:06 - 2014-09-05 09:06 - 01370467 _____ () C:\Users\Salina\Downloads\adwcleaner_3.309 (6).exe
    2014-09-05 09:04 - 2014-09-05 09:04 - 01370467 _____ () C:\Users\Salina\Downloads\adwcleaner_3.309 (5).exe
    2014-09-05 09:03 - 2014-09-05 09:02 - 01370467 _____ () C:\Users\Salina\Downloads\adwcleaner_3.309 (4).exe
    2014-09-05 09:01 - 2014-09-05 09:01 - 01370467 _____ () C:\Users\Salina\Downloads\adwcleaner_3.309 (3).exe
    2014-09-05 09:01 - 2014-09-05 09:01 - 01370467 _____ () C:\Users\Salina\Downloads\adwcleaner_3.309 (2).exe
    2014-09-05 08:59 - 2014-09-05 08:59 - 01370467 _____ () C:\Users\Salina\Downloads\adwcleaner_3.309 (1).exe
    2014-09-05 08:57 - 2014-09-05 08:57 - 01370467 _____ () C:\Users\Salina\Downloads\adwcleaner_3.309.exe
    2014-09-05 08:45 - 2014-09-05 08:45 - 00031112 _____ () C:\Users\Salina\Downloads\Customer Statement_JOHN S MARTIN CO INC (6).xlsx
    2014-09-05 08:36 - 2014-09-05 08:36 - 00000254 _____ () C:\Users\Salina\Downloads\Nextstep (1).txt
    2014-09-05 08:32 - 2014-09-03 09:12 - 00000000 ____D () C:\Users\Salina\Desktop\Logs2
    2014-09-05 08:16 - 2014-09-05 08:16 - 00034868 _____ () C:\ComboFix.txt
    2014-09-05 08:16 - 2014-09-04 07:57 - 00000000 ____D () C:\Qoobox
    2014-09-05 08:14 - 2014-09-04 07:56 - 00000000 ____D () C:\Windows\erdnt
    2014-09-05 08:14 - 2009-07-13 22:34 - 00000215 _____ () C:\Windows\system.ini
    2014-09-05 08:03 - 2014-07-24 07:39 - 00000000 ____D () C:\ProgramData\ProductData
    2014-09-05 07:42 - 2014-09-05 07:41 - 05576440 ____R (Swearware) C:\Users\Salina\Downloads\ComboFix.exe
    2014-09-05 07:39 - 2014-09-05 07:39 - 00000254 _____ () C:\Users\Salina\Downloads\Nextstep.txt
    2014-09-04 08:00 - 2014-07-24 07:37 - 00000000 ____D () C:\ProgramData\IObit
    2014-09-04 07:41 - 2014-09-04 07:41 - 05576326 ____R (Swearware) C:\Users\Salina\Desktop\ComboFix.exe
    2014-09-03 14:34 - 2013-05-22 09:07 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
    2014-09-03 12:16 - 2014-09-03 12:16 - 00000000 ____D () C:\Users\Salina\AppData\Local\CrashDumps
    2014-09-03 09:13 - 2014-08-25 16:15 - 00000000 ____D () C:\Users\Salina\Desktop\SYSTEM CLEANING UTILITIES
    2014-09-03 08:57 - 2014-09-03 08:24 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-09-03 08:57 - 2014-09-03 08:23 - 00000000 ____D () C:\Users\Salina\Desktop\mbar
    2014-09-03 08:23 - 2014-06-23 09:35 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-09-03 08:22 - 2014-09-03 08:22 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Salina\Downloads\mbar-1.07.0.1012.exe
    2014-09-03 08:21 - 2014-09-03 08:21 - 02958168 _____ (BoostSoftware Inc. ) C:\Users\Salina\Downloads\PCHealthBoost-Setup.exe
    2014-09-03 07:51 - 2009-07-14 01:13 - 00783424 _____ () C:\Windows\system32\PerfStringBackup.INI
    2014-09-03 07:50 - 2014-09-03 07:50 - 00033512 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
    2014-09-03 07:50 - 2014-09-03 07:50 - 00000000 ____D () C:\ProgramData\RogueKiller
    2014-09-02 16:01 - 2014-02-18 15:57 - 00000000 ____D () C:\Users\Salina\Desktop\Budget 2014-2015
    2014-08-28 12:20 - 2009-07-14 00:45 - 00410968 _____ () C:\Windows\system32\FNTCACHE.DAT
    2014-08-28 12:19 - 2014-08-25 13:23 - 00000000 ____D () C:\ProgramData\AVAST Software
    2014-08-28 11:21 - 2014-08-28 11:21 - 00031177 _____ () C:\Users\Salina\Downloads\Customer Statement_JOHN S MARTIN CO INC (5).xlsx
    2014-08-28 08:02 - 2014-08-27 08:19 - 00000000 ____D () C:\Users\Salina\AppData\Roaming\Lavasoft
    2014-08-28 07:57 - 2011-10-31 19:05 - 00001945 _____ () C:\Windows\epplauncher.mif
    2014-08-27 09:19 - 2014-08-27 09:19 - 00031245 _____ () C:\Users\Salina\Downloads\Customer Statement_JOHN S MARTIN CO INC (4).xlsx
    2014-08-27 08:53 - 2014-08-27 08:53 - 00688992 ____R (Swearware) C:\Users\Salina\Downloads\dds.com
    2014-08-26 14:51 - 2014-08-26 14:51 - 00000000 ____D () C:\Users\Salina\AppData\Roaming\LavasoftStatistics
    2014-08-26 14:50 - 2014-08-26 14:50 - 00000000 ____D () C:\Program Files\Lavasoft
    2014-08-26 14:48 - 2014-08-26 14:48 - 00000000 ____D () C:\ProgramData\Lavasoft
    2014-08-26 14:47 - 2014-08-26 14:47 - 01707144 _____ () C:\Users\Salina\Downloads\Adaware_Installer.exe
    2014-08-26 14:13 - 2014-08-26 14:13 - 00031170 _____ () C:\Users\Salina\Downloads\Customer Statement_JOHN S MARTIN CO INC (3).xlsx
    2014-08-26 09:29 - 2014-08-26 09:29 - 00001975 _____ () C:\Users\Public\Desktop\GeekBuddy.lnk
    2014-08-26 09:29 - 2014-08-26 08:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO
    2014-08-26 09:25 - 2014-04-10 10:05 - 00002723 _____ () C:\Users\Salina\Desktop\GoToMeeting Quick Connect.lnk
    2014-08-26 08:06 - 2014-08-26 08:06 - 00000000 ___SD () C:\ProgramData\Shared Space
    2014-08-26 08:06 - 2014-08-26 08:06 - 00000000 ____D () C:\Windows\System32\Tasks\COMODO
    2014-08-26 08:06 - 2014-08-26 08:02 - 00000000 ____D () C:\ProgramData\Comodo
    2014-08-26 08:06 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\HomeGroupUser$
    2014-08-26 08:06 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\Guest
    2014-08-26 08:06 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\Administrator
    2014-08-26 08:06 - 2011-11-01 14:39 - 00000000 ____D () C:\Users\Bronwin
    2014-08-26 08:05 - 2014-08-26 08:05 - 00000000 ____D () C:\ProgramData\Comodo Downloader
    2014-08-26 08:05 - 2014-08-26 08:05 - 00000000 ____D () C:\Program Files\COMODO
    2014-08-26 08:02 - 2014-08-26 08:01 - 230403208 _____ (COMODO) C:\Users\Salina\Downloads\cav_installer_3272_7b.exe
    2014-08-25 16:19 - 2014-08-25 16:19 - 00000000 ____D () C:\Users\Salina\Desktop\Dave's Stuff
    2014-08-25 15:04 - 2014-08-25 15:04 - 00000000 _____ () C:\Windows\setuperr.log
    2014-08-25 13:38 - 2014-08-25 13:38 - 00000000 _____ () C:\asc_rdflag
    2014-08-25 13:38 - 2014-07-25 07:29 - 78540800 _____ () C:\Windows\system32\config\SOFTWARE.iodefrag.bak
    2014-08-25 13:38 - 2014-07-25 07:29 - 00868352 _____ () C:\Windows\system32\config\DEFAULT.iodefrag.bak
    2014-08-25 13:38 - 2014-07-25 07:29 - 00098304 _____ () C:\Windows\system32\config\SAM.iodefrag.bak
    2014-08-25 13:38 - 2014-07-25 07:29 - 00024576 _____ () C:\Windows\system32\config\SECURITY.iodefrag.bak
    2014-08-25 13:38 - 2011-10-31 16:47 - 00000000 ____D () C:\Users\Salina
    2014-08-25 13:23 - 2014-08-25 13:22 - 04862664 _____ (AVAST Software) C:\Users\Salina\Downloads\avast_free_antivirus_setup_online.exe
    2014-08-22 22:07 - 2014-08-28 07:51 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2014-08-22 21:45 - 2014-08-28 07:51 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
    2014-08-22 20:59 - 2014-08-28 07:51 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-08-22 16:54 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
    2014-08-22 16:11 - 2009-07-14 01:37 - 00000000 ____D () C:\Windows\DigitalLocker
    2014-08-22 13:28 - 2014-04-10 10:04 - 00003608 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3913336790-2022505941-1720759447-1000
    2014-08-22 11:22 - 2013-10-21 11:08 - 00164247 _____ () C:\Windows\hppins20.dat
    2014-08-22 11:22 - 2013-10-21 10:23 - 00007408 _____ () C:\ProgramData\hpzinstall.log
    2014-08-21 15:21 - 2014-08-21 15:21 - 00001316 _____ () C:\Users\Salina\Downloads\MyDefrag.dat
    2014-08-21 15:21 - 2014-08-21 15:21 - 00000591 _____ () C:\Users\Salina\Downloads\MyDefrag.debuglog
    2014-08-21 15:20 - 2011-02-10 10:02 - 00000000 ____D () C:\Windows\panther
    2014-08-21 15:18 - 2014-08-21 15:18 - 00003028 _____ () C:\Windows\System32\Tasks\SlimCleaner Run
    2014-08-21 15:18 - 2014-08-21 15:18 - 00000000 ____D () C:\Users\Salina\AppData\Local\SlimWare Utilities Inc
    2014-08-21 15:18 - 2014-08-21 15:18 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
    2014-08-21 15:18 - 2014-08-21 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimCleaner
    2014-08-21 15:18 - 2014-08-21 15:18 - 00000000 ____D () C:\Program Files (x86)\SlimCleaner
    2014-08-21 15:17 - 2014-08-21 15:17 - 00801088 _____ (SlimWare Utilities, Inc.) C:\Users\Salina\Downloads\SlimCleaner-setup.exe
    2014-08-21 14:14 - 2014-08-21 14:13 - 00000000 ____D () C:\ProgramData\c6bd839095d3eda2
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000258 __RSH () C:\ProgramData\ntuser.pol
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\Salina\AppData\Local\Packages
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\Salina\AppData\Local\Comodo
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
    2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
    2014-08-21 14:13 - 2014-04-22 10:08 - 00000000 ____D () C:\Users\Salina\AppData\Local\Google
    2014-08-21 14:13 - 2014-04-22 10:08 - 00000000 ____D () C:\Program Files (x86)\Google
    2014-08-21 14:13 - 2009-07-13 23:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
    2014-08-21 14:13 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
    2014-08-19 09:02 - 2014-08-19 09:02 - 00000000 ____D () C:\Windows\CD95F661A5C444F5A6AAECDD91C240E3.TMP
    2014-08-19 09:02 - 2014-08-19 09:02 - 00000000 ____D () C:\Program Files\File Association Helper
    2014-08-19 09:01 - 2014-08-19 09:01 - 00860096 _____ ( ) C:\Users\Salina\Downloads\winzip18-home.exe
    2014-08-19 09:00 - 2014-07-24 10:41 - 00000000 ____D () C:\Users\Salina\AppData\Local\WinZip
    2014-08-19 08:07 - 2013-10-18 14:14 - 00000000 ____D () C:\Users\Salina\Documents\Lynn District Court
    2014-08-18 09:02 - 2014-08-18 09:02 - 00000000 ____D () C:\Users\Salina\AppData\Local\Adobe
    2014-08-18 08:02 - 2012-11-12 19:50 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2014-08-18 08:01 - 2012-11-12 19:50 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2014-08-18 08:01 - 2011-09-29 02:37 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2014-08-15 13:03 - 2014-04-22 10:08 - 00002185 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2014-08-15 08:48 - 2014-08-15 08:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
    2014-08-15 08:47 - 2014-08-15 08:47 - 02027336 _____ (Coupons.com Incorporated) C:\Users\Salina\Downloads\couponprinter.exe
    2014-08-14 07:34 - 2013-10-28 14:05 - 00000000 ____D () C:\Users\Salina\AppData\Roaming\HpUpdate
    2014-08-13 12:45 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
    2014-08-13 12:09 - 2013-10-18 14:56 - 00000000 ____D () C:\Windows\system32\MRT
    2014-08-13 12:07 - 2012-03-25 14:23 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2014-08-13 12:01 - 2014-05-06 12:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
    2014-08-07 07:39 - 2013-10-21 11:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
    2014-08-06 22:06 - 2014-08-13 07:43 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
    2014-08-06 22:01 - 2014-08-13 07:43 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2014-08-06 10:01 - 2013-12-12 11:51 - 00000000 ____D () C:\Users\Salina\Desktop\John S Martin
    2014-08-06 08:51 - 2014-08-06 08:51 - 00005078 _____ () C:\Users\Salina\Downloads\Customer Statement_JOHN S MARTIN CO INC (2).xlsx
    2014-08-06 07:56 - 2013-10-21 11:08 - 00000000 ____D () C:\ProgramData\HP
    2014-08-06 07:55 - 2014-08-06 07:55 - 06674824 _____ () C:\Users\Salina\Downloads\HPPSdr(1).exe
    2014-08-06 07:55 - 2014-08-06 07:55 - 00002010 _____ () C:\Users\Public\Desktop\HP Print and Scan Doctor.lnk
    2014-08-06 07:55 - 2013-10-21 11:09 - 00000000 ____D () C:\Program Files (x86)\HP
    2014-08-06 07:54 - 2014-08-06 07:54 - 06674824 _____ () C:\Users\Salina\Downloads\HPPSdr.exe

    Some content of TEMP:
    ====================
    C:\Users\Salina\AppData\Local\Temp\Quarantine.exe


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-08-29 09:09

    ==================== End Of Log ============================
    Steve

  12. #42
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Very good

    Uninstall Advanced SystemCare.
    Registry cleaners/optimizers are not recommended for several reasons:


    • Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

      The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
    • Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
    • Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
    • Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
    • The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".


    Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.





    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
    Attached Files Attached Files
    Last edited by Broni; September 8th, 2014 at 08:54 PM.

  13. #43
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    I have already uninstalled Advanced System Care. I will complete the next step tomorrow Broni.
    Steve

  14. #44
    Join Date
    Feb 2003
    Location
    Massachusetts
    Posts
    607
    I couldn't find FRST (program) on my computer so I went to the link again and clicked download the file. It didn't give me an option to save it so I clicked on Fix and ran it. I am sending you the fixlist.txt file. Hopefully this won't be a problem. Steve


    HKLM-x32\...\Run: [] => [X]
    ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
    BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
    BHO-x32: No Name -> {200F5C03-A4F0-A899-3AAD-C4F5AEA8470D} -> No File
    BHO-x32: No Name -> {ACC780B0-906C-7AAD-64FF-51131513A55D} -> No File
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
    Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
    S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
    S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    C:\Users\Salina\AppData\Local\Temp\Quarantine.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe
    C:\Program Files (x86)\IObit\Advanced SystemCare 7
    HKU\S-1-5-21-3913336790-2022505941-1720759447-1000\...\Run: [Advanced SystemCare 7] => C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
    BHO-x32: Advanced SystemCare Browser Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
    FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Salina\AppData\Roaming\Mozilla\Firefox\Profiles\ksgzcgc5.default-1405450587902\Extensions\ascsurfingprotection@iobit.com [2014-07-24]
    R2 AdvancedSystemCareService7; C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
    Steve

  15. #45
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    You just posted my script.
    Re-read my instructions and redo.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •