Jump to content


Photo

rtmpsrv.exe - Application Error unable to start correctly (0xc0000142)


  • Please log in to reply
7 replies to this topic

#1 barbieshamrocks

barbieshamrocks

    Member

  • Full Member
  • Pip
  • 16 posts

Posted 11 June 2018 - 07:33 PM

Hello I keep getting frozen internet,getting kicked off repeatedly and have to keep connecting and when I power down get this message:  rtmpsrv.exe application unable to start correctly  (0xc0000142) click ok to close the application and have to force shut down.  here are the logs that I ran:

 

mb-check log version: 3.1.10.1000

User Account type: Administrator

Date Log Created: 06/11/18

Time Log Created: 21:16:30

Path to mb-check: C:\Users\Barb\Downloads\mb-check-3.1.10.1000.exe

 

Product Name: Windows 8.1

System Type: 64 bit

Current Build: 9600

DomainComputer: No

 

 

 

Malwarebytes Version information

==================================

   "controllers_version" : "1.0.374",

   "db_version" : "2018.06.11.08",

   "dbcls_pkg_version" : "1.0.5442",

   "installer_version" : "3.5.1",

 

   "installationToken" : "QkPZ9A-ypASSKxsWrVAY1528763001",

   "licenseState" : "free",

   "machineId" : "0bd24e27d4adb4f7e997c08c249614ef3ea2deab",

 

Installation Date: 06/11/2018

Version Installed: 3.x Installed

Installation Directory: C:\Program Files\Malwarebytes\Anti-Malware\

 

User Information for Local System:

===========================================

User Account: Administrator

Account Level: Admin

User Account: Barb

Account Level: Admin

User Account: Guest

Account Level: Guest

User Account: HomeGroupUser$

Account Level: Guest

Total # of user entries: 4

 

UAC Settings:

===================

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

DWORD 1 Status: ON

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin

DWORD 5 Status: ON

 

AntiVirus Information:

===================

AntiVirus Installed: Windows Defender

Status: Up to Date and Enabled

 

FireWall Information:

===================

NO 3rd Party Firewall Installed

 

AntiSpyware Information:

===================

AntiSpyware Software Installed: Windows Defender

Status: Up to Date and Enabled

 

Machine Information

===============================================

System has been up for: 0.655278 Hours

 

Scheduler Information

===========================

         "scheduleParams" : {

            "frequency" : "months",            "lastTriggeredTime" : {               "day" : 1,               "hour" : 0,               "minute" : 0,               "month" : 1,               "second" : 0,               "year" : 2000            "originalScheduleTime" : {               "day" : 11,               "hour" : 4,               "minute" : 22,               "month" : 7,               "second" : 3,               "year" : 2018            "recoveryPeriod" : 23,            "recurrence" : 1         "scheduledScanParams" : {            "autoClean" : false,            "autoRestart" : false,            "checkForUpdates" : true,            "clientMetadata" : {               "jobId" : "",               "scheduleId" : "",               "scheduleTag" : ""            "enableShuriken" : true,            "externalDetections" : [            "filesToScan" : [            "pumHandling" : "detect",            "pupHandling" : "detect",            "scanArchives" : true,            "scanExtra" : true,            "scanFileSystem" : true,            "scanMemory" : true,            "scanRegistry" : true,            "scanRootkit" : false,            "scanStartup" : true,            "type" : "normal"         "checkLicenseState" : true,         "id" : "c479d144-6dd6-11e8-9476-ace010435742",

         "scheduleParams" : {

            "frequency" : "days",            "lastTriggeredTime" : {               "day" : 1,               "hour" : 0,               "minute" : 0,               "month" : 1,               "second" : 0,               "year" : 2000            "originalScheduleTime" : {               "day" : 19,               "hour" : 3,               "minute" : 11,               "month" : 8,               "second" : 34,               "year" : 2016            "recoveryPeriod" : 0,            "recurrence" : 1         "scheduledScanParams" : {            "autoClean" : false,            "autoRestart" : false,            "checkForUpdates" : false,            "clientMetadata" : {               "jobId" : "",               "scheduleId" : "",               "scheduleTag" : ""            "enableShuriken" : true,            "externalDetections" : [            "filesToScan" : [            "pumHandling" : "detect",            "pupHandling" : "detect",            "scanArchives" : true,            "scanExtra" : true,            "scanFileSystem" : true,            "scanMemory" : true,            "scanRegistry" : true,            "scanRootkit" : false,            "scanStartup" : true,            "type" : "normal"   "swissArmyEarlyBootStartSet" : false,   "totalNumberOfScans" : 1,   "totalPUMsDetected" : "0",   "totalPUPsDetected" : "10",   "totalScannedItems" : "265934",   "totalThreatsDetected" : "10"

 

Update Information

===================================

(enable_auto_update_dbcls = Automatically Check for Updates) (enable_auto_update_sdkctlr = Automatically download and install application component updates) (auto_update_interval = Check for updates every...) (NotifyWhenFullUpdatesAvailable = Notify me when full version updates are available) (warnWhenDefsAreOutOfDate = Notify me if time since last update exceeds 24 hours)

 

   "auto_update_interval" : 60,

   "enable_auto_update_dbcls" : true,

   "enable_auto_update_sdkctlr" : true,

 

   "NotifyWhenFullUpdatesAvailable" : true,

   "WarnWhenDefsAreOutOfDate" : true

 

Scan Config (additional Handling is scheduled parameters)

===========================================

   "globalScanParams" : {

      "enableShuriken" : true,

      "pumHandling" : "detect",

      "pupHandling" : "detect",

      "scanArchives" : true,

      "scanRootkit" : false,

   "scheduledScans" : [

         "id" : "c4769c5e-6dd6-11e8-80ef-ace010435742",

         "scheduledScanParams" : {

            "enableShuriken" : true,

            "pumHandling" : "detect",

            "pupHandling" : "detect",

            "scanArchives" : true,

            "scanRootkit" : false,

            "type" : "normal"

         "id" : "c479d144-6dd6-11e8-9476-ace010435742",

         "scheduledScanParams" : {

            "enableShuriken" : true,

            "pumHandling" : "detect",

            "pupHandling" : "detect",

            "scanArchives" : true,

            "scanRootkit" : false,

            "type" : "normal"

 

RTP Config 

==============================

   "enableShuriken" : true,

   "protectionState" : "enabled",

   "pumHandling" : "detect",

   "pupHandling" : "detect",

 

Mwac Controller Config 

==============================

   "protectionState" : "enabled",

 

Arw Controller Config 

==============================

   "protectionState" : "enabled",

 

AE Controller Config

==============================

   "protectionState" : "enabled",

 

Malwarebytes Anti-Malware Service and Driver Status:

=======================================================

 

--------------Driver File Info:--------------

C:\Windows\system32\drivers\mbamswissarmy.sys File Size: 253664    BYTES FileVersion: 4.2.0.150 MD5: [351bf8f77b0a15a7b5a2ae098c52a387]

C:\Windows\system32\drivers\mbae64.sys  File Size: 152184    BYTES FileVersion: 1.12.4.57 MD5: [1e01f509048bef78831ac89401b172bd]

 

--------------MBAMService:--------------

Type:                   16

State:                  4 (The service is running.)

WIN32_EXIT_CODE:        0

SERVICE_EXIT_CODE:      0

CHECKPOINT:             0

WAIT_HINT:              0

 

 

--------------MBAMChameleon:--------------

Type:                   N/A

State:                  0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon

WIN32_EXIT_CODE:        N/A

SERVICE_EXIT_CODE:      N/A

CHECKPOINT:             N/A

WAIT_HINT:              N/A

 

 

--------------MBAMWebProtection:--------------

Type:                   N/A

State:                  0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MbamWebProtection

WIN32_EXIT_CODE:        N/A

SERVICE_EXIT_CODE:      N/A

CHECKPOINT:             N/A

WAIT_HINT:              N/A

 

 

--------------MBAMSwissArmy:--------------

Type:                   1

State:                  4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

WIN32_EXIT_CODE:        0

SERVICE_EXIT_CODE:      0

CHECKPOINT:             0

WAIT_HINT:              0

 

 

--------------MBAMFarflt:--------------

Type:                   N/A

State:                  0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MbamFarflt

WIN32_EXIT_CODE:        N/A

SERVICE_EXIT_CODE:      N/A

CHECKPOINT:             N/A

WAIT_HINT:              N/A

 

 

--------------MBAMProtection:--------------

Type:                   N/A

State:                  0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MbamProtection

WIN32_EXIT_CODE:        N/A

SERVICE_EXIT_CODE:      N/A

CHECKPOINT:             N/A

WAIT_HINT:              N/A

 

 

--------------ES Protection Driver:--------------

Type:                   N/A

State:                  0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: ESProtectionDriver

WIN32_EXIT_CODE:        N/A

SERVICE_EXIT_CODE:      N/A

CHECKPOINT:             N/A

WAIT_HINT:              N/A

 

 

Required Dependencies:

======================

 

------------------BFE:------------------

Type:                   32

State:                  4 (The service is running.)

WIN32_EXIT_CODE:        0

SERVICE_EXIT_CODE:      0

CHECKPOINT:             0

WAIT_HINT:              0

 

 

Startup Folders for Error_Expanding_Variables Check:

====================================================

 

All Users Startup Folder Exists.

Current User's Startup Folder Exists.

 

 

Compatibility Flag Settings:

=================================

 

 

 

 

 

MBAM Startup Entries: 

=====================

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

 

C:\Program Files\Malwarebytes\Anti-Malware\

--EXTRA FILE INSIDE DIRECTORY--: BROWSERSDKDLL.DLL

--EXTRA FILE INSIDE DIRECTORY--: BROWSERSDKDLLSHIM.DLL

7z.dll                                  File Size: 1677824   BYTES FileVersion:  18.5.0.0 MD5: [7580437d0fb8c1ae60d96dafb6883d30]

Actions.dll                              File Size: 4191440   BYTES FileVersion:  3.1.0.229 MD5: [bbf8d1bd3fed70264553c43933c0778f]

ActionsShim.dll                          File Size: 2082512   BYTES FileVersion:  3.1.0.229 MD5: [97882d8ae90c1f16d1539dd6ef546458]

AEControllerImpl.dll                    File Size: 2945744   BYTES FileVersion:  3.0.0.228 MD5: [b43511de77b4b45276aeb90ea37087c9]

AeShim.dll                              File Size: 1924304   BYTES FileVersion:  3.0.0.156 MD5: [24e006a909c925fe514c257a686cd5ca]

ArwControllerImpl.dll                    File Size: 3325648   BYTES FileVersion:  3.1.0.266 MD5: [2c526a5b7d9a9c27d884e4ab1abefec3]

arwlib.dll                              File Size: 3872976   BYTES FileVersion:  3.0.0.645 MD5: [b09bebdfb68d4af061bc12e0c1c85ca2]

ArwSdkShim.dll                          File Size: 1909456   BYTES FileVersion:  3.0.0.418 MD5: [b023fb2533802aed9218778c57101769]

assistant.exe                            File Size: 877776    BYTES FileVersion:  3.0.0.1496 MD5: [1c9970c34f766168d07f6efd8857b4fc]

BrowserSDKDLL.dll                        File Size: 3498704   BYTES FileVersion:  3.2.0.38 MD5: [92e9642560b3824d14886b5a07abc0fe]

BrowserSDKDLLShim.dll                    File Size: 2072272   BYTES FileVersion:  3.2.0.38 MD5: [102d11ade6874bde5a0ac6af7630e032]

changes.txt                              File Size: 1010      BYTES FileVersion:  N/A            MD5: [1d588962fe8f738a4c69828b28266109]

CleanControllerImpl.dll                  File Size: 5355216   BYTES FileVersion:  3.1.0.409 MD5: [6fc8a69f6702c7dffadfdcd17101f737]

CloudControllerImpl.dll                  File Size: 3416272   BYTES FileVersion:  3.1.0.164 MD5: [bdb0adcf1fa2d6ad11ca148925fc6056]

libeay32.dll                            File Size: 1622528   BYTES FileVersion:  1.0.1.9 MD5: [ffc329a6636b6b930c86513c2239bbce]

LicenseControllerImpl.dll                File Size: 3441872   BYTES FileVersion:  3.1.0.253 MD5: [c091823974c144a4ad60253346be986f]

malwarebytes_assistant.exe              File Size: 876752    BYTES FileVersion:  3.0.0.1496 MD5: [764a7adf001e803e3a8ff365546c09a3]

mbae-api-na.dll                          File Size: 2268368   BYTES FileVersion:  1.12.4.81 MD5: [4d94c0e3c091503b1710ea966c17db37]

mbae.dll                                File Size: 410320    BYTES FileVersion:  1.12.4.81 MD5: [23b5a8933ff5bf482198dd6be9060d60]

mbae64.dll                              File Size: 492752    BYTES FileVersion:  1.12.4.81 MD5: [93da5e4697e7b419091c2c29b0637e7e]

mbam.exe                                File Size: 11316432  BYTES FileVersion:  3.0.0.1496 MD5: [435d53006b7ada204dd124fc3128293a]

MBAMCore.dll                            File Size: 4638416   BYTES FileVersion:  3.0.0.673 MD5: [b9294c963255eb48561d04ce5066d849]

MbamPt.exe                              File Size: 6144      BYTES FileVersion:  3.0.0.219 MD5: [f457eefa52116c47a0f68b916af9d2b4]

MBAMService.exe                          File Size: 6541008   BYTES FileVersion:  3.1.0.667 MD5: [f7265b7490428499f2fe409fa9247866]

MBAMShim.dll                            File Size: 1965264   BYTES FileVersion:  3.0.0.667 MD5: [83d2d3c1683e880a0f45dfb5c9a85dda]

mbamtray.exe                            File Size: 3784400   BYTES FileVersion:  3.0.0.1496 MD5: [be38b471a99bf7fd0e6445308df2e8ab]

mbamwow.exe                              File Size: 532176    BYTES FileVersion:  3.0.0.1496 MD5: [eeed48842ebf61cc3cfc9b6585829e88]

MBAMWsc.exe                              File Size: 2110152   BYTES FileVersion:  3.0.0.167 MD5: [45708f32ad9ee179f5fdc19069d6c695]

mbshlext.dll                            File Size: 2171976   BYTES FileVersion:  3.0.0.57 MD5: [5265576f992af1de32d79b8570f95922]

mbshlext_proto                          File Size: 2171976   BYTES FileVersion:  3.0.0.57 MD5: [5265576f992af1de32d79b8570f95922]

msvcp120.dll                            File Size: 455328    BYTES FileVersion:  12.0.21005.1 MD5: [fd5cabbe52272bd76007b68186ebaf00]

msvcr120.dll                            File Size: 970912    BYTES FileVersion:  12.0.21005.1 MD5: [034ccadc1c073e4216e9466b720f9849]

MWACControllerImpl.dll                  File Size: 3061968   BYTES FileVersion:  3.0.0.278 MD5: [4d0f82a297c6eebe7a40177b1be87058]

MwacLib.dll                              File Size: 2493648   BYTES FileVersion:  3.0.0.413 MD5: [1954e15aec4333a802dd5a964e2b612a]

MwacSdkShim.dll                          File Size: 1927376   BYTES FileVersion:  3.0.0.274 MD5: [940684267476e579dfd70429d9184592]

PoliciesControllerImpl.dll              File Size: 2271352   BYTES FileVersion:  3.0.0.177 MD5: [9461138ffbdb975a8e125163bf948158]

Qt5Core.dll                              File Size: 4809728   BYTES FileVersion:  5.6.3.0 MD5: [6a60ea3c81c70089063169f3e3169e08]

Qt5Gui.dll                              File Size: 5100032   BYTES FileVersion:  5.6.3.0 MD5: [ee7e90e8e700c04629c01493b1d2fbf7]

Qt5Network.dll                          File Size: 2012672   BYTES FileVersion:  5.6.3.0 MD5: [9188a989c32dfe9f1d0d2d8bfb543e99]

Qt5Qml.dll                              File Size: 2522112   BYTES FileVersion:  5.6.3.0 MD5: [df593f35dadf5127e1abf3cadfe3582b]

Qt5Quick.dll                            File Size: 2570752   BYTES FileVersion:  5.6.3.0 MD5: [830f2103b3ad31303627112804910123]

Qt5Svg.dll                              File Size: 247808    BYTES FileVersion:  5.6.3.0 MD5: [56401a33f71c544a203edd7f33d7a773]

Qt5Widgets.dll                          File Size: 4482048   BYTES FileVersion:  5.6.3.0 MD5: [2eea5c9566fa85135da26b339132cb47]

Qt5WinExtras.dll                        File Size: 206336    BYTES FileVersion:  5.6.3.0 MD5: [cc4fc8869c41913b98142a219bd6e98f]

rtp.dll                                  File Size: 2118352   BYTES FileVersion:  3.0.0.215 MD5: [74d669ba416684a6e439482c5f45d8b6]

RTPControllerImpl.dll                    File Size: 2981072   BYTES FileVersion:  3.0.0.384 MD5: [e29c66e21824a2bd033b9b21c54097e0]

RtpShim.dll                              File Size: 1919696   BYTES FileVersion:  3.0.0.215 MD5: [70628afe8b356849627bd1d34ad90628]

ScanControllerImpl.dll                  File Size: 4325072   BYTES FileVersion:  3.0.0.842 MD5: [a7e39e856a7a4846c6fc0b4cd31c18eb]

SelfProtectionSdk.dll                    File Size: 2297040   BYTES FileVersion:  3.0.0.326 MD5: [5c3985c07688511a28d8e85ea1531b02]

SelfProtectionShim.dll                  File Size: 1955024   BYTES FileVersion:  3.0.0.326 MD5: [07f81931d26fef2863c25dfde3279e4d]

ServiceConfig.json                      File Size: 614       BYTES FileVersion:  N/A            MD5: [e95385bc1f77e394efe0b638df2c72e7]

SPControllerImpl.dll                    File Size: 2468560   BYTES FileVersion:  3.0.0.193 MD5: [2e73a140741a648f3529a0538106b087]

ssleay32.dll                            File Size: 321024    BYTES FileVersion:  1.0.1.9 MD5: [4e92c5e12237b7caec5011839310f87d]

suhlpr.dll                              File Size: 2672848   BYTES FileVersion:  3.0.0.305 MD5: [fad7ff3ad298b98af90ee28e8ac9e8ea]

Swissarmy.dll                            File Size: 2716880   BYTES FileVersion:  4.2.0.215 MD5: [84af94a3f5d777dc890339ae64e6d7d4]

SwissarmyShim.dll                        File Size: 2009296   BYTES FileVersion:  4.2.0.215 MD5: [0b87e5eb8e7285425516013112a0ee1b]

TelemetryControllerImpl.dll              File Size: 4097232   BYTES FileVersion:  3.1.0.224 MD5: [a90608b69d21ca273ea2d3a809fddae7]

unins000.dat                            File Size: 202282    BYTES FileVersion:  N/A            MD5: [8e3c68cd61c4ba4b24da2382c944127c]

unins000.exe                            File Size: 1191120   BYTES FileVersion:  51.1052.0.0 MD5: [75e9f0fb1fcd43a7b92a7b5676666579]

unins000.msg                            File Size: 22739     BYTES FileVersion:  N/A            MD5: [200ec5a2e63a8ac04906333e6b92e50c]

UpdateControllerImpl.dll                File Size: 3507920   BYTES FileVersion:  3.1.0.350 MD5: [441ec847e501ddd547fc10492fd5a287]

zlib.dll                                File Size: 81408     BYTES FileVersion:  1.2.8.0 MD5: [b924d807b91ec0e911c975fc5c201c1e]

 

C:\Program Files\Malwarebytes\Anti-Malware\iconengines

ALL FILES PRESENT

qsvgicon.dll                            File Size: 30208     BYTES FileVersion:  5.6.3.0 MD5: [3c5a574d4c17024fd3697e3d21ab0849]

 

C:\Program Files\Malwarebytes\Anti-Malware\imageformats

MISSING FILE!: QDDS.DLL

qgif.dll                                File Size: 24576     BYTES FileVersion:  5.6.3.0 MD5: [f359fdf463a2b6864d2fea930f622b4f]

qicns.dll                                File Size: 31232     BYTES FileVersion:  5.6.3.0 MD5: [024bb6f5c7a2c5e0bbca3882a903c974]

qico.dll                                File Size: 25088     BYTES FileVersion:  5.6.3.0 MD5: [a7574b7330800ddf38572a3d23f62238]

qjpeg.dll                                File Size: 242688    BYTES FileVersion:  5.6.3.0 MD5: [252a29048945b6a46ed1e4162334b2af]

qsvg.dll                                File Size: 19968     BYTES FileVersion:  5.6.3.0 MD5: [7fdc8cd4da3237f926cbb0a1f960ab97]

qtga.dll                                File Size: 18944     BYTES FileVersion:  5.6.3.0 MD5: [b222b938d1652c62478d06c41e87b3f9]

qtiff.dll                                File Size: 318976    BYTES FileVersion:  5.6.3.0 MD5: [ce58327f1e946370ca3f271886092ea6]

qwbmp.dll                                File Size: 17920     BYTES FileVersion:  5.6.3.0 MD5: [3de2c79ede82f1ba9e12c07a997dbff9]

qwebp.dll                                File Size: 328704    BYTES FileVersion:  5.6.3.0 MD5: [e69339fc849c588727581afe5451fd9b]

 

C:\Program Files\Malwarebytes\Anti-Malware\Languages

ALL FILES PRESENT

lang_bg.qm                              File Size: 238862    BYTES FileVersion:  N/A            MD5: [9814b09b8621a7ef5bf6121418d1bf5d]

lang_cs.qm                              File Size: 235137    BYTES FileVersion:  N/A            MD5: [499db8dda8a9823e80bba4dab5d8324b]

lang_da.qm                              File Size: 233076    BYTES FileVersion:  N/A            MD5: [680aad18176f82274b75712570a3fd0d]

lang_de.qm                              File Size: 249262    BYTES FileVersion:  N/A            MD5: [a72d871104c98a7467418f0ebe6a3e1c]

lang_en_GB.qm                            File Size: 43235     BYTES FileVersion:  N/A            MD5: [7feff3fb3ffbb154a80663120ecd263b]

lang_en_US.qm                            File Size: 7658      BYTES FileVersion:  N/A            MD5: [d7ec967efdc80d92145351e4f8ce18dd]

lang_es.qm                              File Size: 244872    BYTES FileVersion:  N/A            MD5: [15cf1cf7b807776cc0b326fb13346dae]

lang_fi.qm                              File Size: 241644    BYTES FileVersion:  N/A            MD5: [dcd76ae99a9d02121e31ed25327ea88a]

lang_fr.qm                              File Size: 251182    BYTES FileVersion:  N/A            MD5: [1f59f23b656f1b5ed55a2452a0252225]

lang_hr.qm                              File Size: 245924    BYTES FileVersion:  N/A            MD5: [63ad4129a5bff878fe98d3bfa2eca706]

lang_hu.qm                              File Size: 241754    BYTES FileVersion:  N/A            MD5: [5884e1c90841833a374fe8211a836eb2]

lang_it.qm                              File Size: 241730    BYTES FileVersion:  N/A            MD5: [248ecbdaca14b8ff893db48d5a957558]

lang_ja.qm                              File Size: 182318    BYTES FileVersion:  N/A            MD5: [ebc050847ffac2fbeba58303f365e1cc]

lang_ko.qm                              File Size: 178184    BYTES FileVersion:  N/A            MD5: [afd0817357622525617ec41748543413]

lang_nl.qm                              File Size: 238956    BYTES FileVersion:  N/A            MD5: [dc4bdaba1bf60b5f1ee4d8a3ecd6814e]

lang_no.qm                              File Size: 231472    BYTES FileVersion:  N/A            MD5: [b6f7262f7a59014718c806f8e37871d2]

lang_pl.qm                              File Size: 247115    BYTES FileVersion:  N/A            MD5: [fff9af09ad2dfedf60d93340f94fbde9]

lang_pt_BR.qm                            File Size: 240679    BYTES FileVersion:  N/A            MD5: [797082413fc5b14d239bdd7b6494602f]

lang_pt_PT.qm                            File Size: 242416    BYTES FileVersion:  N/A            MD5: [21a12b1979c5d6f937fe1042ac7d9fe8]

lang_ro.qm                              File Size: 255586    BYTES FileVersion:  N/A            MD5: [de0a3cc2597f3dede07f9f97e769578e]

lang_ru.qm                              File Size: 255328    BYTES FileVersion:  N/A            MD5: [d2bbb918533e9196aa5881e5ecb5012a]

lang_sk.qm                              File Size: 239539    BYTES FileVersion:  N/A            MD5: [2f1e1d2ed57d8d809701b64ffc7dcabd]

lang_sl.qm                              File Size: 249373    BYTES FileVersion:  N/A            MD5: [87fba087a940e28eb145a43a907a0696]

lang_sv.qm                              File Size: 231722    BYTES FileVersion:  N/A            MD5: [e419218aaf0de8a8ef0102174355813c]

lang_zh_TW.qm                            File Size: 163452    BYTES FileVersion:  N/A            MD5: [dd7fd0b8254e92ab5bc55beb506dc167]

 

C:\Program Files\Malwarebytes\Anti-Malware\platforms

ALL FILES PRESENT

qwindows.dll                            File Size: 993792    BYTES FileVersion:  5.6.3.0 MD5: [ccbc1d1f25595a220739a3e4d48d8639]

 

C:\Program Files\Malwarebytes\Anti-Malware\Qt

ALL FILES PRESENT

 

C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs

ALL FILES PRESENT

 

C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel

ALL FILES PRESENT

plugins.qmltypes                        File Size: 12407     BYTES FileVersion:  N/A            MD5: [e44b896376f64f29dee0dc486d2e06f1]

qmldir                                  File Size: 128       BYTES FileVersion:  N/A            MD5: [df20f8fc4bd37e9d47303359fe2ec138]

qmlfolderlistmodelplugin.dll            File Size: 44032     BYTES FileVersion:  5.6.3.0 MD5: [40dcdef6593b35eaa1cb6fa7bcfb5951]

 

C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings

ALL FILES PRESENT

plugins.qmltypes                        File Size: 518       BYTES FileVersion:  N/A            MD5: [5a95a726ed78bd30027bd9c015d6ff6d]

qmldir                                  File Size: 107       BYTES FileVersion:  N/A            MD5: [b1f564e1cec8d91ffa94c36ede2a8f24]

qmlsettingsplugin.dll                    File Size: 22528     BYTES FileVersion:  5.6.3.0 MD5: [dd3bcd144e8e45dba2f9963bbf11d46e]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQml

ALL FILES PRESENT

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2

ALL FILES PRESENT

modelsplugin.dll                        File Size: 13312     BYTES FileVersion:  5.6.3.0 MD5: [778cdce67207258279ce8c786a134c8e]

plugins.qmltypes                        File Size: 21799     BYTES FileVersion:  N/A            MD5: [5e0d6299c808b9405b6a9638f5bf402f]

qmldir                                  File Size: 90        BYTES FileVersion:  N/A            MD5: [c6d831ad43afa82977d838183de61cd2]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick

ALL FILES PRESENT

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls

ALL FILES PRESENT

plugins.qmltypes                        File Size: 135655    BYTES FileVersion:  N/A            MD5: [eea727a00ba543acfff8325965799151]

qmldir                                  File Size: 191       BYTES FileVersion:  N/A            MD5: [e9cef8a994d9570462ad247e7c959148]

qtquickcontrolsplugin.dll                File Size: 698368    BYTES FileVersion:  5.6.3.0 MD5: [0bdc82d828ce6d7cb2e37d9745a2b684]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles

ALL FILES PRESENT

qmldir                                  File Size: 1575      BYTES FileVersion:  N/A            MD5: [413dcf3e49e01ca487fa65136c6fb0a9]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat

ALL FILES PRESENT

qmldir                                  File Size: 106       BYTES FileVersion:  N/A            MD5: [abbf675a3b243f93a4391ecf7aa9f62e]

qtquickextrasflatplugin.dll              File Size: 809472    BYTES FileVersion:  5.6.3.0 MD5: [22ec0899be4dbee1750f2b0e3e97da32]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs

ALL FILES PRESENT

dialogplugin.dll                        File Size: 173056    BYTES FileVersion:  5.6.3.0 MD5: [2731b8305a22a0dec2418697f9627d29]

plugins.qmltypes                        File Size: 116824    BYTES FileVersion:  N/A            MD5: [e0fbd4e6fbbab46f3352e39a86a01742]

qmldir                                  File Size: 239       BYTES FileVersion:  N/A            MD5: [3395c40a33f999a8ce8c5f63b0983cf8]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private

ALL FILES PRESENT

dialogsprivateplugin.dll                File Size: 35328     BYTES FileVersion:  5.6.3.0 MD5: [0ba49c643ff86d405cc465b35ee66c3c]

plugins.qmltypes                        File Size: 12302     BYTES FileVersion:  N/A            MD5: [be212b606484272fb2d32dd5fab12496]

qmldir                                  File Size: 128       BYTES FileVersion:  N/A            MD5: [d859e992832670dffa54ebc48137c3e0]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras

ALL FILES PRESENT

plugins.qmltypes                        File Size: 29879     BYTES FileVersion:  N/A            MD5: [bf5048e8527be9940b9d6ff1e7d49fb9]

qmldir                                  File Size: 144       BYTES FileVersion:  N/A            MD5: [08cceb0b03c1e9e2365fbb1c7c941a6a]

qtquickextrasplugin.dll                  File Size: 121344    BYTES FileVersion:  5.6.3.0 MD5: [641d1b803577acf00a5c6fc5ccdbdee5]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts

ALL FILES PRESENT

plugins.qmltypes                        File Size: 3777      BYTES FileVersion:  N/A            MD5: [b8378c5fa81c020dcde7a72994a3654e]

qmldir                                  File Size: 130       BYTES FileVersion:  N/A            MD5: [e9ca7d1d1f439c9be217759f619bf102]

qquicklayoutsplugin.dll                  File Size: 69632     BYTES FileVersion:  5.6.3.0 MD5: [243ea4e7d3ee30a1a8571d05c9946225]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets

ALL FILES PRESENT

plugins.qmltypes                        File Size: 11103     BYTES FileVersion:  N/A            MD5: [50a9b64c522ef413f46f22215ed14c99]

qmldir                                  File Size: 120       BYTES FileVersion:  N/A            MD5: [816f665be0760d3076997d321c1a4602]

widgetsplugin.dll                        File Size: 97280     BYTES FileVersion:  5.6.3.0 MD5: [851ed86a7d7912b352cc62663d577a39]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2

ALL FILES PRESENT

plugins.qmltypes                        File Size: 10394     BYTES FileVersion:  N/A            MD5: [e6c66c53b7009f2c764969843eb3dd74]

qmldir                                  File Size: 122       BYTES FileVersion:  N/A            MD5: [c434589591a9b33cbe88891afbb7c144]

windowplugin.dll                        File Size: 13312     BYTES FileVersion:  5.6.3.0 MD5: [678f48149b0c866386e2d6707e8c711e]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2

ALL FILES PRESENT

plugins.qmltypes                        File Size: 177432    BYTES FileVersion:  N/A            MD5: [603b4b64138d15ccf21f4b85d0e310e9]

qmldir                                  File Size: 111       BYTES FileVersion:  N/A            MD5: [fcedccc4408c301dc6b1fe45721353ac]

qtquick2plugin.dll                      File Size: 13824     BYTES FileVersion:  5.6.3.0 MD5: [7adc5daad23335a47599b51cfadf4094]

 

C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras

ALL FILES PRESENT

JumpListDestination.qml                  File Size: 2279      BYTES FileVersion:  N/A            MD5: [927851ddab1d2220d2b51aeb463102ed]

JumpListLink.qml                        File Size: 2748      BYTES FileVersion:  N/A            MD5: [458c59749f618f2aca803e1f25b16f36]

JumpListSeparator.qml                    File Size: 2071      BYTES FileVersion:  N/A            MD5: [6859186f10892380a27fc277add020d5]

plugins.qmltypes                        File Size: 14616     BYTES FileVersion:  N/A            MD5: [3fdb2e85892e4bff392b7fafe693fcde]

qmldir                                  File Size: 171       BYTES FileVersion:  N/A            MD5: [f8589c6293d7e99c8b5ceff87e3a76fe]

qml_winextras.dll                        File Size: 74752     BYTES FileVersion:  5.6.3.0 MD5: [1d7183b6462bec1b98780bf2c4b6a304]

 

C:\Program Files\Malwarebytes\Anti-Malware\scenegraph

ALL FILES PRESENT

softwarecontext.dll                      File Size: 102400    BYTES FileVersion:  5.6.3.0 MD5: [3f5f9142406fac1e5d061be12172e163]

 

C:\Program Files\Malwarebytes\Anti-Malware\sdk

MBAMSwissArmy.cat                        File Size: 10714     BYTES FileVersion:  N/A            MD5: [4be0870e91877390e328566b338ff411]

MBAMSwissArmy.inf                        File Size: 2273      BYTES FileVersion:  N/A            MD5: [674f323a2e134b22b02c2eb1b1418442]

MBAMSwissArmy.sys                        File Size: 253664    BYTES FileVersion:  4.2.0.150 MD5: [351bf8f77b0a15a7b5a2ae098c52a387]

 

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware

MISSING DIRECTORY: ARW

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\gatekeeper.conf

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\license.conf

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\notifications.conf

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\scheduler.conf

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\settings.conf

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\statistics.conf

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\exclusions.dat

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-2016-08-18 (19-19-34).xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-2016-08-23 (20-32-13).xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-2016-08-28 (11-51-39).xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-2018-06-04 (20-31-03).xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\protection-log-2016-08-18.xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\protection-log-2016-08-19.xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\protection-log-2016-08-20.xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\protection-log-2016-08-22.xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\protection-log-2016-08-23.xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\protection-log-2016-08-26.xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\protection-log-2016-08-28.xml

C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\protection-log-2018-06-04.xml

C:\ProgramData\Malwarebytes\MBAMService\clean.mbdb

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json.bak

C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

C:\ProgramData\Malwarebytes\MBAMService\dbmanifest.dat

C:\ProgramData\Malwarebytes\MBAMService\dbmanifest2.dat

C:\ProgramData\Malwarebytes\MBAMService\dbupdate.log

C:\ProgramData\Malwarebytes\MBAMService\dynconfig.dat

C:\ProgramData\Malwarebytes\MBAMService\exclusions.txt

C:\ProgramData\Malwarebytes\MBAMService\HubbleCache

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest.dat

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.dat

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.dat

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txt

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dll

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig.dat

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.dat

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot.mbdb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdb

C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG

C:\ProgramData\Malwarebytes\MBAMService\mbdigsig.dat

C:\ProgramData\Malwarebytes\MBAMService\mbdigsig2.dat

C:\ProgramData\Malwarebytes\MBAMService\prot.mbdb

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\0a768732-6dd7-11e8-ba0b-ace010435742.data

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\0a76ae4c-6dd7-11e8-bc21-ace010435742.data

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\2b2817a2-6dd7-11e8-a4ea-ace010435742.data

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\2b2817a2-6dd7-11e8-a4ea-ace010435742.quar

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\2b2be8d3-6dd7-11e8-b61b-ace010435742.data

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\2b2be8d3-6dd7-11e8-b61b-ace010435742.quar

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\2b390a94-6dd


#2 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,223 posts

Posted 12 June 2018 - 05:25 AM

Hello, Welcome to SpywareInfoForum.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please post the FRST.txt log that was created by the Farbar program.

I need to review it before suggesting any remedial action.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#3 barbieshamrocks

barbieshamrocks

    Member

  • Full Member
  • Pip
  • 16 posts

Posted 13 June 2018 - 04:04 PM

Thank you very much:  here it is:  

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06.06.2018 01
Ran by Barb (administrator) on BARBARABRUESKI (11-06-2018 21:07:19)
Running from C:\Users\Barb\Downloads
Loaded Profiles: Barb (Available Profiles: Barb)
Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows ® Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
() C:\Program Files\WinZip\WinZip Smart Monitor\WinZip Compression Smart Monitor Service.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Toshiba Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Corel Corporation) C:\Program Files\WinZip\WinZip Smart Monitor\WinZipCompressionSmartMonitor.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(WinZip Computing, S.L.) C:\Program Files\WinZip\WzPreloader.exe
(WinZip Computing, S.L.) C:\Program Files\WinZip\FAHWindow64.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\Jing\Jing.exe
(Apowersoft) C:\Program Files (x86)\Apowersoft\Video Download Capture 6\Video Download Capture 6.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Utilities\KeNotify.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(The CefSharp Authors) C:\Program Files (x86)\Apowersoft\Video Download Capture 6\Apowersoft.Browser.exe
() C:\Program Files (x86)\Apowersoft\Video Download Capture 6\rtmpsrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-10-08] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [179288 2014-04-17] (TOSHIBA Corporation)
HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296008 2013-10-21] (TOSHIBA Corporation)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
HKLM\...\Run: [WinZip UN] => C:\Program Files\WinZip\WZUpdateNotifier.exe [2047744 2017-11-15] (WinZip)
HKLM\...\Run: [WinZip PreLoader] => C:\Program Files\WinZip\WzPreloader.exe [123848 2017-11-15] (WinZip Computing, S.L.)
HKLM\...\Run: [WinZip FAH] => C:\Program Files\WinZip\FAHConsole.exe [436416 2017-11-15] (WinZip Computing, S.L.)
HKLM-x32\...\Run: [KeNotify] => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2013-08-05] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TSVU] => c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe [517536 2014-04-07] (TOSHIBA)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3643712 2018-06-04] (Dropbox, Inc.)
HKU\S-1-5-21-2224570990-2050318907-3262021388-1001\...\Run: [Jing] => C:\Program Files (x86)\TechSmith\Jing\Jing.exe [2911224 2015-09-11] (TechSmith Corporation)
HKU\S-1-5-21-2224570990-2050318907-3262021388-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2224570990-2050318907-3262021388-1001\...\Run: [VideoDownloadCapture] => C:\Program Files (x86)\Apowersoft\Video Download Capture 6\Video Download Capture 6.exe [6153880 2018-03-07] (Apowersoft)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{91C12545-CFCF-4514-9855-FE08794F64C9}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-2224570990-2050318907-3262021388-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-2224570990-2050318907-3262021388-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-2224570990-2050318907-3262021388-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.toshiba.com/
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2224570990-2050318907-3262021388-1001 -> DefaultScope {F6ACC77A-319E-43A3-881B-B42661503136} URL = 
SearchScopes: HKU\S-1-5-21-2224570990-2050318907-3262021388-1001 -> {F6ACC77A-319E-43A3-881B-B42661503136} URL = 
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
 
FireFox:
========
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll [2015-04-02] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll [2015-04-02] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-21] (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://homepage-web.com/?s=toshibaupd&m=home
CHR StartupUrls: Default -> "hxxp://yahoo.com/","hxxp://google.com/maps","hxxp://www.facebook.com/","hxxp://ancestry.com/","hxxps://www.google.com/"
CHR DefaultSearchURL: Default -> hxxp://search.myappzcenter.com/search/?category=web&s=49ds&q={searchTerms}
CHR DefaultSearchKeyword: Default -> MusicFinder Search
CHR DefaultSuggestURL: Default -> hxxp://sug.myappzcenter.com/search/index_sg.php?q={searchTerms}
CHR Profile: C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default [2018-06-11]
CHR Extension: (Slides) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-15]
CHR Extension: (Docs) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-15]
CHR Extension: (Google Drive) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-20]
CHR Extension: (YouTube) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-20]
CHR Extension: (DoctoPDF) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\clhbdbilphcancnmheonmkiejhbabelh [2018-06-11]
CHR Extension: (Google Search) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-20]
CHR Extension: (MusicFinder Search) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebhcflbfnmlobiplacldedddeplbjfoc [2018-06-11]
CHR Extension: (Sheets) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-15]
CHR Extension: (Google Docs Offline) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-02]
CHR Extension: (Gmail) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-20]
CHR Extension: (Chrome Media Router) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-06-10]
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [319104 2014-03-19] (Windows ® Win 7 DDK provider) [File not signed]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-03-11] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-03-11] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [51024 2018-06-04] (Dropbox, Inc.)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [342928 2014-12-10] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [158496 2014-10-21] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation)
R2 WinZip Compression Smart Monitor Service; C:\Program Files\WinZip\WinZip Smart Monitor\WinZip Compression Smart Monitor Service.exe [495872 2017-09-01] ()
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [X]
S2 McMPFSvc; "C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]
S2 McNaiAnn; "C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]
S3 McODS; "C:\ProgramData\McAfee\Update\Installs\pkg_default\Download_Files\default\vso\vso_li_cat\%VSINSTALL_DIR64%\mcods.exe" [X]
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3888640 2014-02-14] (Qualcomm Atheros Communications, Inc.)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253664 2018-06-11] (Malwarebytes)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-10-21] (Intel Corporation)
S3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [537192 2015-10-06] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [109480 2015-10-06] (McAfee, Inc.)
R2 npf; C:\Windows\system32\drivers\npf.sys [36600 2017-08-03] (Riverbed Technology, Inc.)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291032 2013-11-22] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-02-21] (Synaptics Incorporated)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [27136 2014-03-24] (Windows ® Win 7 DDK provider)
R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Corporation)
S3 avchv; \SystemRoot\system32\DRIVERS\avchv.sys [X]
S3 dbx; system32\DRIVERS\dbx.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-06-11 21:07 - 2018-06-11 21:07 - 000017278 _____ C:\Users\Barb\Downloads\FRST.txt
2018-06-11 21:07 - 2018-06-11 21:07 - 000000000 ____D C:\FRST
2018-06-11 21:06 - 2018-06-11 21:06 - 002413056 _____ (Farbar) C:\Users\Barb\Downloads\FRST64 (1).exe
2018-06-11 21:05 - 2018-06-11 21:06 - 002413056 _____ (Farbar) C:\Users\Barb\Downloads\FRST64.exe
2018-06-11 21:04 - 2018-06-11 21:04 - 000001143 _____ C:\Users\Barb\Desktop\FRST - Shortcut.lnk
2018-06-11 21:02 - 2018-06-11 21:02 - 001773568 _____ (Farbar) C:\Users\Barb\Downloads\FRST (2).exe
2018-06-11 21:00 - 2018-06-11 21:00 - 001773568 _____ (Farbar) C:\Users\Barb\Downloads\FRST (1).exe
2018-06-11 20:58 - 2018-06-11 20:59 - 001773568 _____ (Farbar) C:\Users\Barb\Downloads\FRST.exe
2018-06-11 20:50 - 2018-06-11 20:50 - 002326304 _____ (Malwarebytes Corporation) C:\Users\Barb\Downloads\mb-check-3.1.10.1000.exe
2018-06-11 20:50 - 2018-06-11 20:50 - 000232402 _____ C:\Users\Barb\Desktop\mb-check-results.zip
2018-06-11 20:50 - 2018-06-11 20:50 - 000000191 _____ C:\Users\Barb\Desktop\mb-grab-errors.txt
2018-06-11 20:44 - 2018-06-11 20:44 - 077565720 _____ (Malwarebytes ) C:\Users\Barb\Downloads\mb3-setup-consumer-3.5.1.2522-1.0.374-1.0.5434 (1).exe
2018-06-11 20:34 - 2018-06-11 20:34 - 000000000 ____D C:\SPYWARE FILES TO SHARE
2018-06-11 20:22 - 2018-06-11 20:38 - 000253664 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-06-11 20:22 - 2018-06-11 20:22 - 000001894 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-06-11 20:22 - 2018-06-11 20:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-06-11 20:22 - 2018-06-11 20:22 - 000000000 ____D C:\ProgramData\MB2Migration
2018-06-11 20:22 - 2018-06-11 20:22 - 000000000 ____D C:\Program Files\Malwarebytes
2018-06-11 20:22 - 2018-05-24 06:55 - 000152184 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
2018-06-11 20:20 - 2018-06-11 20:21 - 077565720 _____ (Malwarebytes ) C:\Users\Barb\Downloads\mb3-setup-consumer-3.5.1.2522-1.0.374-1.0.5434.exe
2018-06-10 12:40 - 2018-06-10 12:40 - 000150741 _____ C:\Users\Barb\Downloads\mcgrath and howard birth certs from 1864_5.pdf
2018-06-10 12:40 - 2018-06-10 12:40 - 000150741 _____ C:\Users\Barb\Downloads\mcgrath and howard birth certs from 1864_5 (2).pdf
2018-06-10 12:40 - 2018-06-10 12:40 - 000150741 _____ C:\Users\Barb\Downloads\mcgrath and howard birth certs from 1864_5 (1).pdf
2018-06-10 12:22 - 2018-06-10 12:22 - 000119503 _____ C:\Users\Barb\Downloads\mcgrath and howard birth certs from 1864.pdf
2018-06-06 17:40 - 2018-06-06 19:47 - 000048640 _____ C:\Users\Barb\Downloads\Marshall Wilson.xls
2018-06-05 17:24 - 2018-06-05 17:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2018-06-04 06:18 - 2018-06-04 06:18 - 000051024 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
2018-06-04 06:18 - 2018-06-04 06:18 - 000050232 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
2018-06-04 06:18 - 2018-06-04 06:18 - 000045672 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
2018-06-04 06:18 - 2018-06-04 06:18 - 000045640 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
2018-06-03 12:32 - 2018-06-03 12:57 - 000000000 ____D C:\UNCLE BILL
2018-06-03 12:29 - 2018-06-03 12:29 - 000000000 ____D C:\ProgramData\Apowersoft
2018-06-03 11:26 - 2018-06-03 11:26 - 066477576 _____ (APOWERSOFT LIMITED ) C:\Users\Barb\Downloads\video-download-capture (2).exe
2018-06-03 11:24 - 2018-06-03 11:24 - 066477576 _____ (APOWERSOFT LIMITED ) C:\Users\Barb\Downloads\video-download-capture (1).exe
2018-06-03 11:14 - 2018-06-03 11:14 - 000000000 ____D C:\Users\Barb\Documents\Apowersoft
2018-06-03 11:14 - 2018-06-03 11:14 - 000000000 ____D C:\Users\Barb\AppData\Local\CEF
2018-06-03 11:13 - 2018-06-03 11:27 - 000001335 _____ C:\Users\Public\Desktop\Video Download Capture.lnk
2018-06-03 11:13 - 2018-06-03 11:14 - 000000000 ____D C:\Users\Barb\AppData\Roaming\Apowersoft
2018-06-03 11:13 - 2018-06-03 11:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apowersoft
2018-06-03 11:13 - 2018-06-03 11:13 - 000000000 ____D C:\Program Files (x86)\Apowersoft
2018-06-03 11:13 - 2017-08-03 09:15 - 000370424 _____ (Riverbed Technology, Inc.) C:\Windows\system32\wpcap.dll
2018-06-03 11:13 - 2017-08-03 09:15 - 000282360 _____ (Riverbed Technology, Inc.) C:\Windows\SysWOW64\wpcap.dll
2018-06-03 11:13 - 2017-08-03 09:15 - 000107768 _____ (Riverbed Technology, Inc.) C:\Windows\system32\Packet.dll
2018-06-03 11:13 - 2017-08-03 09:15 - 000098040 _____ (Riverbed Technology, Inc.) C:\Windows\SysWOW64\Packet.dll
2018-06-03 11:13 - 2017-08-03 09:15 - 000053299 _____ C:\Windows\SysWOW64\pthreadVC.dll
2018-06-03 11:13 - 2017-08-03 09:15 - 000036600 _____ (Riverbed Technology, Inc.) C:\Windows\system32\Drivers\npf.sys
2018-06-03 11:11 - 2018-06-03 11:12 - 066477576 _____ (APOWERSOFT LIMITED ) C:\Users\Barb\Downloads\video-download-capture.exe
2018-05-23 20:37 - 2018-05-23 20:37 - 001617913 _____ C:\Users\Barb\Downloads\50th Wedding Anniversary Party.pdf
2018-05-22 19:29 - 2018-05-22 19:29 - 060051653 _____ C:\Users\Barb\Downloads\2012 Romano Tree (3).pdf
2018-05-22 19:08 - 2018-05-22 19:08 - 000036352 _____ C:\Users\Barb\Downloads\JUDY CHARRIOTT DIMEGIO TREE.xls
2018-05-22 18:04 - 2018-05-22 18:04 - 000065980 _____ C:\Users\Barb\Downloads\Obit C T Sculley.pdf
2018-05-22 18:04 - 2018-05-22 18:04 - 000065980 _____ C:\Users\Barb\Downloads\Obit C T Sculley (1).pdf
2018-05-19 16:40 - 2018-05-19 16:40 - 000101888 _____ C:\Users\Barb\Downloads\FORD-Carlsson Families-Compare (3).xls
2018-05-19 16:39 - 2018-05-19 16:39 - 000101888 _____ C:\Users\Barb\Downloads\FORD-Carlsson Families-Compare (2).xls
2018-05-18 17:39 - 2018-05-18 17:39 - 000101888 _____ C:\Users\Barb\Downloads\FORD-Carlsson Families-Compare (1).xls
2018-05-17 19:34 - 2018-05-17 19:36 - 060051653 _____ C:\Users\Barb\Downloads\2012 Romano Tree (1).pdf
2018-05-17 19:34 - 2018-05-17 19:34 - 060051653 _____ C:\Users\Barb\Downloads\2012 Romano Tree.pdf
2018-05-17 19:34 - 2018-05-17 19:34 - 060051653 _____ C:\Users\Barb\Downloads\2012 Romano Tree (2).pdf
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-06-11 20:53 - 2015-04-02 21:46 - 000000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2018-06-11 20:43 - 2015-12-20 14:29 - 000003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2224570990-2050318907-3262021388-1001
2018-06-11 20:42 - 2015-12-20 15:55 - 004462592 ___SH C:\Users\Barb\Downloads\Thumbs.db
2018-06-11 20:38 - 2017-03-11 09:03 - 000000930 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2018-06-11 20:37 - 2013-08-22 10:45 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-06-11 20:33 - 2015-04-02 21:41 - 000000000 ____D C:\Program Files (x86)\Amazon
2018-06-11 20:22 - 2016-08-18 19:18 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-06-11 20:18 - 2016-01-03 08:49 - 000000000 ____D C:\BARB
2018-06-11 20:13 - 2017-03-11 09:03 - 000000934 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2018-06-11 19:34 - 2013-08-22 11:20 - 000000000 ____D C:\Windows\CbsTemp
2018-06-11 19:12 - 2013-08-22 11:36 - 000000000 ____D C:\Windows\LiveKernelReports
2018-06-11 18:57 - 2015-12-20 14:44 - 000003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4ACEB62B-84B9-4E1C-88FA-C04782DCD157}
2018-06-10 14:07 - 2015-12-20 15:17 - 000000000 ____D C:\FAMILY HISTORY
2018-06-07 17:59 - 2015-12-20 14:45 - 000002215 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-06-07 17:59 - 2015-12-20 14:45 - 000002174 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-06-06 17:40 - 2015-12-20 14:23 - 000000000 ____D C:\Users\Barb\AppData\Local\Packages
2018-06-05 17:36 - 2015-12-29 12:54 - 000000000 ____D C:\PHOTOS
2018-06-05 17:25 - 2017-03-11 09:03 - 000000000 ____D C:\Program Files (x86)\Dropbox
2018-06-05 15:19 - 2018-01-14 09:23 - 000835056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-06-05 15:19 - 2018-01-14 09:23 - 000179704 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-06-04 18:14 - 2013-08-22 09:36 - 000000000 ____D C:\Windows\Inf
2018-06-03 12:56 - 2014-03-18 05:53 - 000865068 _____ C:\Windows\system32\PerfStringBackup.INI
2018-06-03 11:32 - 2018-02-24 21:24 - 000000000 ____D C:\IRELAND 2012
2018-05-22 19:29 - 2018-04-26 07:34 - 000000000 ____D C:\BIG REVEAL HIAY FILES
2018-05-19 19:09 - 2018-05-03 08:35 - 000000000 ____D C:\A WILLIAM FORD TRACKING
2018-05-19 10:08 - 2017-03-11 09:03 - 000003906 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineUA
2018-05-19 10:08 - 2017-03-11 09:03 - 000003670 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineCore
2018-05-18 17:43 - 2018-03-14 18:21 - 000000132 _____ C:\Users\Barb\AppData\Roaming\Adobe PNG Format CS5 Prefs
2018-05-17 17:52 - 2015-12-20 14:45 - 000003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2018-05-17 17:52 - 2015-12-20 14:45 - 000003204 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2018-05-16 18:13 - 2013-08-22 11:36 - 000000000 ____D C:\Windows\rescache
2018-05-16 17:42 - 2013-08-22 10:44 - 005043208 _____ C:\Windows\system32\FNTCACHE.DAT
2018-05-16 17:28 - 2013-08-22 09:25 - 000262144 ___SH C:\Windows\system32\config\BBI
2018-05-14 21:10 - 2017-10-16 18:29 - 141696960 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-05-14 21:10 - 2015-12-29 19:20 - 141696960 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-05-14 21:10 - 2015-12-29 19:20 - 000000000 ____D C:\Windows\system32\MRT
2018-05-12 10:46 - 2015-12-21 11:11 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
 
==================== Files in the root of some directories =======
 
2018-03-14 18:21 - 2018-05-18 17:43 - 000000132 _____ () C:\Users\Barb\AppData\Roaming\Adobe PNG Format CS5 Prefs
 
Some files in TEMP:
====================
2015-12-29 13:27 - 2015-12-29 13:27 - 000467968 _____ (Realtek Semiconductor Corp.) C:\Users\Barb\AppData\Local\Temp\COMAP.EXE
2015-10-27 18:07 - 2015-10-27 18:07 - 000120336 _____ (McAfee, Inc.) C:\Users\Barb\AppData\Local\Temp\McCSPInstall.dll
2015-12-20 14:39 - 2015-10-27 18:07 - 000123368 _____ (McAfee Inc.) C:\Users\Barb\AppData\Local\Temp\mccspuninstall.exe
2016-03-12 15:23 - 2016-03-12 15:25 - 063142648 _____ (SweetLabs,Inc.) C:\Users\Barb\AppData\Local\Temp\oct12AF.tmp.exe
2016-04-14 19:57 - 2016-04-14 19:58 - 063707840 _____ (SweetLabs,Inc.) C:\Users\Barb\AppData\Local\Temp\oct28EE.tmp.exe
2016-09-24 19:21 - 2016-09-24 19:21 - 064108904 _____ (SweetLabs,Inc.) C:\Users\Barb\AppData\Local\Temp\oct35A8.tmp.exe
2015-12-20 14:31 - 2015-12-20 14:32 - 063066872 _____ (SweetLabs,Inc.) C:\Users\Barb\AppData\Local\Temp\oct4D16.tmp.exe
2016-07-25 19:39 - 2016-07-25 19:40 - 063953600 _____ (SweetLabs,Inc.) C:\Users\Barb\AppData\Local\Temp\oct8D9D.tmp.exe
2016-07-31 16:03 - 2016-07-31 16:03 - 063953128 _____ (SweetLabs,Inc.) C:\Users\Barb\AppData\Local\Temp\oct9622.tmp.exe
2015-12-21 11:04 - 2012-11-10 14:20 - 000150600 ____R (Microsoft Corporation) C:\Users\Barb\AppData\Local\Temp\ose00000.exe
2017-04-25 18:39 - 2017-04-25 18:39 - 000000000 _____ () C:\Users\Barb\AppData\Local\Temp\{4C23E6CD-7B78-4341-8B1D-96B0A41D3C4C}-58.0.3029.81_57.0.2987.133_chrome_updater.exe
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-06-01 17:22
 
==================== End of FRST.txt ============================


#4 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,223 posts

Posted 14 June 2018 - 05:45 AM

Hi,

Remove this program in bold via the Control Panel > Programs > Programs and Features.
Amazon 1Button App (HKLM-x32\...\{4D875057-4353-4B8F-93E5-8C3DC7F34EA9}) (Version: 1.0.8 - Amazon) <==== ATTENTION
===

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.


Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

CHR HomePage: Default -> hxxp://homepage-web.com/?s=toshibaupd&m=home
CHR DefaultSearchURL: Default -> hxxp://search.myappzcenter.com/search/?category=web&s=49ds&q={searchTerms}
CHR DefaultSearchKeyword: Default -> MusicFinder Search
CHR DefaultSuggestURL: Default -> hxxp://sug.myappzcenter.com/search/index_sg.php?q={searchTerms}
CHR Extension: (MusicFinder Search) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebhcflbfnmlobiplacldedddeplbjfoc [2018-06-11]

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

If your problem persists re-install the Apowersoft Video Download Capture which is causing this issue.

Faulting application path: C:\Program Files (x86)\Apowersoft\Video Download Capture 6\rtmpsrv.exe

Restart them computer normally.

Please let me know if the problem persists.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#5 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,223 posts

Posted 14 June 2018 - 05:46 AM

Hi,

Remove this program in bold via the Control Panel > Programs > Programs and Features.
Amazon 1Button App (HKLM-x32\...\{4D875057-4353-4B8F-93E5-8C3DC7F34EA9}) (Version: 1.0.8 - Amazon) <==== ATTENTION
===

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.


Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

CHR HomePage: Default -> hxxp://homepage-web.com/?s=toshibaupd&m=home
CHR DefaultSearchURL: Default -> hxxp://search.myappzcenter.com/search/?category=web&s=49ds&q={searchTerms}
CHR DefaultSearchKeyword: Default -> MusicFinder Search
CHR DefaultSuggestURL: Default -> hxxp://sug.myappzcenter.com/search/index_sg.php?q={searchTerms}
CHR Extension: (MusicFinder Search) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebhcflbfnmlobiplacldedddeplbjfoc [2018-06-11]

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

If your problem persists re-install the Apowersoft Video Download Capture which is causing this issue.

Faulting application path: C:\Program Files (x86)\Apowersoft\Video Download Capture 6\rtmpsrv.exe

Restart them computer normally.

Please let me know if the problem persists.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#6 barbieshamrocks

barbieshamrocks

    Member

  • Full Member
  • Pip
  • 16 posts

Posted 16 June 2018 - 01:28 PM

Thanks for your help!  

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 06.06.2018 01
Ran by Barb (16-06-2018 12:48:17) Run:2
Running from C:\Users\Barb\Downloads
Loaded Profiles: Barb (Available Profiles: Barb)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
CHR HomePage: Default -> hxxp://homepage-web.com/?s=toshibaupd&m=home
CHR DefaultSearchURL: Default -> hxxp://search.myappzcenter.com/search/?category=web&s=49ds&q={searchTerms}
CHR DefaultSearchKeyword: Default -> MusicFinder Search
CHR DefaultSuggestURL: Default -> hxxp://sug.myappzcenter.com/search/index_sg.php?q={searchTerms}
CHR Extension: (MusicFinder Search) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebhcflbfnmlobiplacldedddeplbjfoc [2018-06-11]
 
End
 
*****************
 
Restore point was successfully created.
Processes closed successfully.
"Chrome HomePage" => not found
"Chrome DefaultSearchURL" => not found
"Chrome DefaultSearchKeyword" => not found
"Chrome DefaultSuggestURL" => not found
CHR Extension: (MusicFinder Search) - C:\Users\Barb\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebhcflbfnmlobiplacldedddeplbjfoc [2018-06-11] => Error: No automatic fix found for this entry.
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 3146160 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B
 


#7 barbieshamrocks

barbieshamrocks

    Member

  • Full Member
  • Pip
  • 16 posts

Posted 18 June 2018 - 07:26 AM

Im away now til Friday so take yr time and thanks again for your help. B

#8 barbieshamrocks

barbieshamrocks

    Member

  • Full Member
  • Pip
  • 16 posts

Posted 23 June 2018 - 07:42 AM

Thank you very much for your help, it's not freezing any more!






Member of UNITE
Support SpywareInfo Forum - click the button