[RESOLVED] Lots of Problems - Page 2
Page 2 of 2 FirstFirst 12
Results 16 to 28 of 28

Thread: [RESOLVED] Lots of Problems

  1. #16
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.


    • Double click to run it.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.

  2. #17
    Join Date
    Mar 2014
    Posts
    557
    FRST part 1: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-07-2017
    Ran by Angela (administrator) on ANGELA-PC (16-07-2017 06:54:13)
    Running from C:\Users\Angela\Desktop
    Loaded Profiles: Angela (Available Profiles: Angela)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
    (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
    (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
    (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
    (Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
    (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxtray.exe
    (Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
    (Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
    (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    (Microsoft Corporation) C:\WINDOWS\SysWOW64\svchost.exe
    (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
    (Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    (AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
    (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
    (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
    (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.)
    HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-15] (Intel(R) Corporation)
    HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
    HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213832 2017-07-06] (AVAST Software)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-05-09] (Apple Inc.)
    HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
    HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
    HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
    HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
    HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-03-15] (Oracle Corporation)
    Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
    HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2015-05-09]
    ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 24.116.0.53 24.116.2.50 192.168.1.1
    Tcpip\..\Interfaces\{7DE346BF-6AF2-495C-B05C-3121B7F13499}: [DhcpNameServer] 24.116.0.53 24.116.2.50 192.168.1.1

    Internet Explorer:
    ==================
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-3674130756-1144773717-1238336968-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKLM -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-3674130756-1144773717-1238336968-1001 -> DefaultScope {46E79212-8225-45C0-802A-DE124F7D0073} URL = hxxp://www.google.com/search?q={searchTerms}
    SearchScopes: HKU\S-1-5-21-3674130756-1144773717-1238336968-1001 -> {46E79212-8225-45C0-802A-DE124F7D0073} URL = hxxp://www.google.com/search?q={searchTerms}
    SearchScopes: HKU\S-1-5-21-3674130756-1144773717-1238336968-1001 -> {EF487F1C-DC5F-4011-B32F-A278614307A3} URL = hxxp://www.google.com/search?q={searchTerms}
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-07-06] (AVAST Software)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-04-21] (Oracle Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-07-06] (AVAST Software)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-04-21] (Oracle Corporation)
    Toolbar: HKU\S-1-5-21-3674130756-1144773717-1238336968-1001 -> No Name - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No File
    DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://files.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
    DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://files.creative.com/Web/softwareupdate/ocx/150323/CTPID.cab

    FireFox:
    ========
    FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2015-05-09] [not signed]
    FF HKU\S-1-5-21-3674130756-1144773717-1238336968-1001\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
    FF Plugin-x32: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll [2017-04-21] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll [2017-04-21] (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-26] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-26] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)

    Chrome:
    =======
    CHR HomePage: Default -> hxxps://www.google.as/
    CHR StartupUrls: Default -> "hxxp://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP7401D05D-9F1A-4F06-B2CA-58D5B0AA22F4&SSPV="
    CHR Profile: C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default [2017-07-16]
    CHR Extension: (Google Slides) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-12-23]
    CHR Extension: (Google Docs) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-12-23]
    CHR Extension: (Google Drive) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-23]
    CHR Extension: (YouTube) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-23]
    CHR Extension: (Google Sheets) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-12-23]
    CHR Extension: (Google Docs Offline) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-23]
    CHR Extension: (AdBlock) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-06-27]
    CHR Extension: (Avast Online Security) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-06-09]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
    CHR Extension: (Gmail) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-23]
    CHR Extension: (Chrome Media Router) - C:\Users\Angela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-13]
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
    R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7430992 2017-07-06] (AVAST Software s.r.o.)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [263312 2017-07-06] (AVAST Software)
    R2 Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [921664 2011-05-19] (Intel Corporation) [File not signed]
    R3 Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [1335360 2011-05-19] (Intel Corporation) [File not signed]
    R2 Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [995392 2011-05-19] (Intel Corporation) [File not signed]
    R2 DellDigitalDelivery; C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [162816 2011-10-26] (Dell Products, LP.) [File not signed]
    R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
    S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-15] ()
    R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
    R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    U5 AppMgmt; C:\windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
    R1 aswbidsdriver; C:\windows\system32\drivers\aswbidsdrivera.sys [319984 2017-07-06] (AVAST Software s.r.o.)
    R0 aswbidsh; C:\windows\system32\drivers\aswbidsha.sys [198944 2017-07-06] (AVAST Software s.r.o.)
    R0 aswblog; C:\windows\system32\drivers\aswbloga.sys [343264 2017-07-06] (AVAST Software s.r.o.)
    R0 aswbuniv; C:\windows\system32\drivers\aswbuniva.sys [57704 2017-07-06] (AVAST Software s.r.o.)
    S3 aswHdsKe; C:\windows\system32\drivers\aswHdsKe.sys [82936 2016-12-26] (AVAST Software)
    S3 aswHwid; C:\windows\system32\drivers\aswHwid.sys [46984 2017-07-06] (AVAST Software)
    R1 aswKbd; C:\windows\system32\drivers\aswKbd.sys [41800 2017-07-06] (AVAST Software)
    R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [146664 2017-07-06] (AVAST Software)
    R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [110352 2017-07-06] (AVAST Software)
    R0 aswRvrt; C:\windows\system32\drivers\aswRvrt.sys [84392 2017-07-06] (AVAST Software)
    R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1015848 2017-07-06] (AVAST Software)
    R1 aswSP; C:\windows\system32\drivers\aswSP.sys [585608 2017-07-06] (AVAST Software)
    R2 aswStm; C:\windows\system32\drivers\aswStm.sys [198768 2017-07-06] (AVAST Software)
    R0 aswVmm; C:\windows\system32\drivers\aswVmm.sys [361336 2017-07-06] (AVAST Software)
    R1 ESProtectionDriver; C:\windows\system32\drivers\mbae64.sys [77376 2017-07-13] ()
    R2 MBAMChameleon; C:\windows\system32\drivers\MBAMChameleon.sys [188312 2017-06-21] (Malwarebytes)
    S3 MBAMFarflt; C:\windows\system32\drivers\farflt.sys [113592 2017-07-04] (Malwarebytes)
    R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [253856 2017-07-16] (Malwarebytes)
    U3 TrueSight; C:\WINDOWS\System32\drivers\TrueSight.sys [28272 2017-07-14] ()

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-07-16 06:54 - 2017-07-16 06:54 - 00017947 _____ C:\Users\Angela\Desktop\FRST.txt
    2017-07-15 11:37 - 2017-07-15 11:37 - 00028151 _____ C:\ComboFix.txt
    2017-07-15 11:13 - 2017-07-15 11:37 - 00000000 ____D C:\Qoobox
    2017-07-15 11:13 - 2011-06-26 01:45 - 00256000 _____ C:\windows\PEV.exe
    2017-07-15 11:13 - 2010-11-07 12:20 - 00208896 _____ C:\windows\MBR.exe
    2017-07-15 11:13 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
    2017-07-15 11:13 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
    2017-07-15 11:13 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
    2017-07-15 11:13 - 2000-08-30 19:00 - 00098816 _____ C:\windows\sed.exe
    2017-07-15 11:13 - 2000-08-30 19:00 - 00080412 _____ C:\windows\grep.exe
    2017-07-15 11:13 - 2000-08-30 19:00 - 00068096 _____ C:\windows\zip.exe
    2017-07-15 11:11 - 2017-07-15 11:11 - 05659794 ____R (Swearware) C:\Users\Angela\Desktop\ComboFix.exe
    2017-07-14 19:15 - 2017-07-14 19:15 - 00004183 _____ C:\Users\Angela\Desktop\JRT.txt
    2017-07-14 19:12 - 2017-07-14 19:12 - 01790024 _____ (Malwarebytes) C:\Users\Angela\Downloads\JRT.exe
    2017-07-14 07:39 - 2017-07-14 09:06 - 00000000 ____D C:\AdwCleaner
    2017-07-14 07:39 - 2017-07-14 07:39 - 04110280 _____ C:\Users\Angela\Downloads\AdwCleaner.exe
    2017-07-14 07:37 - 2017-07-14 07:37 - 00001212 _____ C:\Users\Angela\Desktop\Malwarebytes.txt
    2017-07-14 06:32 - 2017-07-14 06:32 - 00000000 ____D C:\ProgramData\RogueKiller
    2017-07-14 06:31 - 2017-07-14 06:31 - 00000860 _____ C:\Users\Public\Desktop\RogueKiller.lnk
    2017-07-14 06:31 - 2017-07-14 06:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
    2017-07-14 06:31 - 2017-07-14 06:31 - 00000000 ____D C:\Program Files\RogueKiller
    2017-07-14 06:30 - 2017-07-14 06:30 - 35612552 _____ (Adlice Software ) C:\Users\Angela\Downloads\RogueKiller_setup_ref3.exe
    2017-07-13 12:53 - 2017-07-13 12:53 - 00014421 _____ C:\Users\Angela\Downloads\FRST.txt
    2017-07-13 12:52 - 2017-07-13 12:52 - 02435584 _____ (Farbar) C:\Users\Angela\Desktop\FRST64.exe
    2017-07-12 06:42 - 2017-07-05 23:56 - 00119296 _____ (Microsoft Corporation) C:\windows\system32\Drivers\bthpan.sys
    2017-07-12 06:42 - 2017-06-29 23:15 - 00394448 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
    2017-07-12 06:42 - 2017-06-29 22:32 - 00346312 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 02319872 _____ (Microsoft Corporation) C:\windows\system32\tquery.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 02222080 _____ (Microsoft Corporation) C:\windows\system32\mssrch.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 02058240 _____ (Microsoft Corporation) C:\windows\system32\Query.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 00778240 _____ (Microsoft Corporation) C:\windows\system32\mssvp.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 00491520 _____ (Microsoft Corporation) C:\windows\system32\mssph.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 00288256 _____ (Microsoft Corporation) C:\windows\system32\mssphtb.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 00115200 _____ (Microsoft Corporation) C:\windows\system32\mssitlb.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\mssprxy.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 00075264 _____ (Microsoft Corporation) C:\windows\system32\msscntrs.dll
    2017-07-12 06:42 - 2017-06-29 21:57 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\msshooks.dll
    2017-07-12 06:42 - 2017-06-29 21:40 - 00591872 _____ (Microsoft Corporation) C:\windows\system32\SearchIndexer.exe
    2017-07-12 06:42 - 2017-06-29 21:40 - 00249856 _____ (Microsoft Corporation) C:\windows\system32\SearchProtocolHost.exe
    2017-07-12 06:42 - 2017-06-29 21:39 - 01549312 _____ (Microsoft Corporation) C:\windows\SysWOW64\tquery.dll
    2017-07-12 06:42 - 2017-06-29 21:39 - 00113664 _____ (Microsoft Corporation) C:\windows\system32\SearchFilterHost.exe
    2017-07-12 06:42 - 2017-06-29 21:38 - 01400320 _____ (Microsoft Corporation) C:\windows\SysWOW64\mssrch.dll
    2017-07-12 06:42 - 2017-06-29 21:38 - 01363968 _____ (Microsoft Corporation) C:\windows\SysWOW64\Query.dll
    2017-07-12 06:42 - 2017-06-29 21:38 - 00666624 _____ (Microsoft Corporation) C:\windows\SysWOW64\mssvp.dll
    2017-07-12 06:42 - 2017-06-29 21:38 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\mssph.dll
    2017-07-12 06:42 - 2017-06-29 21:38 - 00197120 _____ (Microsoft Corporation) C:\windows\SysWOW64\mssphtb.dll
    2017-07-12 06:42 - 2017-06-29 21:38 - 00104448 _____ (Microsoft Corporation) C:\windows\SysWOW64\mssitlb.dll
    2017-07-12 06:42 - 2017-06-29 21:38 - 00059392 _____ (Microsoft Corporation) C:\windows\SysWOW64\msscntrs.dll
    2017-07-12 06:42 - 2017-06-29 21:38 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mssprxy.dll
    2017-07-12 06:42 - 2017-06-29 21:27 - 00427520 _____ (Microsoft Corporation) C:\windows\SysWOW64\SearchIndexer.exe
    2017-07-12 06:42 - 2017-06-29 21:27 - 00164352 _____ (Microsoft Corporation) C:\windows\SysWOW64\SearchProtocolHost.exe
    2017-07-12 06:42 - 2017-06-29 21:26 - 00086528 _____ (Microsoft Corporation) C:\windows\SysWOW64\SearchFilterHost.exe
    2017-07-12 06:42 - 2017-06-29 21:26 - 00009728 _____ (Microsoft Corporation) C:\windows\SysWOW64\msshooks.dll
    2017-07-12 06:42 - 2017-06-29 01:27 - 25734656 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
    2017-07-12 06:42 - 2017-06-29 01:19 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
    2017-07-12 06:42 - 2017-06-29 01:18 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
    2017-07-12 06:42 - 2017-06-29 01:04 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
    2017-07-12 06:42 - 2017-06-29 01:03 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
    2017-07-12 06:42 - 2017-06-29 01:03 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
    2017-07-12 06:42 - 2017-06-29 01:02 - 02899456 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
    2017-07-12 06:42 - 2017-06-29 01:02 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
    2017-07-12 06:42 - 2017-06-29 01:02 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
    2017-07-12 06:42 - 2017-06-29 00:55 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
    2017-07-12 06:42 - 2017-06-29 00:54 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
    2017-07-12 06:42 - 2017-06-29 00:51 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
    2017-07-12 06:42 - 2017-06-29 00:50 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
    2017-07-12 06:42 - 2017-06-29 00:50 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
    2017-07-12 06:42 - 2017-06-29 00:50 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
    2017-07-12 06:42 - 2017-06-29 00:50 - 00116224 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
    2017-07-12 06:42 - 2017-06-29 00:44 - 05975552 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

  3. #18
    Join Date
    Mar 2014
    Posts
    557
    FRST part 2: 2017-07-12 06:42 - 2017-06-29 00:43 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
    2017-07-12 06:42 - 2017-06-29 00:39 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
    2017-07-12 06:42 - 2017-06-29 00:35 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
    2017-07-12 06:42 - 2017-06-29 00:31 - 00087552 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
    2017-07-12 06:42 - 2017-06-29 00:31 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
    2017-07-12 06:42 - 2017-06-29 00:30 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
    2017-07-12 06:42 - 2017-06-29 00:27 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
    2017-07-12 06:42 - 2017-06-29 00:26 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
    2017-07-12 06:42 - 2017-06-29 00:23 - 20270592 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
    2017-07-12 06:42 - 2017-06-29 00:23 - 00499200 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
    2017-07-12 06:42 - 2017-06-29 00:23 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
    2017-07-12 06:42 - 2017-06-29 00:23 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
    2017-07-12 06:42 - 2017-06-29 00:23 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
    2017-07-12 06:42 - 2017-06-29 00:22 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
    2017-07-12 06:42 - 2017-06-29 00:22 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
    2017-07-12 06:42 - 2017-06-29 00:22 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
    2017-07-12 06:42 - 2017-06-29 00:19 - 02290176 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
    2017-07-12 06:42 - 2017-06-29 00:17 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
    2017-07-12 06:42 - 2017-06-29 00:16 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
    2017-07-12 06:42 - 2017-06-29 00:14 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
    2017-07-12 06:42 - 2017-06-29 00:13 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
    2017-07-12 06:42 - 2017-06-29 00:13 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
    2017-07-12 06:42 - 2017-06-29 00:13 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
    2017-07-12 06:42 - 2017-06-29 00:11 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
    2017-07-12 06:42 - 2017-06-29 00:09 - 00806912 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
    2017-07-12 06:42 - 2017-06-29 00:09 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
    2017-07-12 06:42 - 2017-06-29 00:08 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
    2017-07-12 06:42 - 2017-06-29 00:07 - 02132992 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
    2017-07-12 06:42 - 2017-06-29 00:05 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
    2017-07-12 06:42 - 2017-06-29 00:01 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
    2017-07-12 06:42 - 2017-06-29 00:00 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
    2017-07-12 06:42 - 2017-06-29 00:00 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
    2017-07-12 06:42 - 2017-06-28 23:58 - 15253504 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
    2017-07-12 06:42 - 2017-06-28 23:58 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
    2017-07-12 06:42 - 2017-06-28 23:56 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
    2017-07-12 06:42 - 2017-06-28 23:56 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
    2017-07-12 06:42 - 2017-06-28 23:54 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
    2017-07-12 06:42 - 2017-06-28 23:53 - 03240960 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
    2017-07-12 06:42 - 2017-06-28 23:52 - 04549632 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
    2017-07-12 06:42 - 2017-06-28 23:48 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
    2017-07-12 06:42 - 2017-06-28 23:47 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
    2017-07-12 06:42 - 2017-06-28 23:46 - 02057216 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
    2017-07-12 06:42 - 2017-06-28 23:46 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
    2017-07-12 06:42 - 2017-06-28 23:43 - 13663744 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
    2017-07-12 06:42 - 2017-06-28 23:41 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
    2017-07-12 06:42 - 2017-06-28 23:29 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
    2017-07-12 06:42 - 2017-06-28 23:28 - 02767872 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
    2017-07-12 06:42 - 2017-06-28 23:24 - 01314816 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
    2017-07-12 06:42 - 2017-06-28 23:23 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
    2017-07-12 06:42 - 2017-06-22 09:58 - 03223040 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
    2017-07-12 06:42 - 2017-06-15 15:23 - 00753664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
    2017-07-12 06:42 - 2017-06-12 17:54 - 00370920 _____ (Microsoft Corporation) C:\windows\system32\clfs.sys
    2017-07-12 06:42 - 2017-06-12 17:54 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
    2017-07-12 06:42 - 2017-06-12 17:54 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
    2017-07-12 06:42 - 2017-06-12 17:49 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 01363456 _____ (Microsoft Corporation) C:\windows\system32\wdc.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00731648 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00594432 _____ (Microsoft Corporation) C:\windows\system32\wvc.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00475136 _____ (Microsoft Corporation) C:\windows\system32\sysmon.ocx
    2017-07-12 06:42 - 2017-06-12 17:49 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00345600 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00123904 _____ (Microsoft Corporation) C:\windows\system32\bcrypt.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00058880 _____ (Microsoft Corporation) C:\windows\system32\pdhui.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
    2017-07-12 06:42 - 2017-06-12 17:49 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
    2017-07-12 06:42 - 2017-06-12 17:29 - 01227264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdc.dll
    2017-07-12 06:42 - 2017-06-12 17:29 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
    2017-07-12 06:42 - 2017-06-12 17:29 - 00444928 _____ (Microsoft Corporation) C:\windows\SysWOW64\wvc.dll
    2017-07-12 06:42 - 2017-06-12 17:29 - 00390144 _____ (Microsoft Corporation) C:\windows\SysWOW64\sysmon.ocx
    2017-07-12 06:42 - 2017-06-12 17:29 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
    2017-07-12 06:42 - 2017-06-12 17:29 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
    2017-07-12 06:42 - 2017-06-12 17:29 - 00082944 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcrypt.dll
    2017-07-12 06:42 - 2017-06-12 17:29 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00554496 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00261120 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00254464 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\pdhui.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
    2017-07-12 06:42 - 2017-06-12 17:28 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
    2017-07-12 06:42 - 2017-06-12 17:19 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
    2017-07-12 06:42 - 2017-06-12 17:14 - 00379392 _____ (Microsoft Corporation) C:\windows\system32\msinfo32.exe
    2017-07-12 06:42 - 2017-06-12 17:14 - 00172544 _____ (Microsoft Corporation) C:\windows\system32\perfmon.exe
    2017-07-12 06:42 - 2017-06-12 17:14 - 00103936 _____ (Microsoft Corporation) C:\windows\system32\resmon.exe
    2017-07-12 06:42 - 2017-06-12 17:12 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
    2017-07-12 06:42 - 2017-06-12 17:12 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
    2017-07-12 06:42 - 2017-06-12 17:12 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
    2017-07-12 06:42 - 2017-06-12 17:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
    2017-07-12 06:42 - 2017-06-12 17:09 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
    2017-07-12 06:42 - 2017-06-12 17:06 - 00303616 _____ (Microsoft Corporation) C:\windows\SysWOW64\msinfo32.exe
    2017-07-12 06:42 - 2017-06-12 17:06 - 00157184 _____ (Microsoft Corporation) C:\windows\SysWOW64\perfmon.exe
    2017-07-12 06:42 - 2017-06-12 17:06 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\resmon.exe
    2017-07-12 06:42 - 2017-06-12 17:05 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
    2017-07-12 06:42 - 2017-06-10 10:59 - 00313856 _____ (Microsoft Corporation) C:\windows\system32\Wldap32.dll
    2017-07-12 06:42 - 2017-06-10 10:39 - 00271360 _____ (Microsoft Corporation) C:\windows\SysWOW64\Wldap32.dll
    2017-07-12 06:42 - 2017-06-09 10:33 - 01680616 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
    2017-07-12 06:42 - 2017-06-06 10:30 - 01867264 _____ (Microsoft Corporation) C:\windows\system32\ExplorerFrame.dll
    2017-07-12 06:42 - 2017-06-06 10:12 - 01499648 _____ (Microsoft Corporation) C:\windows\SysWOW64\ExplorerFrame.dll
    2017-07-12 06:42 - 2017-05-29 23:56 - 01895656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
    2017-07-12 06:42 - 2017-05-29 23:56 - 00377576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
    2017-07-12 06:42 - 2017-05-29 23:56 - 00287976 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
    2017-07-12 06:42 - 2017-05-20 23:24 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
    2017-07-12 06:42 - 2017-05-20 23:06 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
    2017-07-12 06:42 - 2017-05-16 10:35 - 00986856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
    2017-07-12 06:42 - 2017-05-16 10:35 - 00265448 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgmms1.sys
    2017-07-12 06:42 - 2017-05-16 10:30 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
    2017-07-12 06:42 - 2017-05-03 10:34 - 00094952 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
    2017-07-12 06:42 - 2017-05-03 10:29 - 01206272 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
    2017-07-12 06:42 - 2017-05-03 08:05 - 01555968 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
    2017-07-12 06:42 - 2017-05-03 08:05 - 00620544 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
    2017-07-12 06:42 - 2017-05-03 08:05 - 00535552 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
    2017-07-12 06:42 - 2017-05-03 08:05 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
    2017-07-12 06:42 - 2017-05-03 08:05 - 00311296 _____ (Microsoft Corporation) C:\windows\system32\centel.dll
    2017-07-12 06:42 - 2017-05-03 08:05 - 00217088 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
    2017-07-12 06:42 - 2017-05-03 08:05 - 00127488 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
    2017-07-12 06:42 - 2017-03-22 21:06 - 01691136 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
    2017-07-12 06:36 - 2017-07-12 06:36 - 05216768 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
    2017-07-06 10:39 - 2017-07-06 10:39 - 00400464 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
    2017-06-27 13:02 - 2017-06-27 13:02 - 00594882 _____ C:\Users\Angela\Downloads\getPart (6).pdf
    2017-06-25 15:20 - 2017-06-25 15:20 - 00594882 _____ C:\Users\Angela\Downloads\getPart (5).pdf
    2017-06-21 11:02 - 2017-07-13 14:54 - 00077376 _____ C:\windows\system32\Drivers\mbae64.sys
    2017-06-21 11:02 - 2017-07-05 11:27 - 00084256 _____ (Malwarebytes) C:\windows\system32\Drivers\mwac.sys
    2017-06-21 11:02 - 2017-07-05 11:27 - 00044960 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
    2017-06-21 11:02 - 2017-07-04 18:28 - 00113592 _____ (Malwarebytes) C:\windows\system32\Drivers\farflt.sys
    2017-06-21 11:02 - 2017-06-21 11:03 - 00188312 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMChameleon.sys
    2017-06-21 11:02 - 2017-06-21 11:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2017-06-21 11:02 - 2017-06-21 11:02 - 00000000 ____D C:\Program Files\Malwarebytes

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-07-16 06:54 - 2016-08-12 08:33 - 00000000 ____D C:\FRST
    2017-07-16 06:29 - 2009-07-13 23:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2017-07-16 06:29 - 2009-07-13 23:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2017-07-16 06:26 - 2009-07-14 00:13 - 00782470 _____ C:\windows\system32\PerfStringBackup.INI
    2017-07-16 06:26 - 2009-07-13 22:20 - 00000000 ____D C:\windows\inf
    2017-07-16 06:21 - 2015-04-23 16:07 - 00253856 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
    2017-07-16 06:20 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
    2017-07-15 17:12 - 2017-03-23 09:25 - 00000000 ____D C:\Users\Angela\Documents\Food Folder
    2017-07-15 11:37 - 2009-07-14 00:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
    2017-07-15 11:25 - 2009-07-13 21:34 - 00000215 _____ C:\windows\system.ini
    2017-07-14 15:33 - 2017-02-14 12:21 - 00004172 _____ C:\windows\System32\Tasks\Avast Emergency Update
    2017-07-14 06:32 - 2015-07-18 12:14 - 00028272 _____ C:\windows\system32\Drivers\TrueSight.sys
    2017-07-13 14:06 - 2009-07-13 22:20 - 00000000 ____D C:\windows\rescache
    2017-07-13 13:07 - 2015-09-06 07:46 - 00000000 ____D C:\Users\Angela\AppData\Local\CrashDumps
    2017-07-12 18:51 - 2009-07-13 23:45 - 00295544 _____ C:\windows\system32\FNTCACHE.DAT
    2017-07-12 18:48 - 2015-04-20 18:40 - 00000000 ____D C:\windows\system32\MRT
    2017-07-12 18:48 - 2015-04-16 14:52 - 00000000 ____D C:\windows\system32\appraiser
    2017-07-12 18:46 - 2015-04-20 18:40 - 135225752 ____C (Microsoft Corporation) C:\windows\system32\MRT.exe
    2017-07-12 06:36 - 2015-04-17 11:44 - 00803328 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
    2017-07-12 06:36 - 2015-04-17 11:44 - 00004312 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
    2017-07-12 06:36 - 2012-01-05 07:40 - 00144896 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
    2017-07-12 06:36 - 2012-01-05 07:40 - 00000000 ____D C:\windows\SysWOW64\Macromed
    2017-07-12 06:36 - 2012-01-05 07:40 - 00000000 ____D C:\windows\system32\Macromed
    2017-07-11 06:47 - 2015-11-18 11:43 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
    2017-07-07 18:42 - 2017-06-14 19:51 - 00000000 ____D C:\Users\Angela\Documents\New Me I Wanna Be
    2017-07-06 10:41 - 2016-12-01 13:41 - 00003894 _____ C:\windows\System32\Tasks\SafeZone scheduled Autoupdate 1480617663
    2017-07-06 10:39 - 2016-12-01 13:38 - 00585608 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys
    2017-07-06 10:39 - 2016-12-01 13:38 - 00361336 _____ (AVAST Software) C:\windows\system32\Drivers\aswvmm.sys
    2017-07-06 10:39 - 2016-12-01 13:38 - 00360792 _____ (AVAST Software) C:\windows\system32\Drivers\aswvmm.sys.149935558367906
    2017-07-06 10:39 - 2016-12-01 13:38 - 00198768 _____ (AVAST Software) C:\windows\system32\Drivers\aswStm.sys
    2017-07-06 10:39 - 2016-12-01 13:38 - 00146664 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
    2017-07-06 10:39 - 2016-12-01 13:38 - 00110352 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
    2017-07-06 10:39 - 2016-12-01 13:38 - 00084392 _____ (AVAST Software) C:\windows\system32\Drivers\aswRvrt.sys
    2017-07-06 10:39 - 2016-12-01 13:38 - 00046984 _____ (AVAST Software) C:\windows\system32\Drivers\aswHwid.sys
    2017-07-06 10:39 - 2015-04-20 09:04 - 00000000 ____D C:\ProgramData\AVAST Software
    2017-07-06 10:38 - 2017-02-14 12:21 - 00343264 _____ (AVAST Software s.r.o.) C:\windows\system32\Drivers\aswbloga.sys
    2017-07-06 10:38 - 2017-02-14 12:21 - 00319984 _____ (AVAST Software s.r.o.) C:\windows\system32\Drivers\aswbidsdrivera.sys
    2017-07-06 10:38 - 2017-02-14 12:21 - 00198944 _____ (AVAST Software s.r.o.) C:\windows\system32\Drivers\aswbidsha.sys
    2017-07-06 10:38 - 2017-02-14 12:21 - 00057704 _____ (AVAST Software s.r.o.) C:\windows\system32\Drivers\aswbuniva.sys
    2017-07-06 10:38 - 2016-12-01 13:40 - 00041800 _____ (AVAST Software) C:\windows\system32\Drivers\aswKbd.sys
    2017-07-06 10:38 - 2016-12-01 13:38 - 01015848 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys
    2017-06-27 15:58 - 2016-12-23 17:53 - 00002197 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2017-06-24 13:31 - 2009-07-13 22:20 - 00000000 ____D C:\windows\system32\NDF
    2017-06-21 11:02 - 2015-04-23 16:06 - 00000000 ____D C:\ProgramData\Malwarebytes
    2017-06-21 11:02 - 2015-04-23 16:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
    2017-06-19 16:01 - 2017-03-23 09:25 - 00000000 ____D C:\Users\Angela\Documents\Works of Words
    2017-06-18 08:03 - 2017-06-14 18:53 - 00000000 ____D C:\Users\Angela\Documents\Media

    ==================== Files in the root of some directories =======

    2016-10-19 09:57 - 2016-10-17 20:28 - 2684192 _____ (COMODO) C:\Users\Angela\AppData\Roaming\temp~ccavstart.exe
    2016-10-19 09:57 - 2016-10-17 20:29 - 3856040 _____ (Terra Informatica Software, Inc.) C:\Users\Angela\AppData\Roaming\temp~cmdhtml.dll
    2015-07-23 16:23 - 2015-08-16 11:11 - 0009728 _____ () C:\Users\Angela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2016-08-10 10:49 - 2016-08-10 10:49 - 0000985 _____ () C:\ProgramData\hpzinstall.log

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\windows\system32\winlogon.exe => File is digitally signed
    C:\windows\system32\wininit.exe => File is digitally signed
    C:\windows\SysWOW64\wininit.exe => File is digitally signed
    C:\windows\explorer.exe => File is digitally signed
    C:\windows\SysWOW64\explorer.exe => File is digitally signed
    C:\windows\system32\svchost.exe => File is digitally signed
    C:\windows\SysWOW64\svchost.exe => File is digitally signed
    C:\windows\system32\services.exe => File is digitally signed
    C:\windows\system32\User32.dll => File is digitally signed
    C:\windows\SysWOW64\User32.dll => File is digitally signed
    C:\windows\system32\userinit.exe => File is digitally signed
    C:\windows\SysWOW64\userinit.exe => File is digitally signed
    C:\windows\system32\rpcss.dll => File is digitally signed
    C:\windows\system32\dnsapi.dll => File is digitally signed
    C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2017-07-12 10:58

    ==================== End of FRST.txt ============================

  4. #19
    Join Date
    Mar 2014
    Posts
    557
    Addition: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-07-2017
    Ran by Angela (16-07-2017 06:55:39)
    Running from C:\Users\Angela\Desktop
    Windows 7 Home Premium Service Pack 1 (X64) (2015-04-15 22:48:11)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-3674130756-1144773717-1238336968-500 - Administrator - Disabled)
    Angela (S-1-5-21-3674130756-1144773717-1238336968-1001 - Administrator - Enabled) => C:\Users\Angela
    Guest (S-1-5-21-3674130756-1144773717-1238336968-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-3674130756-1144773717-1238336968-1002 - Limited - Enabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
    AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    64 Bit HP CIO Components Installer (HKLM\...\{FF21C3E6-97FD-474F-9518-8DCBE94C2854}) (Version: 7.2.8 - Hewlett-Packard) Hidden
    Accidental Damage Services Agreement (HKLM-x32\...\{EF85FEF4-EB92-4075-A6D2-5F519BB30A2C}) (Version: 2.0.0 - Dell Inc.)
    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.009.20058 - Adobe Systems Incorporated)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
    Adobe Flash Player 26 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 26.0.0.137 - Adobe Systems Incorporated)
    Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
    Apple Application Support (32-bit) (HKLM-x32\...\{E92BB800-BCC5-4C25-8102-AC2C3B7C7C1E}) (Version: 5.5 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{9C912B1E-06DD-43EF-BB2B-45CB2C88BAAE}) (Version: 5.5 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{0A596141-97D5-45FA-9281-98DFAF48D579}) (Version: 10.3.2.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
    Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 17.5.2302 - AVAST Software)
    Banctec Service Agreement (HKLM-x32\...\{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}) (Version: 2.0.0 - Dell Inc.)
    Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
    BufferChm (HKLM-x32\...\{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}) (Version: 130.0.331.000 - Hewlett-Packard) Hidden
    Cisco Connect (HKLM-x32\...\Cisco Connect) (Version: 1.4.11299.0 - Cisco Consumer Products LLC)
    Complete Care Business Service Agreement (HKLM-x32\...\{0ECFCB07-9BFE-4970-ACA1-D568D982760B}) (Version: 2.0.0 - Dell Inc.)
    Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
    Copy (HKLM-x32\...\{FAF26102-09D7-4C58-AB01-0D59A2E517CA}) (Version: 130.0.366.000 - Hewlett-Packard) Hidden
    Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
    Dell Home Systems Service Agreement (HKLM-x32\...\{AB2FDE4F-6BED-4E9E-B676-3DCCEBB1FBFE}) (Version: 2.0.0 - Dell Inc.)
    Dell Resource CD (HKLM-x32\...\{42929F0F-CE14-47AF-9FC7-FF297A603021}) (Version: 1.00.0000 - Dell Inc.)
    Dell Support Center (HKLM\...\{0090A87C-3E0E-43D4-AA71-A71B06563A4A}) (Version: 3.1.5803.11 - PC-Doctor, Inc.) Hidden
    Dell Support Center (HKLM\...\Dell Support Center) (Version: 3.1.5803.11 - Dell Inc.)
    Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1209.101.204 - ALPS ELECTRIC CO., LTD.)
    Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.00.44 - Creative Technology Ltd)
    Destinations (HKLM-x32\...\{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}) (Version: 130.0.0.0 - Hewlett-Packard) Hidden
    DeviceDiscovery (HKLM-x32\...\{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}) (Version: 130.0.372.000 - Hewlett-Packard) Hidden
    DJ_AIO_06_F2400_SW_Min (HKLM-x32\...\{5546F4E9-B0F4-4F54-B949-2AB006C9284F}) (Version: 140.0.690.000 - Hewlett-Packard) Hidden
    F2400 (HKLM-x32\...\{6BAA71B6-8F43-4C72-931A-3354ABB0258A}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden
    Freemake Video Converter version 4.1.9 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.9 - Ellora Assets Corporation)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 59.0.3071.115 - Google Inc.)
    Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
    GPBaseService2 (HKLM-x32\...\{63FF21C9-A810-464F-B60A-3111747B1A6D}) (Version: 130.0.371.000 - Hewlett-Packard) Hidden
    HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
    HP Deskjet F2400 All-in-One Driver 14.0 Rel. 6 (HKLM\...\{819CA3BC-2FF8-4811-B42F-421F7BFD3559}) (Version: 14.0 - HP)
    HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
    HP Print Projects 1.0 (HKLM\...\HP Print Projects) (Version: 1.0 - HP)
    HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
    HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
    HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
    HPDiagnosticAlert (HKLM-x32\...\{B6465A32-8BE9-4B38-ADC5-4B4BDDC10B0D}) (Version: 1.00.0001 - Microsoft) Hidden
    HPPhotoGadget (HKLM-x32\...\{CAE4213F-F797-439D-BD9E-79B71D115BE3}) (Version: 130.0.282.000 - Hewlett-Packard) Hidden
    hpPrintProjects (HKLM-x32\...\{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}) (Version: 130.0.303.000 - Hewlett-Packard) Hidden
    HPProductAssistant (HKLM-x32\...\{C43326F5-F135-4551-8270-7F7ABA0462E1}) (Version: 130.0.371.000 - Hewlett-Packard) Hidden
    hpWLPGInstaller (HKLM-x32\...\{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}) (Version: 130.0.303.000 - Hewlett-Packard) Hidden
    IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6324.0 - IDT)
    Intel PROSet Wireless (HKLM-x32\...\ProInst) (Version: - ) Hidden
    Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2361 - Intel Corporation)
    Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{7CE8BE79-ABC3-4B2C-9543-28ED2B0A9EA8}) (Version: 1.2.0.0587 - Intel Corporation)
    Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{295AEB79-B53A-4F1B-860F-7800BB7E3681}) (Version: 14.2.1000 - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
    Intel(R) WiDi (HKLM-x32\...\{781A93CD-1608-427D-B7F0-D05C07795B25}) (Version: 2.1.41.0 - Intel Corporation)
    Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
    iTunes (HKLM\...\{F0C7385A-9D20-45F3-8101-05D383885180}) (Version: 12.6.1.25 - Apple Inc.)
    Java 8 Update 131 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180131F0}) (Version: 8.0.1310.11 - Oracle Corporation)
    Malwarebytes version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
    MarketResearch (HKLM-x32\...\{175F0111-2968-4935-8F70-33108C6A4DE3}) (Version: 130.0.374.000 - Hewlett-Packard) Hidden
    Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    OpenOffice.org 3.3 (HKLM-x32\...\{3E171899-0175-47CC-84C4-562ACDD4C021}) (Version: 3.3.9567 - OpenOffice.org)
    Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version: - Panda Security)
    PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
    PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
    Premium Service Agreement (HKLM-x32\...\{C33AA6D6-F5EC-48F3-AFDC-8141345D473A}) (Version: 2.0.0 - Dell Inc.)
    QualxServ Service Agreement (HKLM-x32\...\{903679E8-44C8-4C07-9600-05C92654FC50}) (Version: 2.0.0 - Dell Inc.)
    Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.25 - Dell Inc.)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.31.1025.2010 - Realtek)
    Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.)
    Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden
    Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)
    Revo Uninstaller 2.0.3 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.3 - VS Revo Group, Ltd.)
    RogueKiller version 12.11.6.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.11.6.0 - Adlice Software)
    SafeZone Stable 3.55.2393.609 (HKLM-x32\...\SafeZone 3.55.2393.609) (Version: 3.55.2393.609 - Avast Software) Hidden
    Scan (HKLM-x32\...\{06A1D88C-E102-4527-AF70-29FFD7AF215A}) (Version: 140.0.80.000 - Hewlett-Packard) Hidden
    SmartWebPrinting (HKLM-x32\...\{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden
    SolutionCenter (HKLM-x32\...\{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden
    Status (HKLM-x32\...\{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden
    Toolbox (HKLM-x32\...\{292F0F52-B62D-4E71-921B-89A682402201}) (Version: 140.0.428.000 - Hewlett-Packard) Hidden
    TrayApp (HKLM-x32\...\{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}) (Version: 130.0.376.000 - Hewlett-Packard) Hidden
    WebReg (HKLM-x32\...\{43CDF946-F5D9-4292-B006-BA0D92013021}) (Version: 130.0.132.017 - Hewlett-Packard) Hidden
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-06] (AVAST Software)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-06] (AVAST Software)
    ContextMenuHandlers01: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-06] (AVAST Software)
    ContextMenuHandlers01: [BTMSentToExt] -> {0A7D34C2-E9DA-48A1-9E34-0CDFC2DE3B44} => C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [2011-05-19] (Intel Corporation)
    ContextMenuHandlers03: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-06] (AVAST Software)
    ContextMenuHandlers03: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
    ContextMenuHandlers05: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\windows\system32\igfxpph.dll [2011-04-10] (Intel Corporation)
    ContextMenuHandlers06: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-07-06] (AVAST Software)
    ContextMenuHandlers06: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {364C3F9C-BFF7-4538-B8A8-11AE1E6A383F} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-07-06] (AVAST Software)
    Task: {38C76EBA-E24D-4401-8BC3-E34A827A7749} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-07-12] (AVAST Software)
    Task: {392F9A3E-C7DF-41DD-985E-AD6FD6E19A40} - System32\Tasks\SafeZone scheduled Autoupdate 1480617663 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-06-13] (Avast Software)
    Task: {44C9D636-ABE6-494B-A2F3-1DB826E87CB7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
    Task: {7617419B-AAAD-4034-8A5B-F97C2B515BC5} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-04-25] (Adobe Systems Incorporated)
    Task: {84CB4CE2-9FB3-4DD2-B483-D042CDD074A7} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2009-09-23] ()
    Task: {CA8625D3-E128-4F67-8C08-1B9DE60CD569} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-23] (Google Inc.)
    Task: {DEE8680C-6662-4170-B65B-D2A30A0B8A1F} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-07-12] (Adobe Systems Incorporated)
    Task: {E4CC4659-E99B-4AA8-9FA9-07849F4F4871} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-23] (Google Inc.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


    ==================== Shortcuts & WMI ========================

    (The entries could be listed to be restored or removed.)


    ==================== Loaded Modules (Whitelisted) ==============

    2011-09-15 18:46 - 2011-09-15 18:46 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
    2012-01-05 09:10 - 2011-04-10 13:40 - 00094208 _____ () C:\WINDOWS\System32\IccLibDll_x64.dll
    2017-05-09 00:44 - 2017-05-09 00:44 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2017-03-16 16:08 - 2017-03-16 16:08 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2017-05-09 03:05 - 2017-05-09 03:05 - 01354040 _____ () C:\Program Files\iTunes\libxml2.dll
    2017-05-09 03:05 - 2017-05-09 03:05 - 00092472 _____ () C:\Program Files\iTunes\zlib1.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00162032 _____ () c:\Program Files\AVAST Software\Avast\x64\vaarclient.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00831664 _____ () C:\Program Files\AVAST Software\Avast\x64\ffl2.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00276808 _____ () c:\Program Files\AVAST Software\Avast\x64\StreamBack.dll
    2017-06-27 15:58 - 2017-06-22 22:21 - 03807064 _____ () C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\libglesv2.dll
    2017-06-27 15:58 - 2017-06-22 22:21 - 00100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\libegl.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00170224 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00192664 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00224256 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
    2017-07-15 06:35 - 2017-07-15 06:35 - 05781504 _____ () C:\Program Files\AVAST Software\Avast\defs\17071500\algo.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00689272 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00231664 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll
    2017-07-12 10:39 - 2017-07-12 10:39 - 01038952 _____ () C:\Program Files\AVAST Software\Avast\AvChrome.dll
    2017-07-06 10:39 - 2017-07-06 10:39 - 67109376 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2017-07-06 10:38 - 2017-07-06 10:38 - 00292920 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
    2017-07-06 10:38 - 2017-07-06 10:39 - 02962096 _____ () C:\Program Files\AVAST Software\Avast\aswDataScan.dll
    2011-10-26 09:57 - 2011-10-26 09:57 - 00102912 _____ () C:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
    2017-05-10 09:10 - 2017-05-10 09:10 - 00169984 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\e02990982d5c841556f4bc4041a38de0\IsdiInterop.ni.dll
    2012-01-05 07:39 - 2010-11-05 23:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 21:34 - 2016-06-08 13:13 - 00000027 _____ C:\windows\system32\Drivers\etc\hosts

    127.0.0.1 localhost

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-3674130756-1144773717-1238336968-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 24.116.0.53 - 24.116.2.50
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{A322352A-BB91-45F1-8E4F-69DF5A05D987}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
    FirewallRules: [{D122B53C-55EB-482A-BFE3-751AAE9DD699}] => (Allow) C:\Program Files (x86)\Intel Corporation\Intel WiDi\WiDiApp.exe
    FirewallRules: [{15D8110C-BA18-465A-9BF5-D54703105AA6}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
    FirewallRules: [{1D7370A9-4B2E-4F88-860A-049D5DAAC927}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
    FirewallRules: [{7696917B-5B84-459E-919D-D09CAE3F6FEA}] => (Allow) C:\Program Files\dell stage\dell stage\accuweather\accuweather.exe
    FirewallRules: [{EBD3EA01-FE7C-453D-9E0F-70F1D4017A8E}] => (Allow) C:\Program Files\dell stage\musicstage\musicstageengine.exe
    FirewallRules: [{AF7132C7-8313-4DD2-963D-E2E5D9C7ED28}] => (Allow) C:\Program Files\dell stage\dell stage\stage_primary.exe
    FirewallRules: [{61BC4829-79F6-45C3-9A2B-521649FC4D04}] => (Allow) C:\Users\Angela\AppData\Local\Temp\nsuF338.tmp\CnetInstaller-75218346.exe
    FirewallRules: [{993EEDA2-DBC7-493D-950D-92A25035ACC4}] => (Allow) C:\Users\Angela\AppData\Local\Temp\nsuF338.tmp\CnetInstaller-75218346.exe
    FirewallRules: [{5E544C87-3D0E-4EB3-ABF4-788FAC004B48}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{FE331A13-3FC3-432A-9863-F7AF9DEC4050}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{A4EDA2BE-23C9-426C-A774-E6A20852D436}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{BF8A9C14-FA2F-4217-A32C-2BE549070CA9}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
    FirewallRules: [{67429FD8-7B30-483B-8E30-060DEE87ABDE}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcopy2.exe
    FirewallRules: [{BF3DE420-6DFE-4F73-9388-78920029EC7C}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
    FirewallRules: [{2C0D749D-06F8-42F0-A784-D250D7A36294}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{4852D042-8EAE-4892-9954-CC237BA91043}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
    FirewallRules: [{9B4CC0C5-83FF-4781-8A29-0BE9D80C6C28}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
    FirewallRules: [{15B9360C-635B-49CB-A703-4EECFF861FC4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
    FirewallRules: [{E1CC1179-ACE7-4B9F-A3ED-C60A5D278EBC}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    FirewallRules: [{45B6A02B-4B9E-4900-ADE9-7E6FF4670579}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
    FirewallRules: [{C16AB586-6F99-4381-8460-7A3FCD5F0506}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
    FirewallRules: [{C3EF934F-9FF2-4080-B309-B3B14C7BAB02}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
    FirewallRules: [{0AD93CC3-08BE-4B7D-9E6B-A06060B19CED}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
    FirewallRules: [{B2C05159-4F84-4523-A5C0-EABF5E7D2E87}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{AD0A1018-25D8-4996-9CF0-4759E7CE86B2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{81402701-3267-40F9-8318-39C108DBF798}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{49673414-B0B7-456B-AAF3-8AFA6449860D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{2186345B-AE50-452C-9A80-33902E76C829}] => (Allow) C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{A2103625-2C6C-4E93-898A-DCF85DE47FFA}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.607\SZBrowser.exe
    FirewallRules: [{C42AA399-D36A-4109-9C35-1308E029266C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    FirewallRules: [{9663EBC1-6F7E-4D85-AF93-2E23AEC9015C}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.609\SZBrowser.exe

    ==================== Restore Points =========================

    14-06-2017 12:19:29 Windows Update
    30-06-2017 15:38:06 Scheduled Checkpoint
    12-07-2017 18:43:45 Windows Update
    14-07-2017 19:12:19 JRT Pre-Junkware Removal

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (07/16/2017 06:21:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Error: (07/15/2017 11:45:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 1139

    Error: (07/15/2017 11:45:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 1139

    Error: (07/15/2017 11:45:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (07/15/2017 09:24:42 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 1170

    Error: (07/15/2017 09:24:42 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 1170

    Error: (07/15/2017 09:24:42 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (07/15/2017 07:00:32 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 1201

    Error: (07/15/2017 07:00:32 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 1201

    Error: (07/15/2017 07:00:32 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second


    System errors:
    =============
    Error: (07/15/2017 05:12:03 PM) (Source: DCOM) (EventID: 10010) (User: )
    Description: The server {995C996E-D918-4A8C-A302-45719A6F4EA7} did not register with DCOM within the required timeout.

    Error: (07/15/2017 11:25:04 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (07/15/2017 11:18:27 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (07/15/2017 11:15:15 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
    Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Bluetooth Device Monitor service.

    Error: (07/15/2017 11:13:14 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Bluetooth Media Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (07/15/2017 11:13:14 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Bluetooth OBEX Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (07/15/2017 11:13:09 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The HP CUE DeviceDiscovery Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (07/15/2017 11:13:09 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The hpqcxs08 service terminated unexpectedly. It has done this 1 time(s).

    Error: (07/14/2017 09:08:37 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
    Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

    Error: (07/14/2017 09:07:08 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Windows Media Player Network Sharing Service service failed to start due to the following error:
    The service did not start due to a logon failure.


    CodeIntegrity:
    ===================================
    Date: 2016-11-26 10:26:00.930
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-25 11:49:01.852
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-24 06:44:37.103
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-23 18:01:20.175
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-23 09:29:29.635
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-22 19:12:12.642
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-22 18:43:21.644
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-22 18:26:43.073
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-22 18:22:14.816
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2016-11-22 11:39:49.458
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\WINDOWS\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
    Percentage of memory in use: 44%
    Total physical RAM: 6051.18 MB
    Available physical RAM: 3363.32 MB
    Total Virtual: 12100.54 MB
    Available Virtual: 9340.84 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:451.01 GB) (Free:206.38 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1F5D8504)
    Partition 1: (Not Active) - (Size=94 MB) - (Type=DE)
    Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================

  5. #20
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
    Attached Files Attached Files

  6. #21
    Join Date
    Mar 2014
    Posts
    557
    Fix result of Farbar Recovery Scan Tool (x64) Version: 11-07-2017
    Ran by Angela (17-07-2017 06:55:51) Run:1
    Running from C:\Users\Angela\Desktop
    Loaded Profiles: Angela (Available Profiles: Angela)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
    Toolbar: HKU\S-1-5-21-3674130756-1144773717-1238336968-1001 -> No Name - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No File
    U5 AppMgmt; C:\windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
    2016-10-19 09:57 - 2016-10-17 20:28 - 2684192 _____ (COMODO) C:\Users\Angela\AppData\Roaming\temp~ccavstart.exe
    2016-10-19 09:57 - 2016-10-17 20:29 - 3856040 _____ (Terra Informatica Software, Inc.) C:\Users\Angela\AppData\Roaming\temp~cmdhtml.dll
    2015-07-23 16:23 - 2015-08-16 11:11 - 0009728 _____ () C:\Users\Angela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2016-08-10 10:49 - 2016-08-10 10:49 - 0000985 _____ () C:\ProgramData\hpzinstall.log

    *****************

    HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => key removed successfully
    HKU\S-1-5-21-3674130756-1144773717-1238336968-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{71576546-354D-41C9-AAE8-31F2EC22BF0D} => value removed successfully
    HKLM\Software\Classes\CLSID\{71576546-354D-41C9-AAE8-31F2EC22BF0D} => key not found.
    HKLM\System\CurrentControlSet\Services\AppMgmt => key removed successfully
    AppMgmt => service removed successfully
    C:\Users\Angela\AppData\Roaming\temp~ccavstart.exe => moved successfully
    C:\Users\Angela\AppData\Roaming\temp~cmdhtml.dll => moved successfully
    C:\Users\Angela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
    C:\ProgramData\hpzinstall.log => moved successfully

    ==== End of Fixlog 06:55:53 ====

  7. #22
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Last scans...

    Download Security Check from here or here and save it to your Desktop.

    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.



    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    Make sure the following options are checked:

    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
    • Other Services



    Press "Scan".
    It will create a log (FSS.txt) in the same directory the tool is run.
    Please copy and paste the log to your reply.


    Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.




    Download Sophos Free Virus Removal Tool and save it to your desktop.

    • Double click the icon and select Run
    • Click Next
    • Select I accept the terms in this license agreement, then click Next twice
    • Click Install
    • Click Finish to launch the program
    • Once the virus database has been updated click Start Scanning
    • If any threats are found click Details, then View log file... (bottom left hand corner)
    • Copy and paste the results in your reply
    • Close the Notepad document, close the Threat Details screen, then click Start cleanup
    • Click Exit to close the program

  8. #23
    Join Date
    Mar 2014
    Posts
    557
    Results of screen317's Security Check version 1.014 --- 12/23/15
    Windows 7 Service Pack 1 x64 (UAC is enabled)
    Internet Explorer 11
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    Avast Antivirus
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    Java 8 Update 131
    Java version 32-bit out of Date!
    Google Chrome (59.0.3071.115)
    Google Chrome (SetupMetrics...)
    ````````Process Check: objlist.exe by Laurent````````
    Malwarebytes Anti-Malware mbamservice.exe
    Malwarebytes Anti-Malware mbamtray.exe
    AVAST Software Avast AvastSvc.exe
    AVAST Software Avast AvastUI.exe
    AVAST Software Avast x64 aswidsagenta.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 0%
    ````````````````````End of Log``````````````````````

  9. #24
    Join Date
    Mar 2014
    Posts
    557
    Farbar Service Scanner Version: 27-01-2016
    Ran by Angela (administrator) on 18-07-2017 at 16:37:02
    Running from "C:\Users\Angela\Downloads"
    Microsoft Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Policy:
    ========================


    Action Center:
    ============


    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => File is digitally signed
    C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\System32\dhcpcore.dll => File is digitally signed
    C:\Windows\System32\drivers\afd.sys => File is digitally signed
    C:\Windows\System32\drivers\tdx.sys => File is digitally signed
    C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\System32\dnsrslvr.dll => File is digitally signed
    C:\Windows\System32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\System32\mpssvc.dll => File is digitally signed
    C:\Windows\System32\bfe.dll => File is digitally signed
    C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\System32\SDRSVC.dll => File is digitally signed
    C:\Windows\System32\vssvc.exe => File is digitally signed
    C:\Windows\System32\wscsvc.dll => File is digitally signed
    C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\System32\wuaueng.dll => File is digitally signed
    C:\Windows\System32\qmgr.dll => File is digitally signed
    C:\Windows\System32\es.dll => File is digitally signed
    C:\Windows\System32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Windows\System32\ipnathlp.dll => File is digitally signed
    C:\Windows\System32\iphlpsvc.dll => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed


    **** End of log ****

  10. #25
    Join Date
    Mar 2014
    Posts
    557
    No threats found by Sophos and my computer hasn't had any issues in a while.

  11. #26
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Update your Java version here: http://www.java.com/en/download/manual.jsp
    Alternate download: http://www.filehippo.com/search?q=java

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.
    Note 2: If you're running 64-bit system make sure you install BOTH, 32-bit and 64-bit Java.

    ======================================

    Your computer is clean

    1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
    This is a very crucial step so make sure you don't skip it.
    Download DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

    Double-click Delfix.exe to start the tool.
    Make sure the following items are checked:

    • Activate UAC (optional; some users prefer to keep it off)
    • Remove disinfection tools
    • Create registry backup
    • Purge System Restore
    • Reset system settings


    Now click "Run" and wait patiently.
    Once finished a logfile will be created. You don't have to attach it to your next reply.

    2. Make sure Windows Updates are current.

    3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    4. Check if your browser plugins are up to date.
    Firefox - https://www.mozilla.org/en-US/plugincheck/
    other browsers: https://browsercheck.qualys.com/ (click on "Scan without installing plugin" and then on "Scan now")

    5. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    6. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

    7. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    8. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    9. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    10. Read:
    How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
    Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tuto...r-safe-online/
    About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/foru.../#entry3187642

    11. Please, let me know, how your computer is doing.

  12. #27
    Join Date
    Mar 2014
    Posts
    557
    My computer seems to be running smoothly as ever. I sometimes have trouble clicking on things to get them to load, but so far that hasn't been a huge issue. Thank you for the help!

  13. #28
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Way to go!!
    Good luck and stay safe

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •