[RESOLVED] Need check up, computer showing multiple processes slowing down the system - Page 2
Page 2 of 3 FirstFirst 123 LastLast
Results 16 to 30 of 37

Thread: [RESOLVED] Need check up, computer showing multiple processes slowing down the system

  1. May 6th, 2017, 09:07 PM #16
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    OK ....
    My Home Page
    Reply With Quote Reply With Quote
  2. May 6th, 2017, 10:43 PM #17
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    Still unable to paste the logs from RK, MBAM and Adw scans, keep getting directed to "Something Went Wrong" page.

    They're attached instead, sorry about that.
    Attached Files Attached Files
    Reply With Quote Reply With Quote
  3. May 6th, 2017, 11:01 PM #18
    Train
    Train is offline Friend of Site Staff
    Join Date
    Apr 2000
    Location
    Sheboygan, WI
    Posts
    53,392
    # AdwCleaner v6.046 - Logfile created 06/05/2017 at 19:30:04
    # Updated on 24/04/2017 by Malwarebytes
    # Database : 2017-05-05.1 [Server]
    # Operating System : Windows 10 Pro (X64)
    # Username : admin - ADMIN-PC
    # Running from : C:\Users\admin\Desktop\adwcleaner_6.046.exe
    # Mode: Clean
    # Support : https://www.malwarebytes.com/support



    ***** [ Services ] *****

    [-] Service deleted: swdumon


    ***** [ Folders ] *****

    [-] Folder deleted: C:\Users\Public\Documents\Downloaded Installers
    [-] Folder deleted: C:\Program Files (x86)\Common Files\freemake shared
    [-] Folder deleted: C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\YSearchUtil
    [-] Folder deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlmebkoiahbppacaicbgncnjhbpdfkcc


    ***** [ Files ] *****

    [-] File deleted: C:\WINDOWS\SysNative\drivers\swdumon.sys
    [!] File not deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_dlmebkoiahbppacaicbgncnjhbpdfkcc_0.localstorage


    ***** [ DLL ] *****



    ***** [ WMI ] *****



    ***** [ Shortcuts ] *****



    ***** [ Scheduled Tasks ] *****



    ***** [ Registry ] *****

    [-] Key deleted: HKLM\SOFTWARE\Classes\HCDNProxy
    [#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\HCDNProxy
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{138F4260-66CA-4F7C-812F-C6EED99B7EC7}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{790F2D3B-18EE-40E2-A45E-1FAC13B6AFB8}
    [-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
    [-] Key deleted: HKU\S-1-5-21-2848961991-288533299-670403562-1000\Software\QiYi
    [-] Key deleted: HKU\S-1-5-21-2848961991-288533299-670403562-1000\Software\SlimWare Utilities Inc
    [-] Key deleted: HKU\S-1-5-21-2848961991-288533299-670403562-1000\Software\PPTAssist
    [-] Key deleted: HKU\S-1-5-21-2848961991-288533299-670403562-1000\Software\Link64
    [-] Key deleted: HKU\S-1-5-21-2848961991-288533299-670403562-1000\Software\AppDataLow\Software\QiYi
    [#] Key deleted on reboot: HKCU\Software\QiYi
    [#] Key deleted on reboot: HKCU\Software\SlimWare Utilities Inc
    [#] Key deleted on reboot: HKCU\Software\PPTAssist
    [#] Key deleted on reboot: HKCU\Software\Link64
    [#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\QiYi
    [-] Key deleted: HKLM\SOFTWARE\SLIMWARE UTILITIES, INC.
    [-] Key deleted: HKLM\SOFTWARE\SlimWare Utilities Inc
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet
    [#] Key deleted on reboot: [x64] HKCU\Software\QiYi
    [#] Key deleted on reboot: [x64] HKCU\Software\SlimWare Utilities Inc
    [#] Key deleted on reboot: [x64] HKCU\Software\PPTAssist
    [#] Key deleted on reboot: [x64] HKCU\Software\Link64
    [#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\QiYi
    [-] Value deleted: HKU\S-1-5-21-2848961991-288533299-670403562-1000\Software\Microsoft\Windows\CurrentVersion\Run [VideoDownloaderUltimate]
    [-] Value deleted: HKU\S-1-5-21-2848961991-288533299-670403562-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [VideoDownloaderUltimate]
    [#] Value deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [VideoDownloaderUltimate]
    [#] Value deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Run [VideoDownloaderUltimate]


    ***** [ Web browsers ] *****

    [-] [C:\Users\admin\AppData\Local\Chromium\User Data\Default\Web data] [Search Provider] Deleted: yahoo! powered
    [-] [C:\Users\admin\AppData\Local\Chromium\User Data\Default] [startup_urls] Deleted: hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_16_29&param1=1&param2=f%3D7%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDtB0F0E0E0DyDzztCyCyEzy0F0A0CtCtN0D0Tzu0StCyCyCtBtN1L2XzutAtFtBtAtFtCtFtAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0AtDyB0C0ByC0CtGtB0CyEtBtG0Bzy0AyEtGyDzzzztBtG0C0Azz0EyByByByB0BtD0C0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0BtAzy0FtAyDyBtGtBtA0B0FtGyEyBtCtAtGzy0FtAyBtG0DtAtD0CtDtDzzyCtA0B0EyE2QtN0A0LzuyE%26cr%3D1216353858%26a%3Dwcg_fremkfs_16_29%26os_ver%3D10.0%26os%3DWindows%2B10%2BPro&uref=chmm
    [-] [C:\Users\admin\AppData\Local\Chromium\User Data\Default] [extension] Deleted: pilplloabdedfmialnfchjomjmpjcoej
    [-] [C:\Users\admin\AppData\Local\Chromium\User Data\Default] [homepage] Deleted: hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_16_29&param1=1&param2=f%3D1%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDtB0F0E0E0DyDzztCyCyEzy0F0A0CtCtN0D0Tzu0StCyCyCtBtN1L2XzutAtFtBtAtFtCtFtAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0AtDyB0C0ByC0CtGtB0CyEtBtG0Bzy0AyEtGyDzzzztBtG0C0Azz0EyByByByB0BtD0C0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0BtAzy0FtAyDyBtGtBtA0B0FtGyEyBtCtAtGzy0FtAyBtG0DtAtD0CtDtDzzyCtA0B0EyE2QtN0A0LzuyE%26cr%3D1216353858%26a%3Dwcg_fremkfs_16_29%26os_ver%3D10.0%26os%3DWindows%2B10%2BPro&uref=chmm
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [startup_urls] Deleted: hxxp://search.conduit.com/?gd=&ctid=CT3325805&octid=EB_ORIGINAL_CTID&ISID=M96653B90-C956-45BB-9D6C-2EB7BD0DB52A&SearchSource=55&CUI=&UM=5&UP=SP568F8D5A-E817-4A49-A1F7-39507AE65515&SSPV=
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [startup_urls] Deleted: hxxp://www.default-search.net?sid=492&aid=100&itype=n&ver=12283&tm=336&src=hmp
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [startup_urls] Deleted: hxxp://www.default-search.net?sid=492&aid=100&itype=a&ver=12521&tm=336&src=hmp
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [startup_urls] Deleted: hxxp://start.mysearchdial.com/?f=1&a=cmi_14_18_ch&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0SzzyDyEtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCyE0E0D0CyE0A0DtGyE0E0F0CtGyC0DtA0AtGtAyCyBtCtGtAtB0EyC0BzytC0BtA0D0AyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzzyE0ByD0B0EtG0ByCzz0BtGtD0DyByDtGtB0EyCtAtGtDyCyDzztCtAzy0CtC0DyB0A2Q&cr=179754203&ir=
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [startup_urls] Deleted: hxxp://binkiland.com/?f=7&a=bnk_ir_15_07&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0StCtCtAzytN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StByEtBtCyDtDtC0BtGzzyD0AzytGtCyD0A0AtG0Czz0A0AtGtBzzyByDzztD0AzyyC0B0EyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0F0E0CyEtBtB0FtGtDyEtByCtGyEyByD0FtGzyyCzztAtG0A0A0A0EyC0D0CyD0Fzy0AtA2Q&cr=536959978&ir=
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [startup_urls] Deleted: hxxp://binkiland.com/?f=7&a=bnk_ir_15_07&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0StCtCtAzytN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0CtAyByByEtDtGzy0E0A0DtGzzyE0CtAtGyC0DyC0BtGtCtCyE0AtBtC0F0EtB0F0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CtA0AtCyE0B0EtGzz0F0EyDtGyE0B0F0DtG0AtDyB0CtGyBzytDtD0EyCzytCzyyEyCtD2Q&cr=1668793059&ir=
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [startup_urls] Deleted: hxxp://www.palikan.com/?f=7&a=plk_coinisrs_15_43&cd=2XzuyEtN2Y1L1QzuyDtBtC0A0CyD0FtB0DyDtDyE0EyE0ByCtN0D0Tzu0StCtAzytAtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyBtCtB0D0ByDyC0AtGyEzzyEyDtGyB0BtCyDtGyB0BtDtBtGzytD0CtAyCtA0DyCtByD0DyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtA0A0EtC0A0DzytGzy0DzyyBtGyEzztC0BtGzz0D0DtDtGtBzyyD0ByB0DtBtB0EyBzztC2QtN0A0LzuyE&cr=362974482&ir=
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ceopoaldcnmhechacafgagdkklcogkgd
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: dlmebkoiahbppacaicbgncnjhbpdfkcc
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: mallpejgeafdahhflmliiahjdpgbegpk
    [-] [C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: pilplloabdedfmialnfchjomjmpjcoej
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default\Web data] [Search Provider] Deleted: yahoo.com
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default\Web data] [Search Provider] Deleted: aol.com
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default\Web data] [Search Provider] Deleted: ask.com
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default\Web data] [Search Provider] Deleted: ask.com_
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default\Web data] [Search Provider] Deleted: binkiland.com
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default\Web data] [Search Provider] Deleted: conduit.search
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default\Web data] [Search Provider] Deleted: default-search.net
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default\Web data] [Search Provider] Deleted: mysearchdial.com
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default] [startup_urls] Deleted: hxxp://search.conduit.com/?gd=&ctid=CT3325805&octid=EB_ORIGINAL_CTID&ISID=M96653B90-C956-45BB-9D6C-2EB7BD0DB52A&SearchSource=55&CUI=&UM=5&UP=SP568F8D5A-E817-4A49-A1F7-39507AE65515&SSPV=
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default] [startup_urls] Deleted: hxxp://www.default-search.net?sid=492&aid=100&itype=n&ver=12283&tm=336&src=hmp
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default] [startup_urls] Deleted: hxxp://www.default-search.net?sid=492&aid=100&itype=a&ver=12521&tm=336&src=hmp
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default] [startup_urls] Deleted: hxxp://start.mysearchdial.com/?f=1&a=cmi_14_18_ch&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0SzzyDyEtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCyE0E0D0CyE0A0DtGyE0E0F0CtGyC0DtA0AtGtAyCyBtCtGtAtB0EyC0BzytC0BtA0D0AyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzzyE0ByD0B0EtG0ByCzz0BtGtD0DyByDtGtB0EyCtAtGtDyCyDzztCtAzy0CtC0DyB0A2Q&cr=179754203&ir=
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default] [startup_urls] Deleted: hxxp://binkiland.com/?f=7&a=bnk_ir_15_07&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0StCtCtAzytN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StByEtBtCyDtDtC0BtGzzyD0AzytGtCyD0A0AtG0Czz0A0AtGtBzzyByDzztD0AzyyC0B0EyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0F0E0CyEtBtB0FtGtDyEtByCtGyEyByD0FtGzyyCzztAtG0A0A0A0EyC0D0CyD0Fzy0AtA2Q&cr=536959978&ir=
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default] [startup_urls] Deleted: hxxp://binkiland.com/?f=7&a=bnk_ir_15_07&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0StCtCtAzytN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0CtAyByByEtDtGzy0E0A0DtGzzyE0CtAtGyC0DyC0BtGtCtCyE0AtBtC0F0EtB0F0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CtA0AtCyE0B0EtGzz0F0EyDtGyE0B0F0DtG0AtDyB0CtGyBzytDtD0EyCzytCzyyEyCtD2Q&cr=1668793059&ir=
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default] [startup_urls] Deleted: hxxp://www.palikan.com/?f=7&a=plk_coinisrs_15_43&cd=2XzuyEtN2Y1L1QzuyDtBtC0A0CyD0FtB0DyDtDyE0EyE0ByCtN0D0Tzu0StCtAzytAtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyBtCtB0D0ByDyC0AtGyEzzyEyDtGyB0BtCyDtGyB0BtDtBtGzytD0CtAyCtA0DyCtByD0DyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtA0A0EtC0A0DzytGzy0DzyyBtGyEzztC0BtGzz0D0DtDtGtBzyyD0ByB0DtBtB0EyBzztC2QtN0A0LzuyE&cr=362974482&ir=
    [-] [C:\Users\admin\AppData\Local\Comodo\Chromodo\User Data\Default] [extension] Deleted: dlmebkoiahbppacaicbgncnjhbpdfkcc


    *************************

    :: "Tracing" keys deleted
    :: Winsock settings cleared

    *************************

    C:\AdwCleaner\AdwCleaner[C0].txt - [11756 Bytes] - [06/05/2017 19:30:04]
    C:\AdwCleaner\AdwCleaner[S0].txt - [8873 Bytes] - [06/05/2017 19:18:10]

    ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [11903 Bytes] ##########
    Reply With Quote Reply With Quote
  4. May 7th, 2017, 02:33 PM #19
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    JRT scan log:

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.1.3 (04.10.2017)
    Operating System: Windows 10 Pro x64
    Ran by admin (Administrator) on Sun 05/07/2017 at 11:07:11.03
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 4

    Successfully deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ceopoaldcnmhechacafgagdkklcogkgd (Folder)
    Successfully deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mallpejgeafdahhflmliiahjdpgbegpk (Folder)
    Successfully deleted: C:\Users\admin\AppData\Roaming\nico mak computing (Folder)
    Successfully deleted: C:\WINDOWS\wininit.ini (File)



    Registry: 1

    Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57 (Registry Value)




    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Sun 05/07/2017 at 11:17:31.33
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Reply With Quote Reply With Quote
  5. May 7th, 2017, 07:12 PM #20
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.


    • Double click to run it.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
    My Home Page
    Reply With Quote Reply With Quote
  6. May 7th, 2017, 08:15 PM #21
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    FRST scan, post 1:

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 07-05-2017
    Ran by admin (administrator) on ADMIN-PC (07-05-2017 16:54:09)
    Running from C:\Users\admin\Desktop\Bin\Farbar April 2017
    Loaded Profiles: admin (Available Profiles: admin)
    Platform: Windows 10 Pro Version 1607 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    (Intel Corporation) C:\Windows\System32\igfxCUIService.exe
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (COMODO) C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\ns.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\ns.exe
    (Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17032.10341.0_x64__8wekyb3d8bbwe\Video.UI.exe
    () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1703.601.0_x64__8wekyb3d8bbwe\Calculator.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\System32\smartscreen.exe
    (Microsoft Corporation) C:\Windows\splwow64.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1487552 2017-04-22] (COMODO)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-02-22] (Apple Inc.)
    HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
    HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [529480 2016-02-23] (Autodesk Inc.)
    HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
    HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
    HKLM-x32\...\Run: [IseUI] => C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe [3386576 2017-04-06] (COMODO)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-03-15] (Oracle Corporation)
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9532120 2017-04-10] (Piriform Ltd)
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Run: [Akamai NetSession Interface] => C:\Users\admin\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Run: [Spotify] => C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe [7089776 2017-04-02] (Spotify Ltd)
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1336320 2015-11-25] (Autodesk, Inc.)
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Run: [Spotify Web Helper] => C:\Users\admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-04-02] (Spotify Ltd)
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Run: [Chromium] => c:\users\admin\appdata\local\chromium\application\chrome.exe [1068544 2016-07-20] (The Chromium Authors)
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Run: [AfterPlayMonitor] => C:\Users\admin\AppData\Roaming\Letv\AfterPlay\AfterPlayMonitor.ex
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Run: [HP ENVY 5660 series (NET)] => C:\Program Files\HP\HP ENVY 5660 series\Bin\ScanToPCActivationApp.exe [3770504 2017-02-23] (HP Inc.)
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\...\Policies\Explorer: []
    HKU\S-1-5-21-2848961991-288533299-670403562-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\PhotoScreensaver.scr [572416 2017-03-15] (Microsoft Corporation)
    Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
    ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation)
    ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation)
    ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation)
    ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\WINDOWS\system32\AcSignIcon.dll [2015-02-05] (Autodesk, Inc.)
    ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security\Engine32\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation)
    ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security\Engine32\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation)
    ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security\Engine32\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-04-09]
    ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.523\SSScheduler.exe (McAfee, Inc.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Notifier.lnk [2017-03-19]
    ShortcutTarget: Update Notifier.lnk -> C:\Program Files\WinZip\WZUpdateNotifier.exe (WinZip)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2017-03-19]
    ShortcutTarget: WinZip Preloader.lnk -> C:\Program Files\WinZip\WzPreloader.exe (WinZip Computing, S.L.)
    GroupPolicy: Restriction <======= ATTENTION
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Hosts: 0.0.0.1 mssplus.mcafee.com
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{849236a3-4436-416b-8cc7-6346b7bd62e3}: [DhcpNameServer] 172.20.10.1
    Tcpip\..\Interfaces\{dccd4302-edb2-4e7e-a0a5-bb1247f5ea22}: [NameServer] 156.154.70.22,156.154.71.22
    Tcpip\..\Interfaces\{dccd4302-edb2-4e7e-a0a5-bb1247f5ea22}: [DhcpNameServer] 192.168.1.254
    Tcpip\..\Interfaces\{e0b04b34-ac65-4d27-8d1e-6a5cbde805b0}: [NameServer] 156.154.70.22,156.154.71.22
    Tcpip\..\Interfaces\{e0b04b34-ac65-4d27-8d1e-6a5cbde805b0}: [DhcpNameServer] 192.168.1.254

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-2848961991-288533299-670403562-1000 -> DefaultScope {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxp://us.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo&type=33010001005_10.0.1.6209_u_ds
    SearchScopes: HKU\S-1-5-21-2848961991-288533299-670403562-1000 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxp://us.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo&type=33010001005_10.0.1.6209_u_ds
    BHO: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-04-26] (Intel Security)
    BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-04-26] (Intel Security)
    BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-04-25] (Oracle Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-25] (Oracle Corporation)
    Toolbar: HKLM - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-04-26] (Intel Security)
    Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-04-26] (Intel Security)
    Toolbar: HKU\S-1-5-21-2848961991-288533299-670403562-1000 -> True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-04-26] (Intel Security)

    FireFox:
    ========
    FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.5.4.24\coFFAddon
    FF Extension: (Norton Security Toolbar) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.5.4.24\coFFAddon [2017-04-12]
    FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.5.4.24\coFFAddon
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
    FF Plugin-x32: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll [2017-04-25] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll [2017-04-25] (Oracle Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
    FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-2848961991-288533299-670403562-1000: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\Users\admin\AppData\Roaming\Visan\plugins\npRLSecurePluginLayer.dll [2011-05-13] (RocketLife, LLP)
    FF Plugin HKU\S-1-5-21-2848961991-288533299-670403562-1000: none.com/Base -> C:\Program Files (x86)\Letv\npBase.dll [No File]

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://www.google.com/
    CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3325805&octid=EB_ORIGINAL_CTID&ISID=M96653B90-C956-45BB-9D6C-2EB7BD0DB52A&SearchSource=55&CUI=&UM=5&UP=SP568F8D5A-E817-4A49-A1F7-39507AE65515&SSPV=","hxxp://www.default-search.net?sid=492&aid=100&itype=n&ver=12283&tm=336&src=hmp","hxxp://www.default-search.net?sid=492&aid=100&itype=a&ver=12521&tm=336&src=hmp","hxxp://start.mysearchdial.com/?f=1&a=cmi_14_18_ch&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0SzzyDyEtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCyE0E0D0CyE0A0DtGyE0E0F0CtGyC0DtA0AtGtAyCyBtCtGtAtB0EyC0BzytC0BtA0D0AyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzzyE0ByD0B0EtG0ByCzz0BtGtD0DyByDtGtB0EyCtAtGtDyCyDzztCtAzy0CtC0DyB0A2Q&cr=179754203&ir=","hxxp://binkiland.com/?f=7&a=bnk_ir_15_07&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0StCtCtAzytN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StByEtBtCyDtDtC0BtGzzyD0AzytGtCyD0A0AtG0Czz0A0AtGtBzzyByDzztD0AzyyC0B0EyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0F0E0CyEtBtB0FtGtDyEtByCtGyEyByD0FtGzyyCzztAtG0A0A0A0EyC0D0CyD0Fzy0AtA2Q&cr=536959978&ir=","hxxp://binkiland.com/?f=7&a=bnk_ir_15_07&cd=2XzuyEtN2Y1L1QzuyEyEtAyB0EyC0ByByEyBtCyD0F0A0CtCtN0D0Tzu0StCtCtAzytN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0CtAyByByEtDtGzy0E0A0DtGzzyE0CtAtGyC0DyC0BtGtCtCyE0AtBtC0F0EtB0F0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CtA0AtCyE0B0EtGzz0F0EyDtGyE0B0F0DtG0AtDyB0CtGyBzytDtD0EyCzytCzyyEyCtD2Q&cr=1668793059&ir=","hxxp://www.palikan.com/?f=7&a=plk_coinisrs_15_43&cd=2XzuyEtN2Y1L1QzuyDtBtC0A0CyD0FtB0DyDtDyE0EyE0ByCtN0D0Tzu0StCtAzytAtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyBtCtB0D0ByDyC0AtGyEzzyEyDtGyB0BtCyDtGyB0BtDtBtGzytD0CtAyCtA0DyCtByD0DyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtA0A0EtC0A0DzytGzy0DzyyBtGyEzztC0BtGzz0D0DtDtGtBzyyD0ByB0DtBtB0EyBzztC2QtN0A0LzuyE&cr=362974482&ir=","hxxp://www.google.com"
    CHR NewTab: Default -> Not-active:"chrome-extension://elmkjjfkkchohaaoljobaffjeedcoocj/ntab.html", Not-active:"chrome-extension://bbiebkacgojhhljmeblnnhhnjdbengga/stubby.html", Not-active:"chrome-extension://lpbfeldcjoeabmdagfbkjfhklppdggjc/newtab/blank.html", Not-active:"chrome-extension://jhpokfhcmoiblfaemmafjgnllflfapmg/newtab/blank.html"
    CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=dss_yset_chr__PARAM__
    CHR DefaultSearchKeyword: Default -> Yahoo
    CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
    CHR Profile: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default [2017-05-07]
    CHR Extension: (Google Slides) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-11]
    CHR Extension: (Floorplanner) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag [2015-12-27]
    CHR Extension: (Yahoo Web) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\acjpdakpjonkfmggcmanlhdakfkhloii [2016-01-28]
    CHR Extension: (Sudoku) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agdhembpgcpfegeigidembjopfhghnpj [2015-11-11]
    CHR Extension: (BIODIGITAL HUMAN) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agoenciogemlojlhccbcpcfflicgnaak [2015-11-11]
    CHR Extension: (Google Docs) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-11]
    CHR Extension: (Google Drive) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-11]
    CHR Extension: (Yahoo Partner) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhfhojbhbnajajgihpicejdalbjlpcep [2016-09-05]
    CHR Extension: (WOT: Web of Trust, Website Reputation Ratings) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2017-03-02]
    CHR Extension: (YouTube) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-11]
    CHR Extension: (FVD Suggestions) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\caoielngcdpgeldnckhponffkiajaobo [2016-08-10]
    CHR Extension: (Save to Wanelo) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccdkmknpnokbpbmfohfjejmjipomenmb [2015-11-11]
    CHR Extension: (Google Search) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-11]
    CHR Extension: (Tampermonkey) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2016-12-15]
    CHR Extension: (Savings Button: Deals + Cash Back) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlmebkoiahbppacaicbgncnjhbpdfkcc [2017-05-06]
    CHR Extension: (hTab) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj [2017-04-04]
    CHR Extension: (Blur) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\epanfjkfahimkgomnigadpkobaefekcd [2017-04-18]
    CHR Extension: (Google Sheets) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-11]
    CHR Extension: (iCloud Bookmarks) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkepacicchenbjecpbpbclokcabebhah [2016-10-30]
    CHR Extension: (Google Docs Offline) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-14]
    CHR Extension: (Click&Clean) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod [2017-04-29]
    CHR Extension: (Dictionary by Dictionary.com) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gikhgcaliglmioibbockkmjknfnepbdh [2015-11-11]
    CHR Extension: (360 Internet Protection) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\glcimepnljoholdmjchkloafkggfoijh [2017-01-09]
    CHR Extension: (Pinterest Save Button) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2017-04-23]
    CHR Extension: (Kindle Cloud Reader) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdipabjmbhpdkjaihfjoikhjjeneebd [2015-12-25]
    CHR Extension: (SMS from Gmail ™ & Facebook™ (MightyText)) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iffdacemhfpnchinokehhnppllonacfj [2017-04-28]
    CHR Extension: (Dropbox) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl [2015-11-11]
    CHR Extension: (VLCApp for Chrome) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhpokfhcmoiblfaemmafjgnllflfapmg [2016-08-24]
    CHR Extension: (Grammarly for Chrome) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2017-05-05]
    CHR Extension: (Forest: stay focused, be present) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjacjjdnoddnpbbcjilcajfhhbdhkpgk [2017-03-22]
    CHR Extension: (Web Whiteboard) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhmonflnoepbijmbbfipoifgkbibofgd [2015-11-11]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
    CHR Extension: (Rollip - Photo Effects) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ooikhmcdpofogemaldinihdhidaokcmp [2015-11-11]
    CHR Extension: (Tv Online) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcfeebemepipakkhapnhljbcdkagkloh [2015-11-11]
    CHR Extension: (Click&Clean App) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp [2017-04-01]
    CHR Extension: (Gmail) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-11]
    CHR Extension: (Chrome Media Router) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-25]
    CHR Extension: (Cool Metronome) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\polmfiinlikaadclgdojekfaoglellgm [2015-11-11]
    CHR Profile: C:\Users\admin\AppData\Local\Google\Chrome\User Data\System Profile [2017-05-07]
    CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\Exts\Chrome.crx [2017-03-27]
    CHR HKLM\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
    CHR HKU\S-1-5-21-2848961991-288533299-670403562-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [bhfhojbhbnajajgihpicejdalbjlpcep] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\Exts\Chrome.crx [2017-03-27]
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [1145928 2016-02-23] (Autodesk Inc.)
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-02-22] (Apple Inc.)
    S2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [31160 2015-02-05] (Autodesk, Inc.)
    R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [10512032 2017-04-22] (COMODO)
    S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2876096 2017-04-22] (COMODO)
    S2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2016-11-02] (Ellora Assets Corp.) [File not signed]
    R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [33640 2017-04-07] (HP Inc.)
    R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-09-24] (Intel Corporation)
    R2 isesrv; C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe [118480 2017-04-06] (COMODO)
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
    S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.523\McCHSvc.exe [404376 2017-03-19] (McAfee, Inc.)
    R2 NS; C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\NS.exe [326160 2017-03-16] (Symantec Corporation)
    S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-29] (Microsoft Corporation)
    S2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [996736 2017-04-18] (McAfee, Inc.)
    S2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16160 2017-04-18] (McAfee, Inc.)
    S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86776 2017-04-18] (McAfee, Inc.)
    S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2017-03-27] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2017-03-27] (Microsoft Corporation)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R1 BHDrvx64; C:\Program Files (x86)\Norton Security\NortonData\22.5.4.24\Definitions\BASHDefs\20161027.001\BHDrvx64.sys [1854712 2016-08-18] (Symantec Corporation)
    R1 ccSet_NS; C:\WINDOWS\system32\drivers\NSx64\1609010.00C\ccSetx64.sys [174240 2017-02-07] (Symantec Corporation)
    R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [40960 2017-03-30] (COMODO)
    R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [831504 2017-03-30] (COMODO)
    R1 cmdhlp; C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [50808 2017-03-30] (COMODO)
    S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-12-18] (Samsung Electronics Co., Ltd.)
    R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [497368 2016-10-10] (Symantec Corporation)
    R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77440 2017-03-22] ()
    R1 IDSVia64; C:\Program Files (x86)\Norton Security\NortonData\22.5.4.24\Definitions\IPSDefs\20161027.002\IDSvia64.sys [1012952 2016-10-28] (Symantec Corporation)
    R1 inspect; C:\WINDOWS\system32\DRIVERS\inspect.sys [129200 2017-03-30] (COMODO)
    R1 isedrv; C:\WINDOWS\system32\drivers\isedrv.sys [62208 2017-03-29] (COMODO)
    R3 LBAI; C:\WINDOWS\System32\Drivers\LBAI.sys [24832 2015-11-09] (Lenovo)
    R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [186304 2017-05-06] (Malwarebytes)
    R3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [111544 2017-05-07] (Malwarebytes)
    R3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-05-07] (Malwarebytes)
    R0 MBAMSwissArmy; C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [251832 2017-05-07] (Malwarebytes)
    R3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [92096 2017-05-07] (Malwarebytes)
    S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
    R3 SRTSP; C:\WINDOWS\System32\Drivers\NSx64\1609010.00C\SRTSP64.SYS [770200 2017-03-16] (Symantec Corporation)
    R1 SRTSPX; C:\WINDOWS\system32\drivers\NSx64\1609010.00C\SRTSPX64.SYS [49312 2017-03-16] (Symantec Corporation)
    S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-12-18] (Samsung Electronics Co., Ltd.)
    R0 SymEFASI; C:\WINDOWS\System32\drivers\NSx64\1609010.00C\SYMEFASI64.SYS [1716896 2017-02-07] (Symantec Corporation)
    S4 SymELAM; C:\WINDOWS\system32\drivers\NSx64\1609010.00C\SymELAM.sys [24616 2017-02-07] (Symantec Corporation)
    R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [102608 2017-02-14] (Symantec Corporation)
    R1 SymIRON; C:\WINDOWS\system32\drivers\NSx64\1609010.00C\Ironx64.SYS [291480 2017-02-07] (Symantec Corporation)
    R1 SymNetS; C:\WINDOWS\System32\Drivers\NSx64\1609010.00C\SYMNETS.SYS [567512 2017-02-07] (Symantec Corporation)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2017-05-06] ()
    S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
    S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
    S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
    S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.5.4.24\Definitions\SDSDefs\20161012.008\ENG64.SYS [X]
    S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.5.4.24\Definitions\SDSDefs\20161012.008\EX64.SYS [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-05-07 09:30 - 2017-05-07 11:36 - 00000000 ____D C:\Users\admin\Desktop\VirtualDr
    2017-05-06 19:11 - 2017-05-06 19:30 - 00000000 ____D C:\AdwCleaner
    2017-05-06 17:15 - 2017-05-06 19:00 - 00000000 ____D C:\Program Files\RogueKiller
    2017-05-06 17:15 - 2017-05-06 17:15 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
    2017-05-06 17:15 - 2017-05-06 17:15 - 00000000 ____D C:\ProgramData\RogueKiller
    2017-05-06 17:15 - 2017-05-06 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
    2017-05-06 07:43 - 2017-05-07 16:00 - 00092096 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
    2017-05-06 07:43 - 2017-05-07 11:06 - 00111544 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
    2017-05-06 07:43 - 2017-05-07 11:06 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
    2017-05-06 07:43 - 2017-05-06 07:43 - 00186304 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
    2017-05-06 07:42 - 2017-05-07 10:59 - 00251832 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2017-05-06 07:42 - 2017-05-06 07:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2017-05-06 07:42 - 2017-05-06 07:42 - 00000000 ____D C:\ProgramData\Malwarebytes
    2017-05-06 07:42 - 2017-05-06 07:42 - 00000000 ____D C:\Program Files\Malwarebytes
    2017-05-06 07:42 - 2017-03-22 11:02 - 00077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
    2017-05-05 17:27 - 2017-05-05 17:27 - 00001228 _____ C:\Users\Public\Desktop\True Key.lnk
    2017-05-02 13:36 - 2017-05-02 13:36 - 00000000 __SHD C:\found.001
    2017-05-01 18:30 - 2017-05-01 19:34 - 00000000 ____D C:\Users\admin\Desktop\pre-algebra ACI
    2017-04-26 21:05 - 2017-04-26 21:05 - 00074562 _____ C:\Users\admin\Desktop\Royal Caribbean International $4262 9-2 to 9-9.pdf
    2017-04-25 16:24 - 2017-04-25 16:24 - 00000000 ____D C:\Users\admin\AppData\Roaming\Google
    2017-04-18 16:26 - 2017-04-18 16:26 - 00000000 ____D C:\Users\admin\Documents\Inventor Server SDK ACAD 2016
    2017-04-16 05:06 - 2017-04-16 05:06 - 00003548 _____ C:\WINDOWS\System32\Tasks\{C754CC6B-A7E4-4453-A26E-845EF72EABFE}
    2017-04-12 08:59 - 2017-03-27 21:37 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp
    2017-04-12 08:59 - 2017-03-27 21:34 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
    2017-04-12 08:59 - 2017-03-27 21:30 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll
    2017-04-12 08:59 - 2017-03-27 21:18 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
    2017-04-12 08:59 - 2017-03-27 21:14 - 07468544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
    2017-04-12 08:59 - 2017-03-27 21:08 - 00299008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RADCUI.dll
    2017-04-12 08:58 - 2017-03-27 22:21 - 00167848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
    2017-04-12 08:58 - 2017-03-27 22:07 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
    2017-04-12 08:58 - 2017-03-27 22:05 - 01504056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
    2017-04-12 08:58 - 2017-03-27 22:04 - 02262776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2017-04-12 08:58 - 2017-03-27 22:04 - 01431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
    2017-04-12 08:58 - 2017-03-27 22:04 - 00975744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
    2017-04-12 08:58 - 2017-03-27 22:04 - 00861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
    2017-04-12 08:58 - 2017-03-27 21:59 - 06667520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
    2017-04-12 08:58 - 2017-03-27 21:58 - 20967840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
    2017-04-12 08:58 - 2017-03-27 21:52 - 00306800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll
    2017-04-12 08:58 - 2017-03-27 21:48 - 05685760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
    2017-04-12 08:58 - 2017-03-27 21:42 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
    2017-04-12 08:58 - 2017-03-27 21:42 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
    2017-04-12 08:58 - 2017-03-27 21:40 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExSMime.dll
    2017-04-12 08:58 - 2017-03-27 21:40 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthManagerProxy.dll
    2017-04-12 08:58 - 2017-03-27 21:39 - 00040960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
    2017-04-12 08:58 - 2017-03-27 21:38 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
    2017-04-12 08:58 - 2017-03-27 21:38 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll
    2017-04-12 08:58 - 2017-03-27 21:38 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
    2017-04-12 08:58 - 2017-03-27 21:37 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apds.dll
    2017-04-12 08:58 - 2017-03-27 21:37 - 00177664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
    2017-04-12 08:58 - 2017-03-27 21:37 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.SystemManagement.dll
    2017-04-12 08:58 - 2017-03-27 21:36 - 00769024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ipsecsnp.dll
    2017-04-12 08:58 - 2017-03-27 21:36 - 00136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinRtTracing.dll
    2017-04-12 08:58 - 2017-03-27 21:36 - 00094208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll
    2017-04-12 08:58 - 2017-03-27 21:36 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.UserDeviceAssociation.dll
    2017-04-12 08:58 - 2017-03-27 21:35 - 00392192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll
    2017-04-12 08:58 - 2017-03-27 21:35 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll
    2017-04-12 08:58 - 2017-03-27 21:35 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
    2017-04-12 08:58 - 2017-03-27 21:35 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentActivation.dll
    2017-04-12 08:58 - 2017-03-27 21:35 - 00092672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll
    2017-04-12 08:58 - 2017-03-27 21:34 - 00299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
    2017-04-12 08:58 - 2017-03-27 21:34 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Core.dll
    2017-04-12 08:58 - 2017-03-27 21:33 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
    2017-04-12 08:58 - 2017-03-27 21:33 - 00436736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ipsmsnap.dll
    2017-04-12 08:58 - 2017-03-27 21:32 - 01243136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll
    2017-04-12 08:58 - 2017-03-27 21:32 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll
    2017-04-12 08:58 - 2017-03-27 21:32 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
    2017-04-12 08:58 - 2017-03-27 21:32 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
    2017-04-12 08:58 - 2017-03-27 21:32 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WwaApi.dll
    2017-04-12 08:58 - 2017-03-27 21:32 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vaultcli.dll
    2017-04-12 08:58 - 2017-03-27 21:32 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll
    2017-04-12 08:58 - 2017-03-27 21:31 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
    2017-04-12 08:58 - 2017-03-27 21:30 - 00819200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppContracts.dll
    2017-04-12 08:58 - 2017-03-27 21:30 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NaturalLanguage6.dll
    2017-04-12 08:58 - 2017-03-27 21:30 - 00787968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sbe.dll
    2017-04-12 08:58 - 2017-03-27 21:30 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
    2017-04-12 08:58 - 2017-03-27 21:30 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
    2017-04-12 08:58 - 2017-03-27 21:29 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll
    2017-04-12 08:58 - 2017-03-27 21:29 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
    2017-04-12 08:58 - 2017-03-27 21:29 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll
    Reply With Quote Reply With Quote
  7. May 7th, 2017, 08:33 PM #22
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    Still being re-directed to "Something Went Wrong" page, after dozens of attempts to continue pasting and posting.

    I'm attaching the FRST txt and Addition txt files.
    Attached Files Attached Files
    Reply With Quote Reply With Quote
  8. May 7th, 2017, 08:41 PM #23
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
    Attached Files Attached Files
    My Home Page
    Reply With Quote Reply With Quote
  9. May 7th, 2017, 10:20 PM #24
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    Fixlog.txt attached after repeated attempts to paste and post keeps being redirected to "Something went wrong" page.
    Attached Files Attached Files
    Reply With Quote Reply With Quote
  10. May 7th, 2017, 10:33 PM #25
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Last scans....

    Download Security Check from here or here and save it to your Desktop.

    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.



    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    Make sure the following options are checked:

    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
    • Other Services



    Press "Scan".
    It will create a log (FSS.txt) in the same directory the tool is run.
    Please copy and paste the log to your reply.


    Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.




    Download Sophos Free Virus Removal Tool and save it to your desktop.

    • Double click the icon and select Run
    • Click Next
    • Select I accept the terms in this license agreement, then click Next twice
    • Click Install
    • Click Finish to launch the program
    • Once the virus database has been updated click Start Scanning
    • If any threats are found click Details, then View log file... (bottom left hand corner)
    • Copy and paste the results in your reply
    • Close the Notepad document, close the Threat Details screen, then click Start cleanup
    • Click Exit to close the program
    My Home Page
    Reply With Quote Reply With Quote
  11. May 8th, 2017, 07:38 AM #26
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    checkup.txt:
    Results of screen317's Security Check version 0.99.82
    Windows 7 Service Pack 1 x64 (UAC is enabled)
    Internet Explorer 11
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Disabled!
    COMODO Antivirus
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    Malwarebytes Anti-Malware version 1.75.0.1300
    Java 7 Update 55
    Adobe Flash Player 9 Flash Player out of Date!
    Google Chrome 34.0.1847.131
    ````````Process Check: objlist.exe by Laurent````````
    Malwarebytes Anti-Malware mbamservice.exe
    Malwarebytes Anti-Malware mbamgui.exe
    Comodo Firewall cmdagent.exe
    Malwarebytes' Anti-Malware mbamscheduler.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 0%
    ````````````````````End of Log``````````````````````
    Reply With Quote Reply With Quote
  12. May 8th, 2017, 07:43 AM #27
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    FSS.txt, post 1:

    Farbar Service Scanner Version: 27-01-2016
    Ran by admin (administrator) on 07-05-2017 at 20:02:24
    Running from "C:\Users\admin\Desktop"
    Microsoft Windows 10 Pro (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Policy:
    ========================


    Security Center:
    ============


    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1
    Reply With Quote Reply With Quote
  13. May 8th, 2017, 07:45 AM #28
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    FSS.txt, post 2:

    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => File is digitally signed
    C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\System32\drivers\afd.sys => File is digitally signed
    C:\Windows\System32\drivers\tdx.sys => File is digitally signed
    C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\System32\dnsrslvr.dll => File is digitally signed
    C:\Windows\System32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\System32\mpssvc.dll => File is digitally signed
    C:\Windows\System32\bfe.dll => File is digitally signed
    C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\System32\SDRSVC.dll => File is digitally signed
    C:\Windows\System32\vssvc.exe => File is digitally signed
    C:\Windows\System32\wscsvc.dll => File is digitally signed
    C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\System32\wuaueng.dll => File is digitally signed
    C:\Windows\System32\qmgr.dll => File is digitally signed
    C:\Windows\System32\es.dll => File is digitally signed
    C:\Windows\System32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Windows\System32\ipnathlp.dll => File is digitally signed
    C:\Windows\System32\iphlpsvc.dll => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed


    **** End of log ****
    Reply With Quote Reply With Quote
  14. May 8th, 2017, 07:46 AM #29
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    Ran TFC.

    Sophos still running, overnight and still scanning....
    Reply With Quote Reply With Quote
  15. May 8th, 2017, 07:47 AM #30
    cmg7590
    cmg7590 is offline Virtual Intern
    Join Date
    May 2005
    Posts
    122
    So far, Sophos has found zero threats.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules