Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Computer keeps crashing and runs slowly

Started by winston66 , Mar 30 2017 10:46 AM

Please log in to reply

95 replies to this topic

#1 winston66

Advanced Member

Full Member
221 posts

Posted 30 March 2017 - 10:46 AM

Hi,

My computer keeps crashing and running slowly with slow scrolling and lots of whirring noises in the background.

I've scanned with Malwarebytes and it hasn't found anything. I enclose the latest log, plus the others that you requested.

Windows defender deleted automatically some infections.

I also ran Roguekiller and it kept crashing after about 12 minutes having found 6 infections.

I tried it in safe mode and it completed and I deleted the malware but the problem persists, so I would be grateful for some help.

I enclose the logs:

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 3/30/2017

Scan Time: 5:08 PM

Logfile: malwarebytes log.txt

Administrator: Yes

Version: 2.2.1.1043

Malware Database: v2017.03.30.05

Rootkit Database: v2017.03.11.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 10

CPU: x64

File System: NTFS

User: eddie

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 459280

Time Elapsed: 40 min, 18 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Warn

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Result of Security Analysis by Rocket Grannie (x86) Updated: 21st March, 2017

Running from:C:\Users\eddie\Downloads (18:06:26 - 03/30/2017)

***---------------------------------------------------------***

Microsoft Windows 10 Home X64

UAC is Enabled!

Internet Explorer 11

Default Browser: Microsoft Edge

***------------Antivirus - Antispyware - Firewall-----------***

Windows Firewall (Enabled)

*No other Firewall Installed*

***-------Security Programs - Browsers - Miscellaneous------***

Adobe Flash Player 24 NPAPI (version 24.0.0.221) is *out of Date*

Firefox (version 52)

Google Chrome (version 55)

Java (version 8.0.1210.13)

Microsoft Silverlight (version 5.1)

Opera (version 40)

Malwarebytes Anti-Malware version (version 2.2.1.1043) is *out of Date*

Windows Live Essentials (version 15.4.3502.0922) is *out of Date*

***----------------Analysis Complete-------------------------***

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017

Ran by eddie (administrator) on EH (30-03-2017 17:00:41)

Running from C:\Users\eddie\Downloads

Loaded Profiles: eddie (Available Profiles: eddie & DefaultAppPool)

Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Edge)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe

(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe

(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe

(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1051_none_7f2bf7ea21d201b2\TiWorker.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.239.431.0.exe

(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

(Farbar) C:\Users\eddie\Downloads\FRST64 (1).exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860040 2011-01-05] (Acer Incorporated)

HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-10-12] (Microsoft Corporation)

HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2313408 2016-04-07] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKLM\...\Policies\Explorer: [NoSetTaskbar] 0

HKLM\...\Policies\Explorer: [NoDeletePrinter] 0

HKLM\...\Policies\Explorer: [NoDFSTab] 0

HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0

HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0

HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0

HKLM\...\Policies\Explorer: [NoResolveSearch] 0

HKLM\...\Policies\Explorer: [NoHardwareTab] 0

HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoSetTaskbar] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDeletePrinter] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDFSTab] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoChangeStartMenu] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoEncryptOnMove] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoRunasInstallPrompt] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoResolveSearch] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoHardwareTab] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoInternetOpenWith] 1

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\Acer.scr [453152 2009-12-24] ()

Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] ()

ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll [2010-05-27] (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll [2010-05-27] (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

Tcpip\..\Interfaces\{604d8546-b3f4-4103-98c2-eb0147a643e1}: [DhcpNameServer] 192.168.1.1 192.168.1.1

Tcpip\..\Interfaces\{c7df49a0-6ed0-4cbe-a411-31ab0cafdee1}: [DhcpNameServer] 192.168.1.1

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-430072569-3085444723-2816121149-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131351051986745399&GUID=1CF400F0-D723-4B12-9630-2C62121F22A3

SearchScopes: HKU\S-1-5-21-430072569-3085444723-2816121149-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-430072569-3085444723-2816121149-1000 -> {3411790C-FE37-4FB4-AE93-875EC539C513} URL = hxxps://fr.search.yahoo.com/search?p={searchTerms}&intl=fr&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle

BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-02-08] (Intel Security)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-01-27] (Oracle Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-27] (Oracle Corporation)

Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-02-08] (Intel Security)

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FireFox:

========

FF DefaultProfile: vxxzpzjj.Default User

FF ProfilePath: C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\wrbmdaum.default-1401536782745 [2017-03-30]

FF NewTab: Mozilla\Firefox\Profiles\wrbmdaum.default-1401536782745 -> about:newtab

FF ProfilePath: C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\mqpc19y9.default-1419782358567 [2016-11-16]

FF NewTab: Mozilla\Firefox\Profiles\mqpc19y9.default-1419782358567 -> about:newtab

FF Extension: (Flash Protected-Mode Testing) - C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\mqpc19y9.default-1419782358567\Extensions\flash-protectedmode-beta35@experiments.mozilla.org.xpi [2014-12-28] [not signed]

FF ProfilePath: C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\hrycc2jf.default-1426499126421 [2016-11-16]

FF NewTab: Mozilla\Firefox\Profiles\hrycc2jf.default-1426499126421 -> about:newtab

FF ProfilePath: C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\iivakdjh.default-1432626449904 [2016-11-16]

FF NewTab: Mozilla\Firefox\Profiles\iivakdjh.default-1432626449904 -> about:newtab

FF ProfilePath: C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\mjwkykkj.default-1434305276277 [2016-11-16]

FF ProfilePath: C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\vxxzpzjj.Default User [2017-03-30]

FF Extension: (Bitdefender QuickScan) - C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\vxxzpzjj.Default User\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2016-11-11]

FF Extension: (Site Deployment Checker) - C:\Users\eddie\AppData\Roaming\Mozilla\Firefox\Profiles\vxxzpzjj.Default User\features\{07d78b7f-274d-4696-80a5-b61049bd3835}\deployment-checker@mozilla.org.xpi [2017-03-30]

FF Extension: (Java Console) - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2017-03-08] [not signed]

FF Extension: (Java Console) - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2017-03-08] [not signed]

FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-30] [not signed]

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_221.dll [2017-03-08] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-04-07] (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_221.dll [2017-03-08] ()

FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-27] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-27] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-03-30] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-03-30] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-04-07] (Adobe Systems)

Chrome:

=======

CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default

CHR DefaultSearchKeyword: Default -> Yahoo

CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10

CHR Profile: C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default [2017-03-30]

CHR Extension: (Google Docs) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-28]

CHR Extension: (Google Drive) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-28]

CHR Extension: (YouTube) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-28]

CHR Extension: (Yahoo Partner) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdbpcigaolookbahgdofnimidinicfid [2017-03-28]

CHR Extension: (Google Docs Offline) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-28]

CHR Extension: (Chrome Web Store Payments) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-28]

CHR Extension: (Gmail) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-28]

CHR Extension: (Chrome Media Router) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-28]

CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [fdbpcigaolookbahgdofnimidinicfid] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [694464 2016-04-07] (Adobe Systems Incorporated)

R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2227312 2017-02-27] (Adobe Systems, Incorporated)

S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)

R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7183632 2016-07-18] (TeamViewer GmbH)

R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [996824 2017-02-06] (McAfee, Inc.)

R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16248 2017-02-06] (McAfee, Inc.)

S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2017-02-06] (McAfee, Inc.)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-03-04] (Microsoft Corporation)

S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [115832 2016-07-21] (Emsisoft Ltd)

S3 MEMOQDRV; C:\WINDOWS\System32\drivers\memoqdrv.sys [30584 2010-01-20] (BCPC)

R1 MpKsl67a4976d; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{61559E1F-80DA-44F7-AD03-5712E8CE0B30}\MpKsl67a4976d.sys [44928 2017-03-30] (Microsoft Corporation)

S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

S3 PSKMAD; C:\WINDOWS\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2017-03-30] ()

S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-03-30] (Zemana Ltd.)

U3 idsvc; no ImagePath

S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-03-30 17:00 - 2017-03-30 17:00 - 02424832 _____ (Farbar) C:\Users\eddie\Downloads\FRST64 (1).exe

2017-03-30 16:59 - 2017-03-30 16:59 - 01766912 _____ (Farbar) C:\Users\eddie\Downloads\FRST.exe

2017-03-30 16:43 - 2017-03-30 16:44 - 00524248 _____ (F-Secure Corporation) C:\Users\eddie\Downloads\6E39.tmp

2017-03-30 16:43 - 2017-03-30 16:43 - 00524248 _____ (F-Secure Corporation) C:\Users\eddie\Downloads\D4B3.tmp

2017-03-30 15:30 - 2017-03-30 15:31 - 05766464 _____ (Zemana Ltd. ) C:\Users\eddie\Downloads\Zemana.AntiMalware.Setup (1).exe

2017-03-30 15:27 - 2017-03-30 15:27 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys

2017-03-30 15:26 - 2017-03-30 15:26 - 05766464 _____ (Zemana Ltd. ) C:\Users\eddie\Downloads\Zemana.AntiMalware.Setup.exe

2017-03-30 12:27 - 2017-03-30 12:28 - 32824320 _____ (Tweaking.com) C:\Users\eddie\Downloads\tweaking.com_windows_repair_aio_setup (1).exe

2017-03-30 09:46 - 2017-03-30 09:46 - 35099168 _____ (Adlice Software ) C:\Users\eddie\Downloads\setup (3).exe

2017-03-30 09:43 - 2017-03-30 10:02 - 00001295 _____ C:\Users\eddie\Desktop\Google Chrome.lnk

2017-03-30 09:25 - 2017-03-30 09:47 - 00000903 _____ C:\Users\Public\Desktop\RogueKiller.lnk

2017-03-30 09:24 - 2017-03-30 09:25 - 35099168 _____ (Adlice Software ) C:\Users\eddie\Downloads\setup (2).exe

2017-03-30 09:14 - 2017-03-30 09:16 - 35099168 _____ (Adlice Software ) C:\Users\eddie\Downloads\setup.exe

2017-03-30 08:40 - 2017-03-30 08:40 - 00002348 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2017-03-30 08:40 - 2017-03-30 08:40 - 00002336 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2017-03-30 08:39 - 2017-03-30 08:39 - 00003416 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2017-03-30 08:39 - 2017-03-30 08:39 - 00003292 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2017-03-29 22:03 - 2017-03-29 22:04 - 04089296 _____ C:\Users\eddie\Downloads\4AC9.tmp

2017-03-29 22:03 - 2017-03-29 22:03 - 04089296 _____ C:\Users\eddie\Downloads\4A3B.tmp

2017-03-29 17:10 - 2017-03-29 17:10 - 04089296 _____ C:\Users\eddie\Downloads\AdwCleaner (10).exe

2017-03-29 15:55 - 2017-03-29 15:55 - 00134301 _____ C:\Users\eddie\Downloads\blank_tshirt_v2_red.pdf

2017-03-29 15:52 - 2017-03-29 15:52 - 00161723 _____ C:\Users\eddie\Downloads\T-Shirt (6).pdf

2017-03-28 18:58 - 2017-03-28 18:58 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (9).exe

2017-03-27 17:44 - 2017-03-30 09:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller

2017-03-27 17:44 - 2017-03-30 09:47 - 00000000 ____D C:\Program Files\RogueKiller

2017-03-27 17:42 - 2017-03-27 17:43 - 35099168 _____ (Adlice Software ) C:\Users\eddie\Downloads\setup (1).exe

2017-03-27 17:24 - 2017-03-27 17:25 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (8).exe

2017-03-26 18:46 - 2017-03-26 18:46 - 01535288 _____ C:\Users\eddie\Downloads\eage_2015_-_a_geophysical_workflow_for_effective_prospect_assessment_-_case_study_-_henke_-hassan.pdf

2017-03-26 15:07 - 2017-03-26 15:07 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-EH-Windows-10-Home-(64-bit).dat

2017-03-26 15:07 - 2017-03-26 15:07 - 00000000 ____D C:\RegBackup

2017-03-26 14:08 - 2017-03-30 12:32 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job

2017-03-26 14:04 - 2017-03-30 12:29 - 00381154 _____ C:\WINDOWS\Tweaking.com - Windows Repair Setup Log.txt

2017-03-26 14:04 - 2017-03-26 14:04 - 00000000 ____D C:\Program Files (x86)\Tweaking.com

2017-03-26 14:03 - 2017-03-26 14:04 - 32824320 _____ (Tweaking.com) C:\Users\eddie\Downloads\tweaking.com_windows_repair_aio_setup.exe

2017-03-26 13:24 - 2017-03-26 13:24 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (7).exe

2017-03-26 09:33 - 2017-03-26 09:33 - 00536520 _____ (Hola Networks Ltd.) C:\Users\eddie\Downloads\Hola-Setup (1).exe

2017-03-25 18:56 - 2017-03-25 18:56 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (6).exe

2017-03-25 18:51 - 2017-03-25 18:52 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (5).exe

2017-03-24 21:02 - 2017-03-24 21:02 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (4).exe

2017-03-24 20:21 - 2017-03-24 20:21 - 11141180 _____ C:\Users\eddie\Desktop\R0003.wav

2017-03-24 16:44 - 2017-03-24 16:44 - 00041689 _____ C:\Users\eddie\Downloads\wetransfer-d5c195.zip

2017-03-24 16:43 - 2017-03-24 16:43 - 00021366 _____ C:\Users\eddie\Downloads\Win7_64bit.zip

2017-03-21 15:56 - 2017-03-21 15:57 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (3).exe

2017-03-20 20:42 - 2017-03-20 20:42 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (2).exe

2017-03-19 17:54 - 2017-03-19 17:55 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner (1).exe

2017-03-19 17:48 - 2017-03-19 17:48 - 04031440 _____ C:\Users\eddie\Downloads\AdwCleaner.exe

2017-03-19 10:45 - 2017-03-19 10:45 - 00536520 _____ (Hola Networks Ltd.) C:\Users\eddie\Downloads\Hola-Setup.exe

2017-03-19 10:43 - 2017-03-19 10:44 - 01281696 _____ (UCWeb Inc.) C:\Users\eddie\Downloads\UCBrowser_V6.1.2015.1007_windows_pf101_(Build17022118).exe

2017-03-15 21:32 - 2017-03-04 09:40 - 00965472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2017-03-15 21:32 - 2017-03-04 09:09 - 01969912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll

2017-03-15 21:32 - 2017-03-04 09:04 - 01362512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpmde.dll

2017-03-15 21:32 - 2017-03-04 09:02 - 00184416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IPHLPAPI.DLL

2017-03-15 21:32 - 2017-03-04 08:56 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll

2017-03-15 21:32 - 2017-03-04 08:53 - 02256080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2017-03-15 21:32 - 2017-03-04 08:53 - 01431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2017-03-15 21:32 - 2017-03-04 08:53 - 00975744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll

2017-03-15 21:32 - 2017-03-04 08:53 - 00861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2017-03-15 21:32 - 2017-03-04 08:53 - 00781152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe

2017-03-15 21:32 - 2017-03-04 08:53 - 00493912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2017-03-15 21:32 - 2017-03-04 08:52 - 00549088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll

2017-03-15 21:32 - 2017-03-04 08:52 - 00272720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll

2017-03-15 21:32 - 2017-03-04 08:47 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2017-03-15 21:32 - 2017-03-04 08:47 - 06667528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll

2017-03-15 21:32 - 2017-03-04 08:47 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll

2017-03-15 21:32 - 2017-03-04 08:45 - 00173408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\basecsp.dll

2017-03-15 21:32 - 2017-03-04 08:42 - 01260784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2017-03-15 21:32 - 2017-03-04 08:42 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll

2017-03-15 21:32 - 2017-03-04 08:40 - 00306800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll

2017-03-15 21:32 - 2017-03-04 08:36 - 05685760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll

2017-03-15 21:32 - 2017-03-04 08:30 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll

2017-03-15 21:32 - 2017-03-04 08:30 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll

2017-03-15 21:32 - 2017-03-04 08:30 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe

2017-03-15 21:32 - 2017-03-04 08:29 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssitlb.dll

2017-03-15 21:32 - 2017-03-04 08:29 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctfp.dll

2017-03-15 21:32 - 2017-03-04 08:29 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XInputUap.dll

2017-03-15 21:32 - 2017-03-04 08:29 - 00019968 _____ C:\WINDOWS\SysWOW64\GamePanelExternalHook.dll

2017-03-15 21:32 - 2017-03-04 08:28 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExSMime.dll

2017-03-15 21:32 - 2017-03-04 08:27 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddrawex.dll

2017-03-15 21:32 - 2017-03-04 08:26 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll

2017-03-15 21:32 - 2017-03-04 08:26 - 00177664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll

2017-03-15 21:32 - 2017-03-04 08:26 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll

2017-03-15 21:32 - 2017-03-04 08:26 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VCardParser.dll

2017-03-15 21:32 - 2017-03-04 08:26 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.UI.GameBar.dll

2017-03-15 21:32 - 2017-03-04 08:26 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll

2017-03-15 21:32 - 2017-03-04 08:26 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netiougc.exe

2017-03-15 21:32 - 2017-03-04 08:25 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp

2017-03-15 21:32 - 2017-03-04 08:25 - 00251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mscandui.dll

2017-03-15 21:32 - 2017-03-04 08:25 - 00136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinRtTracing.dll

2017-03-15 21:32 - 2017-03-04 08:25 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BrowserSettingSync.dll

2017-03-15 21:32 - 2017-03-04 08:25 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.SystemManagement.dll

2017-03-15 21:32 - 2017-03-04 08:25 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WPDShServiceObj.dll

2017-03-15 21:32 - 2017-03-04 08:25 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tbauth.dll

2017-03-15 21:32 - 2017-03-04 08:24 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scksp.dll

2017-03-15 21:32 - 2017-03-04 08:24 - 00093184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctfui.dll

2017-03-15 21:32 - 2017-03-04 08:24 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.Ngc.dll

2017-03-15 21:32 - 2017-03-04 08:24 - 00022016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerCookies.exe

2017-03-15 21:32 - 2017-03-04 08:23 - 00531456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iprtrmgr.dll

2017-03-15 21:32 - 2017-03-04 08:23 - 00392192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll

2017-03-15 21:32 - 2017-03-04 08:23 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll

2017-03-15 21:32 - 2017-03-04 08:23 - 00299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll

2017-03-15 21:32 - 2017-03-04 08:23 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll

2017-03-15 21:32 - 2017-03-04 08:23 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netiohlp.dll

2017-03-15 21:32 - 2017-03-04 08:22 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2017-03-15 21:32 - 2017-03-04 08:22 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll

2017-03-15 21:32 - 2017-03-04 08:22 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cemapi.dll

2017-03-15 21:32 - 2017-03-04 08:22 - 00183296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFilterHost.exe

2017-03-15 21:32 - 2017-03-04 08:21 - 01243136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll

2017-03-15 21:32 - 2017-03-04 08:21 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\main.cpl

2017-03-15 21:32 - 2017-03-04 08:21 - 00575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2017-03-15 21:32 - 2017-03-04 08:21 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll

2017-03-15 21:32 - 2017-03-04 08:21 - 00196608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tapi32.dll

2017-03-15 21:32 - 2017-03-04 08:21 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Identity.Provider.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPTpm12.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00424960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msutb.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanui.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WwaApi.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vaultcli.dll

2017-03-15 21:32 - 2017-03-04 08:20 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll

2017-03-15 21:32 - 2017-03-04 08:19 - 00714752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll

2017-03-15 21:32 - 2017-03-04 08:19 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2017-03-15 21:32 - 2017-03-04 08:19 - 00431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll

2017-03-15 21:32 - 2017-03-04 08:19 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv

2017-03-15 21:32 - 2017-03-04 08:19 - 00318464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll

2017-03-15 21:32 - 2017-03-04 08:19 - 00181760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tcpipcfg.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 01231360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wcnwiz.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00819200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppContracts.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00567808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssphtb.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll

2017-03-15 21:32 - 2017-03-04 08:18 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll

2017-03-15 21:32 - 2017-03-04 08:17 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll

2017-03-15 21:32 - 2017-03-04 08:17 - 00297472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe

2017-03-15 21:32 - 2017-03-04 08:16 - 01456640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00968704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00858112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasgcw.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NaturalLanguage6.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00762880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mprddm.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl

2017-03-15 21:32 - 2017-03-04 08:16 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00636928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll

2017-03-15 21:32 - 2017-03-04 08:16 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll

2017-03-15 21:32 - 2017-03-04 08:15 - 01543680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmc.exe

2017-03-15 21:32 - 2017-03-04 08:15 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2017-03-15 21:32 - 2017-03-04 08:15 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\azroleui.dll

2017-03-15 21:32 - 2017-03-04 08:14 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll

2017-03-15 21:32 - 2017-03-04 08:13 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2017-03-15 21:32 - 2017-03-04 08:13 - 04613120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2017-03-15 21:32 - 2017-03-04 08:13 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll

2017-03-15 21:32 - 2017-03-04 08:13 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll

2017-03-15 21:32 - 2017-03-04 08:13 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll

2017-03-15 21:32 - 2017-03-04 08:13 - 00256512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll

2017-03-15 21:32 - 2017-03-04 08:12 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll

2017-03-15 21:32 - 2017-03-04 08:12 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2017-03-15 21:32 - 2017-03-04 08:12 - 00700416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.Search.dll

2017-03-15 21:32 - 2017-03-04 08:12 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll

2017-03-15 21:32 - 2017-03-04 08:11 - 01323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll

2017-03-15 21:32 - 2017-03-04 08:11 - 01320448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll

2017-03-15 21:32 - 2017-03-04 08:11 - 01137152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll

2017-03-15 21:32 - 2017-03-04 08:11 - 00355328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTMediaFrame.dll

2017-03-15 21:32 - 2017-03-04 08:10 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\regedit.exe

2017-03-15 21:32 - 2017-03-04 08:10 - 00259584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcuiu.dll

2017-03-15 21:32 - 2017-03-04 08:09 - 00570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll

2017-03-15 21:32 - 2017-03-04 08:07 - 02748928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll

2017-03-15 21:32 - 2017-03-04 08:07 - 02643456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll

2017-03-15 21:32 - 2017-03-04 08:07 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll

2017-03-15 21:32 - 2017-03-04 08:06 - 02153984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll

2017-03-15 21:32 - 2017-03-04 08:06 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll

2017-03-15 21:32 - 2017-03-04 08:05 - 07468544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2017-03-15 21:32 - 2017-03-04 08:05 - 03520512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe

2017-03-15 21:32 - 2017-03-04 08:05 - 01133568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vssapi.dll

2017-03-15 21:32 - 2017-03-04 08:05 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidprov.dll

2017-03-15 21:32 - 2017-03-04 08:05 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll

2017-03-15 21:32 - 2017-03-04 08:04 - 00719872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_sr.dll

2017-03-15 21:32 - 2017-03-04 08:03 - 06044672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2017-03-15 21:32 - 2017-03-04 08:03 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2017-03-15 21:32 - 2017-03-04 08:03 - 00409600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVSENCD.DLL

2017-03-15 21:32 - 2017-03-04 08:03 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxclu.dll

2017-03-15 21:32 - 2017-03-04 08:02 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll

2017-03-15 21:32 - 2017-03-04 08:02 - 01004544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll

2017-03-15 21:32 - 2017-03-04 08:02 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll

2017-03-15 21:32 - 2017-03-04 08:02 - 00510464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr

2017-03-15 21:32 - 2017-03-04 08:01 - 03478528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbon.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 02682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 01988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 01656320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Perception.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 01595904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 01293312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe

2017-03-15 21:32 - 2017-03-04 08:01 - 01232384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 01154560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Pimstore.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 01013248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 00827904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe

2017-03-15 21:32 - 2017-03-04 08:01 - 00620544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 00560640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll

2017-03-15 21:32 - 2017-03-04 08:01 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 04557824 _____ (Microsoft) C:\WINDOWS\SysWOW64\dbgeng.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 02996736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys

2017-03-15 21:32 - 2017-03-04 08:00 - 02483200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 02026496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2017-03-15 21:32 - 2017-03-04 08:00 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 00862208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 00850944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 00691200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 00598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll

2017-03-15 21:32 - 2017-03-04 08:00 - 00444416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll

2017-03-15 21:32 - 2017-03-04 07:57 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe

2017-03-15 21:32 - 2017-03-04 07:57 - 00783360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll

2017-03-15 21:32 - 2017-03-04 07:57 - 00449024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll

2017-03-15 21:32 - 2017-03-04 07:57 - 00299008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RADCUI.dll

2017-03-15 21:31 - 2017-03-04 09:57 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2017-03-15 21:31 - 2017-03-04 09:57 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2017-03-15 21:31 - 2017-03-04 09:57 - 00192352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll

2017-03-15 21:31 - 2017-03-04 09:09 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll

2017-03-15 21:31 - 2017-03-04 09:09 - 00497416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll

2017-03-15 21:31 - 2017-03-04 09:06 - 01706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll

2017-03-15 21:31 - 2017-03-04 09:04 - 02048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll

2017-03-15 21:31 - 2017-03-04 08:56 - 00248992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll

2017-03-15 21:31 - 2017-03-04 08:54 - 02277288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll

2017-03-15 21:31 - 2017-03-04 08:54 - 00524776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll

2017-03-15 21:31 - 2017-03-04 08:53 - 05722320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll

2017-03-15 21:31 - 2017-03-04 08:53 - 00313568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll

2017-03-15 21:31 - 2017-03-04 08:53 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll

2017-03-15 21:31 - 2017-03-04 08:51 - 01980768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll

2017-03-15 21:31 - 2017-03-04 08:51 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll

2017-03-15 21:31 - 2017-03-04 08:50 - 00846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 04023000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 01853224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 01360456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 01344448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 01277856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 01202384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 01123912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 00981376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 00976184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 00952416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 00640976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 00530480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 00374448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 00352760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MMDevAPI.dll

2017-03-15 21:31 - 2017-03-04 08:47 - 00034088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CompPkgSup.dll

2017-03-15 21:31 - 2017-03-04 08:46 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2017-03-15 21:31 - 2017-03-04 08:46 - 00321792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe

2017-03-15 21:31 - 2017-03-04 08:45 - 00112120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpapi.dll

2017-03-15 21:31 - 2017-03-04 08:42 - 01415240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll

2017-03-15 21:31 - 2017-03-04 08:42 - 00545944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe

2017-03-15 21:31 - 2017-03-04 08:30 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll

2017-03-15 21:31 - 2017-03-04 08:30 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll

2017-03-15 21:31 - 2017-03-04 08:27 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\accountaccessor.dll

2017-03-15 21:31 - 2017-03-04 08:27 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Radios.dll

2017-03-15 21:31 - 2017-03-04 08:27 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll

2017-03-15 21:31 - 2017-03-04 08:26 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll

2017-03-15 21:31 - 2017-03-04 08:26 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll

2017-03-15 21:31 - 2017-03-04 08:26 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll

2017-03-15 21:31 - 2017-03-04 08:26 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfdprov.dll

2017-03-15 21:31 - 2017-03-04 08:25 - 00175104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll

2017-03-15 21:31 - 2017-03-04 08:25 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCCSEngineShared.dll

2017-03-15 21:31 - 2017-03-04 08:24 - 00328192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll

2017-03-15 21:31 - 2017-03-04 08:24 - 00142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll

2017-03-15 21:31 - 2017-03-04 08:24 - 00129024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SerialCommunication.dll

2017-03-15 21:31 - 2017-03-04 08:24 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll

2017-03-15 21:31 - 2017-03-04 08:23 - 00506368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe

2017-03-15 21:31 - 2017-03-04 08:23 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.LowLevel.dll

2017-03-15 21:31 - 2017-03-04 08:23 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DavSyncProvider.dll

2017-03-15 21:31 - 2017-03-04 08:23 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll

2017-03-15 21:31 - 2017-03-04 08:23 - 00184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll

2017-03-15 21:31 - 2017-03-04 08:22 - 01299968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll

2017-03-15 21:31 - 2017-03-04 08:22 - 00332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll

2017-03-15 21:31 - 2017-03-04 08:22 - 00265728 _____ C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll

2017-03-15 21:31 - 2017-03-04 08:22 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll

2017-03-15 21:31 - 2017-03-04 08:22 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\icm32.dll

2017-03-15 21:31 - 2017-03-04 08:22 - 00117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthBroker.dll

2017-03-15 21:31 - 2017-03-04 08:22 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll

2017-03-15 21:31 - 2017-03-04 08:21 - 00670208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll

2017-03-15 21:31 - 2017-03-04 08:21 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Import.dll

2017-03-15 21:31 - 2017-03-04 08:21 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll

2017-03-15 21:31 - 2017-03-04 08:21 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll

2017-03-15 21:31 - 2017-03-04 08:21 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll

2017-03-15 21:31 - 2017-03-04 08:20 - 13873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2017-03-15 21:31 - 2017-03-04 08:20 - 00562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll

2017-03-15 21:31 - 2017-03-04 08:20 - 00386048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll

2017-03-15 21:31 - 2017-03-04 08:20 - 00325120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleacc.dll

2017-03-15 21:31 - 2017-03-04 08:20 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll

2017-03-15 21:31 - 2017-03-04 08:20 - 00271360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll

2017-03-15 21:31 - 2017-03-04 08:20 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll

2017-03-15 21:31 - 2017-03-04 08:19 - 00498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mbsmsapi.dll

2017-03-15 21:31 - 2017-03-04 08:19 - 00390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll

2017-03-15 21:31 - 2017-03-04 08:19 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll

2017-03-15 21:31 - 2017-03-04 08:19 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll

2017-03-15 21:31 - 2017-03-04 08:18 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll

2017-03-15 21:31 - 2017-03-04 08:18 - 00525824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintDialogs.dll

2017-03-15 21:31 - 2017-03-04 08:18 - 00314368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll

2017-03-15 21:31 - 2017-03-04 08:18 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll

2017-03-15 21:31 - 2017-03-04 08:17 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll

2017-03-15 21:31 - 2017-03-04 08:17 - 00238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll

2017-03-15 21:31 - 2017-03-04 08:16 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mscms.dll

2017-03-15 21:31 - 2017-03-04 08:16 - 00500224 _____ (Microsoft Corporation) C

Attached Files

Addition.txt 44.45KB 125 downloads

#2 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,162 posts

Posted 30 March 2017 - 03:51 PM

Hello winston66 and welcome to SpywareInfo Forum.
I'm Android 8888 and I'll be helping you. Please ask questions if anything is unclear.

I see you have Team Viewer installed. This is a remote access program, and is a potential risk if unneeded or unused. If not needed, I would recommend uninstalling it. If you decide to keep it, be sure you have a strong password of at least 8 characters (more is better), including at least one lower case letter, one upper case letter, at least one number, and at least one special character (upper case on the number keys).

Please remove the following extensions from Google Chrome:
Chrome Web Store Payments
Chrome Media Router

Click on the Chrome menu (the icon with three vertical dots) on the browser toolbar.
Click Tools and select Extensions.
Click the trash can icon in Chrome Web Store Payments and Chrome Media Router.
A confirmation dialog appears, click Remove.

Next,

Please perform the following fix with FRST.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and click the OK button.
Please copy the entire contents of the code box below. To do this highlight the contents of the box and right click on it and select Copy.
Paste this into the open Notepad.

Start
CloseProcesses:

CreateRestorePoint:

EmptyTemp:
HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKLM\...\Policies\Explorer: [NoSetTaskbar] 0
HKLM\...\Policies\Explorer: [NoDeletePrinter] 0
HKLM\...\Policies\Explorer: [NoDFSTab] 0
HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0
HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 0
HKLM\...\Policies\Explorer: [NoHardwareTab] 0
HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoInternetOpenWith] 1
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131351051986745399&GUID=1CF400F0-D723-4B12-9630-2C62121F22A3
SearchScopes: HKU\S-1-5-21-430072569-3085444723-2816121149-1000 -> {3411790C-FE37-4FB4-AE93-875EC539C513} URL = hxxps://fr.search.yahoo.com/search?p={searchTerms}&intl=fr&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
FF NewTab: Mozilla\Firefox\Profiles\wrbmdaum.default-1401536782745 -> about:newtab
FF NewTab: Mozilla\Firefox\Profiles\mqpc19y9.default-1419782358567 -> about:newtab
FF NewTab: Mozilla\Firefox\Profiles\hrycc2jf.default-1426499126421 -> about:newtab
FF NewTab: Mozilla\Firefox\Profiles\iivakdjh.default-1432626449904 -> about:newtab
FF Extension: (Java Console) - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2017-03-08] [not signed]
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Extension: (Chrome Web Store Payments) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-28]
CHR Extension: (Chrome Media Router) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-28]
S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X]
U3 idsvc; no ImagePath
S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam64.sys [X]
Task: {155FD0C4-E86E-408A-B17F-3A9E3069C662} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {18DB92AF-9F76-43C9-A8A9-B6F2E32A7BBC} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {198CC7EB-AB2F-4A07-B3A2-6E3539906430} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {21DC01BF-78F9-4BE5-9E0D-A064CD9884C7} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {27FFD92F-3382-47E9-B6B6-B33D557980CB} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {2C140CCA-F1F4-453B-A078-2CA84D04C9FA} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {32DB4263-CCE9-48EB-A403-E06C2250BBBD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {3EB1BA3B-FD23-4B59-ACD4-F48BD54C71D7} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {658A9CE7-38CF-4DF7-835A-E575BD554FD6} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {67508C3D-C2B5-42D0-B8AC-2B074AEA569B} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {9DB0208C-AD66-4E78-8607-7367AB17356A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {AEB18A8B-A9FC-464D-8802-602CC2863E10} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {D4B0B0D2-B2F1-4863-B666-7F0FC4DF1A25} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {D653D269-49D1-464C-93E6-1A0383D6F4D9} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {D65E8FFC-CA1A-4D2B-82B4-83372694C92E} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {FAFAD28F-810B-47E3-B1BA-41F12F737192} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Public\Desktop\Acer Accessory Store.lnk -> C:\Program Files\Acer Accessory Store\StartURL.exe () -> hxxp://store.acer-euro.com/gb?utm_source=Icon&utm_medium=Icon&utm_campaign=Acer%2BInternal
AlternateDataStreams: C:\Users\eddie\Downloads\cispremium_only_installer (1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\eddie\Downloads\cispremium_only_installer (1).exe:$CmdZnID [26]
127.0.0.1 localhost
FirewallRules: [{1879679C-0274-47E4-B133-743AD754987D}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{54E87D07-11A7-4CCC-8109-A54FC5166667}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{3D3EDE53-75E3-42B9-9624-302767880E13}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{EE77EDF0-E3B2-4F83-AFF1-E682B0549268}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
C:\Program Files (x86)\AVG\AVG2012
C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
C:\Program Files (x86)\AVG\AVG2013
C:\Program Files (x86)\AVG
End

Save the file as fixlist.txt in to the same folder as FRST64.
Right-click the FRST64 icon and select Run as administrator to run the tool.
Click the Fix button only once and wait.
When finished FRST will generate a log on the Desktop (fixlog.txt). Please post it in your next reply.

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

Please download Malwarebytes Anti-Rootkit BETA and save it to your Desktop.

Right-click on the icon and select Run as administrator to start the extraction of the program;
Click Yes to accept the security warning that may appear;
Click OK to extract it to your Desktop (MBAR will be launched shortly after the extraction);
Click on Next, and then on the Update button to let it update its database. Once the database has been successfully updated, click on Next;
Make sure all the checkboxes are checked, then click on the Scan button, and let it completes its scan (this can take a while);
Once the scan is done, if threats are found, make sure that every item is checked, and click on the Cleanup button (a reboot might be required);
After that (and the reboot, if one was required), go back in the mbar folder and look for a text file called mbar-log-TODAY'S-DATE.txt;
Please copy and paste the entire contents of that log in your next reply;

To summarize, please post the entire contents of:
fixlog.txt;
mbar-log.

Let me also know how is your computer running. Does it still slow with noises and crashing?

Thank you.

Android 8888

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

#3 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 01:02 AM

Hi Android 8888.

Thank you very much for the assistance.

Firstly, late last night I lost Chrome (blank screen) so switched to Firefox.

I left the computer on overnight and Chrome was back again ?

I have not found any trace of chrome webstore or chrome media route in extensions.

The only enabled ones there are google docs and google docs office.

I'm sorry but I've tried and tried to put the tool you posted into the FRST folder but don't know how to do it.

The only place I can find FRST is in downloads and the one with the 30/03/2017 date is FRST (1)

Can you please give ABC instructions.

I enclose below the Mbar log. The scan was trouble free.

Malwarebytes Anti-Rootkit BETA 1.9.3.1001

www.malwarebytes.org

Database version:

main: v2017.03.31.02

rootkit: v2017.03.11.01

Windows 10 x64 NTFS

Internet Explorer 11.953.14393.0

eddie :: EH [administrator]

3/31/2017 8:03:20 AM

mbar-log-2017-03-31 (08-03-20).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 459605

Time elapsed: 39 minute(s), 55 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

The computer is very quiet now and appears to be running okay.

Kind regards

Winston66

#4 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 01:55 AM

Hi Android 8888

I've just come across something odd.

I have just tried logging into a site called Money am, which is potentially a share dealing site, although I just use it for information and my password will not work.

I have requested a new one from the link on the site, which by now should be in my in box.

#5 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 02:22 AM

Hi Android 8888

I've just had a screen freeze again, which lasted about a minute with lots of whirring sound.

I had trouble typing this first time in chrome browser. Letters displayed about 20secs after they were typed and then the screen froze completely and then Chrome blacked out once again.

I'm now back in Firefox.

Regards,

Winston66

Edited by winston66, 31 March 2017 - 03:46 AM.

#6 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 02:33 AM

Hi again.

Latest update. Firefox crashed so I rebooted and tried Chrome again which now works.

Regards,

Winston66

#7 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 03:28 AM

Hi again Android 8888

I went onto a football website Arsenal news now and this appeared.

I don't know if it is genuine or not:

Votre Windows (Windows 10) est infecté par (3) virus. Le pré-scan a trouvé des traces de (2) logiciels malveillants et (1) hameçonnage / espiogiciel. Dégâts du système: 28,1% - La suppression immédiate est resquise!

La suppression de (3) Virus est nécessaire immédiatement pour éviter d'autres dommages au système, la perte des applications, de photos ou d'autres fichiers.

Des traces de (1) Hameçonnage/Espiogiciel ont été trouvés sur votre Windows (Windows 10). Les informations personnels et bancaires sont à risque.

I don't know if you understand french but basically I've got 3 viruses, 2 sortware infections and a phishing spyware. 28.1% of the system has been damaged.

Kind regards,

Winston66

Edited by winston66, 31 March 2017 - 03:46 AM.

#8 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,162 posts

Posted 31 March 2017 - 04:52 AM

Hello winston66.

I enclose below the Mbar log. The scan was trouble free.

Good work. This is a good sign.

Okay, I'll give instructions step by step on how to proceed to run the fix script with the Farbar Recovery Scan Tool (FRST).

FRST can work within any folder but was designed to obtain greater reliability when running from the Desktop such as most part of the malware removal tools.

So please move your FRST64 executable file from the downloads folder to your computer's Desktop. There is no problem in doing this because after the cleaning process we will remove all the tools that were used, including the Farbar tool.

Now press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and click the OK button.
Please copy the entire contents of the code box below. To do this highlight the contents of the box and right click on it and select Copy. NOTE: Do not include the word "Quote".
Paste this into the open Notepad file.

Start
CloseProcesses:
CreateRestorePoint:
EmptyTemp:
HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKLM\...\Policies\Explorer: [NoSetTaskbar] 0
HKLM\...\Policies\Explorer: [NoDeletePrinter] 0
HKLM\...\Policies\Explorer: [NoDFSTab] 0
HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0
HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 0
HKLM\...\Policies\Explorer: [NoHardwareTab] 0
HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\...\Policies\Explorer: [NoInternetOpenWith] 1
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-430072569-3085444723-2816121149-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131351051986745399&GUID=1CF400F0-D723-4B12-9630-2C62121F22A3
SearchScopes: HKU\S-1-5-21-430072569-3085444723-2816121149-1000 -> {3411790C-FE37-4FB4-AE93-875EC539C513} URL = hxxps://fr.search.yahoo.com/search?p={searchTerms}&intl=fr&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
FF NewTab: Mozilla\Firefox\Profiles\wrbmdaum.default-1401536782745 -> about:newtab
FF NewTab: Mozilla\Firefox\Profiles\mqpc19y9.default-1419782358567 -> about:newtab
FF NewTab: Mozilla\Firefox\Profiles\hrycc2jf.default-1426499126421 -> about:newtab
FF NewTab: Mozilla\Firefox\Profiles\iivakdjh.default-1432626449904 -> about:newtab
FF Extension: (Java Console) - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2017-03-08] [not signed]
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Extension: (Chrome Web Store Payments) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-28]
CHR Extension: (Chrome Media Router) - C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-28]
S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X]
U3 idsvc; no ImagePath
S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam64.sys [X]
Task: {155FD0C4-E86E-408A-B17F-3A9E3069C662} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {18DB92AF-9F76-43C9-A8A9-B6F2E32A7BBC} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {198CC7EB-AB2F-4A07-B3A2-6E3539906430} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {21DC01BF-78F9-4BE5-9E0D-A064CD9884C7} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {27FFD92F-3382-47E9-B6B6-B33D557980CB} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {2C140CCA-F1F4-453B-A078-2CA84D04C9FA} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {32DB4263-CCE9-48EB-A403-E06C2250BBBD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {3EB1BA3B-FD23-4B59-ACD4-F48BD54C71D7} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {658A9CE7-38CF-4DF7-835A-E575BD554FD6} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {67508C3D-C2B5-42D0-B8AC-2B074AEA569B} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {9DB0208C-AD66-4E78-8607-7367AB17356A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {AEB18A8B-A9FC-464D-8802-602CC2863E10} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {D4B0B0D2-B2F1-4863-B666-7F0FC4DF1A25} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {D653D269-49D1-464C-93E6-1A0383D6F4D9} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {D65E8FFC-CA1A-4D2B-82B4-83372694C92E} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {FAFAD28F-810B-47E3-B1BA-41F12F737192} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Public\Desktop\Acer Accessory Store.lnk -> C:\Program Files\Acer Accessory Store\StartURL.exe () -> hxxp://store.acer-euro.com/gb?utm_source=Icon&utm_medium=Icon&utm_campaign=Acer%2BInternal
AlternateDataStreams: C:\Users\eddie\Downloads\cispremium_only_installer (1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\eddie\Downloads\cispremium_only_installer (1).exe:$CmdZnID [26]
127.0.0.1 localhost
FirewallRules: [{1879679C-0274-47E4-B133-743AD754987D}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{54E87D07-11A7-4CCC-8109-A54FC5166667}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{3D3EDE53-75E3-42B9-9624-302767880E13}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{EE77EDF0-E3B2-4F83-AFF1-E682B0549268}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
C:\Program Files (x86)\AVG\AVG2012
C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
C:\Program Files (x86)\AVG\AVG2013
C:\Program Files (x86)\AVG
End

Now save the Notepad file with the name fixlist.txt in to the same folder as FRST64 which in this case it will be in your computer's Desktop.
Right-click the FRST64 icon and select Run as administrator to start the tool.
Click the Fix button only once and wait.

When finished FRST64 will generate a log on the Desktop (fixlog.txt).
Please post the entire contents of the fixlog.txt log in your reply.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

Next,

Please download Junkware Removal Tool and save it to your Desktop.

Please close your security software to avoid potential conflicts.
Rright-click on the icon and select Run as administrator.
The tool will open and check for updates. You will see the Disclaimer.
Press any key to continue and start scanning your system.
Please be patient as this can take a while to complete, depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
Please post the contents of JRT.txt into your next reply.

Next,

Please download AdwCleaner by Xplode and save it to your Desktop.

Close all open programs and internet browsers.
Right-click on the icon and chose Run as administrator to run the tool.
Click Yes to accept any security warnings that may appear.
Click I Agree on the disclaimer to accept the Terms of Use.
Click the Scan button to start the scan and wait for the process to complete.
Click the Logfile button and the report will open in Notepad.
NOTE: If you get an error message, it means that nothing was found. Exit from AdwCleaner.
Click on the Clean button and follow the prompts.
A log file will automatically open after the scan has finished and the PC has rebooted.
Please post the content of that log file in your next reply.
You can find the log file at C:\AdwCleaner[Cn].txt (n is a number).

Please try to run RogueKiller again in Normal mode and provide the Scan log. Please DO NOT remove anything it finds.

Close all programs and browsers.
Please disconnect any USB or external drives from the computer before you run this scan!
Right-click on the RogueKiller icon and select Run as administrator.
Click Yes to accept any security warnings that may appear.
Click the Scan tab and then click the Start Scan button.
Wait until the scan has finished. This may take some time consuming.
Once finished click on Open Report. It will open a new window.
Click Export TXT to export the report as a text file, give a name to the file such as RKlog.txt and save it to your Desktop.
Close RogueKiller.
Please copy and paste the contents of RKlog.txt to your next reply.

Please post the contents of:
The fixlog.txt;
The JRT log.
The AdwCleaner clean log;
The RKlog.txt

Can you tell me where that sound seems to come from? Does it appear to come from the fan or from the hard disk drive? Are you able to check that?

Thank you.

Android 8888

#9 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 05:23 AM

Hi Android 8888.

I'm sorry I'm still having problems with the fixlist txt.

Perhaps you can tell me what I'm doing wrong.

In the notepad window with the fix copied I click file at the top of page and save as.

In the window that opens I highlight desktop in the left hand column and in file name it says fixlist and below that save as file type - text docs txt

I have tries both with fixlist and by adding txt onto it.

Do I need to save the Save as file type to All files ?

I then right click the FRST64 icon on the desktop and get to the opening window.

The search window is empty. I have types both fixlist and fixlist seperately into the box and it tells me that no fixlist.txt found and that it should be in the same director/folder as the tool.

Where am I going wrong please and would you want me to run the scan from scratch or work with the previous one.

Sorry for the confusion.

Regards,

Winston66

#10 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 05:43 AM

Hi Android 8888

Here's the latest log

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.1.2 (03.10.2017)

Operating System: Windows 10 Home x64

Ran by eddie (Administrator) on Fri 03/31/2017 at 13:35:07.83

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 0

Registry: 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 03/31/2017 at 13:37:50.92

End of JRT log

Regards Winston66

#11 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 05:50 AM

Hi once again.

Here's the adware log file.

I'm showing 1 infection my end.

# AdwCleaner v6.045 - Logfile created 31/03/2017 at 13:47:06

# Updated on 28/03/2017 by Malwarebytes

# Database : 2017-03-30.1 [Local]

# Operating System : Windows 10 Home (X64)

# Username : eddie - EH

# Running from : C:\Users\eddie\Desktop\adwcleaner_6.045.exe

# Mode: Scan

# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious keys found.

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Web browsers ] *****

No malicious Firefox based browser items found.

Chrome pref Found: [C:\Users\eddie\AppData\Local\Google\Chrome\User Data\Default\Web data] - uk.ask.com

*************************

C:\AdwCleaner\AdwCleaner[C10].txt - [753 Bytes] - [05/11/2015 16:21:49]

C:\AdwCleaner\AdwCleaner[C11].txt - [1025 Bytes] - [09/11/2015 09:51:04]

C:\AdwCleaner\AdwCleaner[C12].txt - [753 Bytes] - [30/11/2015 09:17:15]

C:\AdwCleaner\AdwCleaner[C13].txt - [753 Bytes] - [12/12/2015 18:26:57]

C:\AdwCleaner\AdwCleaner[C14].txt - [3110 Bytes] - [15/08/2016 14:45:56]

C:\AdwCleaner\AdwCleaner[C15].txt - [3708 Bytes] - [09/03/2017 19:24:39]

C:\AdwCleaner\AdwCleaner[C16].txt - [3603 Bytes] - [12/03/2017 15:36:14]

C:\AdwCleaner\AdwCleaner[C17].txt - [3754 Bytes] - [13/03/2017 18:52:35]

C:\AdwCleaner\AdwCleaner[C18].txt - [4184 Bytes] - [17/03/2017 20:03:40]

C:\AdwCleaner\AdwCleaner[C19].txt - [4639 Bytes] - [19/03/2017 17:58:46]

C:\AdwCleaner\AdwCleaner[C1].txt - [3977 Bytes] - [02/08/2016 16:18:16]

C:\AdwCleaner\AdwCleaner[C20].txt - [5400 Bytes] - [26/03/2017 13:29:25]

C:\AdwCleaner\AdwCleaner[C21].txt - [5219 Bytes] - [29/03/2017 22:11:06]

C:\AdwCleaner\AdwCleaner[C8].txt - [2432 Bytes] - [21/10/2015 10:53:56]

C:\AdwCleaner\AdwCleaner[C9].txt - [13688 Bytes] - [03/11/2015 17:13:24]

C:\AdwCleaner\AdwCleaner[R10].txt - [2645 Bytes] - [27/07/2015 10:21:48]

C:\AdwCleaner\AdwCleaner[R11].txt - [2705 Bytes] - [27/07/2015 10:26:04]

C:\AdwCleaner\AdwCleaner[R8].txt - [3434 Bytes] - [06/07/2015 16:49:32]

C:\AdwCleaner\AdwCleaner[R9].txt - [3493 Bytes] - [06/07/2015 16:51:18]

C:\AdwCleaner\AdwCleaner[S12].txt - [3136 Bytes] - [15/08/2016 14:44:19]

C:\AdwCleaner\AdwCleaner[S13].txt - [2917 Bytes] - [21/10/2015 10:52:38]

C:\AdwCleaner\AdwCleaner[S14].txt - [13607 Bytes] - [03/11/2015 17:11:14]

C:\AdwCleaner\AdwCleaner[S15].txt - [1308 Bytes] - [05/11/2015 16:17:08]

C:\AdwCleaner\AdwCleaner[S16].txt - [1556 Bytes] - [09/11/2015 09:48:57]

C:\AdwCleaner\AdwCleaner[S17].txt - [1556 Bytes] - [09/11/2015 09:50:12]

C:\AdwCleaner\AdwCleaner[S18].txt - [661 Bytes] - [30/11/2015 09:16:15]

C:\AdwCleaner\AdwCleaner[S19].txt - [661 Bytes] - [02/12/2015 20:20:57]

C:\AdwCleaner\AdwCleaner[S1].txt - [3798 Bytes] - [02/08/2016 16:15:41]

C:\AdwCleaner\AdwCleaner[S20].txt - [661 Bytes] - [12/12/2015 18:23:51]

C:\AdwCleaner\AdwCleaner[S21].txt - [655 Bytes] - [09/01/2016 20:43:21]

C:\AdwCleaner\AdwCleaner[S22].txt - [2987 Bytes] - [15/08/2016 14:53:29]

C:\AdwCleaner\AdwCleaner[S23].txt - [3646 Bytes] - [09/03/2017 19:23:50]

C:\AdwCleaner\AdwCleaner[S24].txt - [3197 Bytes] - [09/03/2017 20:32:08]

C:\AdwCleaner\AdwCleaner[S25].txt - [3271 Bytes] - [10/03/2017 20:50:14]

C:\AdwCleaner\AdwCleaner[S26].txt - [3824 Bytes] - [12/03/2017 15:22:52]

C:\AdwCleaner\AdwCleaner[S27].txt - [3662 Bytes] - [12/03/2017 15:32:41]

C:\AdwCleaner\AdwCleaner[S28].txt - [3566 Bytes] - [12/03/2017 15:44:07]

C:\AdwCleaner\AdwCleaner[S29].txt - [3640 Bytes] - [12/03/2017 18:48:41]

C:\AdwCleaner\AdwCleaner[S30].txt - [3876 Bytes] - [13/03/2017 18:52:02]

C:\AdwCleaner\AdwCleaner[S31].txt - [3863 Bytes] - [13/03/2017 21:15:30]

C:\AdwCleaner\AdwCleaner[S32].txt - [3937 Bytes] - [14/03/2017 01:01:27]

C:\AdwCleaner\AdwCleaner[S33].txt - [4012 Bytes] - [14/03/2017 20:07:09]

C:\AdwCleaner\AdwCleaner[S34].txt - [4086 Bytes] - [15/03/2017 17:14:01]

C:\AdwCleaner\AdwCleaner[S35].txt - [4292 Bytes] - [17/03/2017 20:03:17]

C:\AdwCleaner\AdwCleaner[S36].txt - [4308 Bytes] - [18/03/2017 13:46:34]

C:\AdwCleaner\AdwCleaner[S37].txt - [4856 Bytes] - [19/03/2017 17:51:05]

C:\AdwCleaner\AdwCleaner[S38].txt - [4698 Bytes] - [19/03/2017 17:57:37]

C:\AdwCleaner\AdwCleaner[S39].txt - [4603 Bytes] - [20/03/2017 20:45:28]

C:\AdwCleaner\AdwCleaner[S40].txt - [4676 Bytes] - [21/03/2017 15:59:49]

C:\AdwCleaner\AdwCleaner[S41].txt - [4751 Bytes] - [24/03/2017 21:05:24]

C:\AdwCleaner\AdwCleaner[S42].txt - [4824 Bytes] - [25/03/2017 18:59:47]

C:\AdwCleaner\AdwCleaner[S43].txt - [5377 Bytes] - [26/03/2017 13:27:36]

C:\AdwCleaner\AdwCleaner[S44].txt - [5047 Bytes] - [27/03/2017 17:32:18]

C:\AdwCleaner\AdwCleaner[S45].txt - [5121 Bytes] - [28/03/2017 19:03:51]

C:\AdwCleaner\AdwCleaner[S46].txt - [5195 Bytes] - [29/03/2017 17:13:17]

C:\AdwCleaner\AdwCleaner[S47].txt - [5326 Bytes] - [29/03/2017 22:10:53]

C:\AdwCleaner\AdwCleaner[S48].txt - [5417 Bytes] - [30/03/2017 08:24:55]

C:\AdwCleaner\AdwCleaner[S49].txt - [5493 Bytes] - [31/03/2017 13:27:07]

C:\AdwCleaner\AdwCleaner[S50].txt - [5320 Bytes] - [31/03/2017 13:47:06]

C:\AdwCleaner\AdwCleaner[S5].txt - [3569 Bytes] - [06/07/2015 16:52:18]

C:\AdwCleaner\AdwCleaner[S6].txt - [2778 Bytes] - [27/07/2015 10:27:40]

########## EOF - C:\AdwCleaner\AdwCleaner[S50].txt - [5540 Bytes] ##########

regards,

Winston66

#12 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,162 posts

Posted 31 March 2017 - 05:52 AM

Okay, no problem with that.

Please follow my steps.

I suppose you have already moved FRST64 to the computer's Desktop.

Open Notepad.

Copy and paste the entire content of the Quote box in my previous post to the notepad file.

Then on the top menu click on File and select Save as. It will open a new window.

Search for the Desktop and select it (this is where you will save the file to).

Now on the File name address box, just type fixlist leave all the rest as it is and click the Save button. Check to see if the fixlist.txt file is placed on the Desktop.

Now, right-click on FRST64 and select Run as administrator to start the tool.

Click the Fix button and wait until the fix is complete.

After the scan has finished, it will open a Notepad file named fixlog.txt

Copy and paste the entire content of that file in your reply.

Is it clear for you now?

p.s. I'll be out for a while. Be back in one hour.

Thank you.

#13 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 07:04 AM

Hi Android 8888,

The first scan of RK crashed at around the same time as a Windows defender window told me they had detected and were dealing with malware.

So I turned it off and re scanned. HERE IS THE LOG:

Started from : C:\Program Files\RogueKiller\RogueKiller64.exe

Mode : Scan -- Date : 03/31/2017 14:12:41 (Duration : 00:32:00)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS545050B9A300 +++++

--- User ---

[MBR] fbcb1350eb7aecd74d1611ca27a8e87b

[BSP] 05dceed3571d7c16494d87e0a658715a : Windows Vista/7/8|VT.Unknown MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15360 MB

1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 31459328 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 31664128 | Size: 461478 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 ... OK

User = LL2 ... OK

My adware cleaner window has frozen on the scan results page, so I will have to re boot to clear it. The infection is still showing on it as I took no action.

Windows Defender quarantined the following ,should I delete it.

Behavior:Win32 Powerserve.D

Error code 0x80070057

The parameter is incorrect

Category - Suspicious behavior

Description - Program is dangerous and executes commands from an attacker.

Items - behavior:pid 4592: 50247080127395

process : pid: 4592 : Process stat 131354348325115913

Regards

winston66

#14 winston66

Advanced Member

Full Member
221 posts

Posted 31 March 2017 - 07:31 AM

Hi Android 8888

Thanks for that. It wasn't saving to desktop but I've worked out how to default the setting now. I also believe although it was showing desktop in the file save window, I had to click it again for it to send it to desktop.

Sorry for the inconvenience and her's the log.

Fix result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017

Ran by eddie (31-03-2017 15:09:40) Run:8

Running from C:\Users\eddie\Desktop

Loaded Profiles: eddie (Available Profiles: eddie & DefaultAppPool)

Boot Mode: Normal

==============================================

fixlist content:

*****************

Start

CloseProcesses:

CreateRestorePoint:

EmptyTemp: