Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

hp-pavilion-g6-2123us-notebook-sluggish

Started by brabirschorr , Jan 02 2020 06:08 PM

This topic is locked

5 replies to this topic

#1 brabirschorr

Member

Full Member
79 posts

Posted 02 January 2020 - 06:08 PM

Hello:

My hp-pavilion-g6-2123us-notebook (c. 2012) is sluggish and has just been replaced by a new machine. I'd like to retrieve important files from the hp and potentially use as a backup, but want to remove any malware and potential viruses first. I had an active topic for this same computer somewhere on this website in March 2015 but cannot find it now. At the time the tech indicated that there was a potential imminent failure with the hard drive and that I should back everything up - I purchased an external drive but neglected to follow up with the back up.

Requested logs follow:

FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 28-12-2019

Ran by Dad (administrator) on DAD-HPLAPTOP (Hewlett-Packard HP Pavilion g6 Notebook PC) (02-01-2020 18:38:11)

Running from C:\Users\Dad\Desktop\MalwareRemoval2020Jan

Loaded Profiles: Dad (Available Profiles: Dad & Mom)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVAST Software s.r.o. -> ) C:\Program Files\AVAST Software\Avast\AvastNM.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupUI.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.141.333\AvastBrowserCrashHandler.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.141.333\AvastBrowserCrashHandler64.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswidsagent.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(CyberLink -> CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe

(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-09-30] (Synaptics Incorporated -> Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-10-29] (IDT, Inc.) [File not signed]

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [268680 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [630912 2012-02-10] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [518456 2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [231736 2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-12-16] (Oracle America, Inc. -> Oracle Corporation)

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION

HKU\S-1-5-21-3620890968-501116891-2233395218-1001\...\Run: [AvastBrowserAutoLaunch_A29E674676F5ABDB918717B2345B658E] => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1857552 2019-11-04] (AVAST Software s.r.o. -> AVAST Software)

HKLM\Software\Microsoft\Active Setup\Installed Components: [{0CE7EBAF-157D-4111-9146-057CB2A4023E}] -> msiexec /fu {0CE7EBAF-157D-4111-9146-057CB2A4023E} /qn

HKLM\Software\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache

HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\79.0.3945.88\Installer\chrmstp.exe [2019-12-19] (Google LLC -> Google LLC)

HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache

HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{30C521FB-255B-46C8-9F0D-EE5AE371C9AA}] -> C:\Program Files (x86)\AVAST Software\Browser\Application\77.2.2153.120\Installer\chrmstp.exe [2019-11-27] (AVAST Software s.r.o. -> AVAST Software)

HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

HKLM\Software\...\Authentication\Credential Providers: [{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL [2011-03-29] (Microsoft Corporation -> Microsoft Corp.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Avast Cleanup Premium.lnk [2019-02-10]

ShortcutTarget: Avast Cleanup Premium.lnk -> C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupUI.exe (AVAST Software s.r.o. -> AVAST Software)

FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {10004FD1-A4A8-4494-AC9D-6183C710F7F3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe

Task: {12D8F574-CB8F-44E1-BD10-8D8DE9A616E9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc -> Google Inc.)

Task: {150DF946-606B-4F4F-8882-AE876DF8405F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc -> Google Inc.)

Task: {1B4D8E85-A843-4874-A2DB-08AB6FD5D6C3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe

Task: {1C5D1428-EDA1-4612-A106-EEACAC7BF6AD} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2012-11-05] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)

Task: {2E173516-610C-4189-B920-AD6099F70146} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_303_Plugin.exe [1457720 2019-12-12] (Adobe Inc. -> Adobe)

Task: {32D31D15-E3A6-448D-BB00-3F4F09095D3C} - System32\Tasks\Avast Secure Browser Heartbeat Task (Hourly) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1857552 2019-11-04] (AVAST Software s.r.o. -> AVAST Software)

Task: {3D0DC0F0-9F89-491E-8FD2-A31A7A16A807} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-06-07] (AVAST Software s.r.o. -> AVAST Software)

Task: {439C28BA-9403-41CA-B616-F610B9215EEA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe

Task: {4474413D-2D28-489F-98CA-5E08333CE683} - System32\Tasks\Avast Cleanup Update => C:\Program Files (x86)\AVAST Software\Avast Cleanup\TUNEUpdate.exe [1659000 2019-07-25] (AVAST Software s.r.o. -> AVAST Software)

Task: {49A27E0B-5B04-4F9B-9A4D-6555F10C1867} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe

Task: {5070763C-565C-4D5F-832F-F0B2C157F9E8} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [1873288 2019-09-18] (AVAST Software s.r.o. -> AVAST Software)

Task: {5A4D8735-DAF2-4529-B746-2F3E40CA7901} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe

Task: {5AD950E3-8DD7-4DC0-821A-14FA3A2FF7FC} - System32\Tasks\HPCeeScheduleForDad => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [96568 2015-06-16] (Hewlett-Packard Company -> Hewlett-Packard)

Task: {7292BA83-8C8F-40AB-B0CA-00C9A8DB6E81} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [616320 2018-01-08] (Apple Inc. -> Apple Inc.)

Task: {78A10841-724B-4048-91F2-80B9F13865C9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe

Task: {7A2926F2-CC42-4DFB-A98D-FC385C58C811} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1240656 2019-09-10] (Adobe Inc. -> Adobe Systems)

Task: {7FBFE336-1586-4AA9-8A26-C1A47F472919} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe

Task: {803E29E4-6B79-42A6-9701-D502613DC866} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-12-12] (Adobe Inc. -> Adobe)

Task: {8A50BF4F-565B-4952-8C79-F071EBD40828} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe

Task: {8C8D8241-DAF0-438E-84B5-6C1DB0F13AB3} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-06-07] (AVAST Software s.r.o. -> AVAST Software)

Task: {91220D73-0368-4C09-9123-F08D717A47DE} - System32\Tasks\Avast Secure Browser Heartbeat Task (Logon) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1857552 2019-11-04] (AVAST Software s.r.o. -> AVAST Software)

Task: {9B4C076F-A7A5-499B-A208-7709F36D0B0A} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488 2011-11-28] (CyberLink -> CyberLink)

Task: {B3AA6A35-D843-4706-A35B-B0DDF91749A8} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe

Task: {BB6832A9-FF8E-4F69-8061-F548F5D5FBA0} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}

Task: {DF67DEB4-F94C-45B9-9C78-1A9FB513A809} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [3933576 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\HPCeeScheduleForDad.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280 2011-03-28] (Microsoft Corporation -> Microsoft Corp.)

Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280 2011-03-28] (Microsoft Corporation -> Microsoft Corp.)

Winsock: Catalog5 09 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc. -> Apple Inc.)

Winsock: Catalog5-x64 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392 2011-03-29] (Microsoft Corporation -> Microsoft Corp.)

Winsock: Catalog5-x64 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392 2011-03-29] (Microsoft Corporation -> Microsoft Corp.)

Winsock: Catalog5-x64 09 C:\Program Files\Bonjour\mdnsNSP.dll [133392 2015-08-12] (Apple Inc. -> Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{6612A014-7918-4302-865F-0E7013C1C906}: [DhcpNameServer] 192.168.0.1

Internet Explorer:

==================

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3620890968-501116891-2233395218-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=U146&ocid=U146DHP

HKU\S-1-5-21-3620890968-501116891-2233395218-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-3620890968-501116891-2233395218-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.bing.com/?pc=U156&form=U156HP

SearchScopes: HKLM -> {6A27897E-1F0C-4B37-9762-496A46183772} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}

SearchScopes: HKU\S-1-5-21-3620890968-501116891-2233395218-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}

BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2011-06-08] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_201\bin\ssv.dll [2019-02-10] (Oracle America, Inc. -> Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corporation -> Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_201\bin\jp2ssv.dll [2019-02-10] (Oracle America, Inc. -> Oracle Corporation)

BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2011-06-08] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_201\bin\ssv.dll [2019-02-10] (Oracle America, Inc. -> Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corporation -> Microsoft Corp.)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_201\bin\jp2ssv.dll [2019-02-10] (Oracle America, Inc. -> Oracle Corporation)

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

FireFox:

========

FF ProfilePath: C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\rkbeddvp.default [2019-12-15]

FF Homepage: Mozilla\Firefox\Profiles\rkbeddvp.default -> hxxp://www.msn.com/?pc=U146&ocid=U146DHP|hxxp://www.bing.com/?pc=U156&form=U156HP

FF Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\rkbeddvp.default\Extensions\sp@avast.com.xpi [2019-02-19]

FF Extension: (Avast Online Security) - C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\rkbeddvp.default\Extensions\wrc@avast.com.xpi [2018-07-17]

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_32_0_0_303.dll [2019-12-12] (Adobe Inc. -> )

FF Plugin: @java.com/DTPlugin,version=11.201.2 -> C:\Program Files\Java\jre1.8.0_201\bin\dtplugin\npDeployJava1.dll [2019-02-10] (Oracle America, Inc. -> Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.201.2 -> C:\Program Files\Java\jre1.8.0_201\bin\plugin2\npjp2.dll [2019-02-10] (Oracle America, Inc. -> Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_303.dll [2019-12-12] (Adobe Inc. -> )

FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2015-09-13] (Citrix Systems, Inc. -> Citrix Systems, Inc.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google Inc -> Google)

FF Plugin-x32: @java.com/DTPlugin,version=11.201.2 -> C:\Program Files (x86)\Java\jre1.8.0_201\bin\dtplugin\npDeployJava1.dll [2019-02-10] (Oracle America, Inc. -> Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.201.2 -> C:\Program Files (x86)\Java\jre1.8.0_201\bin\plugin2\npjp2.dll [2019-02-10] (Oracle America, Inc. -> Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.35.422\npGoogleUpdate3.dll [2019-12-14] (Google LLC -> Google LLC)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.35.422\npGoogleUpdate3.dll [2019-12-14] (Google LLC -> Google LLC)

FF Plugin-x32: @videolan.org/vlc,version=2.0.7 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=3.0.7.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2010-12-07] (WildTangent Inc -> )

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-08-21] (Adobe Inc. -> Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll [2016-09-16]

Chrome:

=======

CHR DefaultProfile: Default

CHR HomePage: Default -> hxxp://www.google.com/

CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.bing.com/?pc=U156&form=U156HP","hxxp://www.msn.com/?pc=U146&ocid=U146DHP"

CHR Profile: C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default [2020-01-02]

CHR DownloadDir: C:\Users\Dad\Downloads

CHR Extension: (Google Drive) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-16]

CHR Extension: (YouTube) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]

CHR Extension: (Google Search) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]

CHR Extension: (Adobe Acrobat) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2019-09-30]

CHR Extension: (Avast Online Security) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2020-01-02]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-19]

CHR Extension: (Gmail) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-23]

CHR Extension: (Chrome Media Router) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-01-02]

CHR Profile: C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Guest Profile [2015-03-07]

CHR Profile: C:\Users\Dad\AppData\Local\Google\Chrome\User Data\System Profile [2015-05-14]

CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]

CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [235520 2012-02-10] (Microsoft Windows Hardware Compatibility Publisher -> AMD)

S4 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-02-10] (Advanced Micro Devices, Inc.) [File not signed]

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [96056 2019-04-29] (Apple Inc. -> Apple Inc.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [6259592 2019-12-19] (AVAST Software s.r.o. -> AVAST Software)

S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-06-07] (AVAST Software s.r.o. -> AVAST Software)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [996880 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [417536 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-06-07] (AVAST Software s.r.o. -> AVAST Software)

S3 AvastSecureBrowserElevationService; C:\Program Files (x86)\AVAST Software\Browser\Application\77.2.2153.120\elevation_service.exe [970088 2019-11-04] (AVAST Software s.r.o. -> AVAST Software)

R2 CleanupPSvc; C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe [10287216 2019-07-25] (AVAST Software s.r.o. -> AVAST Software)

S4 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [166400 2009-09-14] (Microsoft Windows Hardware Compatibility Publisher -> SEIKO EPSON CORPORATION)

S4 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [128512 2009-09-14] (Microsoft Windows Hardware Compatibility Publisher -> SEIKO EPSON CORPORATION)

R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [6960640 2020-01-02] (Malwarebytes Inc -> Malwarebytes)

S4 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [321536 2012-10-29] (IDT, Inc.) [File not signed]

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation)

R2 wlidsvc; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2292096 2011-03-29] (Microsoft Corporation -> Microsoft Corp.)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Accelerometer; C:\Windows\System32\DRIVERS\Accelerometer.sys [43840 2012-09-24] (Hewlett-Packard Company -> Hewlett-Packard Company)

R3 amdhub30; C:\Windows\system32\drivers\amdhub30.sys [102528 2011-10-26] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, INC.)

R3 amdiox64; C:\Windows\system32\drivers\amdiox64.sys [46136 2010-02-18] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

R3 amdkmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [10825216 2012-02-10] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)

R3 amdkmdap; C:\Windows\System32\DRIVERS\atikmpag.sys [328704 2012-02-10] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [31872 2012-02-02] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

R3 amdxhc; C:\Windows\system32\drivers\amdxhc.sys [219776 2011-10-26] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, INC.)

R0 amd_sata; C:\Windows\System32\drivers\amd_sata.sys [82048 2011-12-13] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

R0 amd_xata; C:\Windows\System32\drivers\amd_xata.sys [42624 2011-12-13] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION (no ServiceDLL)

R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [204824 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdriver.sys [274456 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R0 aswbidsh; C:\Windows\System32\drivers\aswbidsh.sys [209552 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R0 aswbuniv; C:\Windows\System32\drivers\aswbuniv.sys [65120 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R1 aswKbd; C:\Windows\System32\drivers\aswKbd.sys [42736 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [171520 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R3 aswNetNd6; C:\Windows\System32\DRIVERS\aswNetNd6.sys [38152 2017-07-11] (AVAST Software s.r.o. -> AVAST Software)

R1 aswNetSec; C:\Windows\System32\drivers\aswNetSec.sys [552848 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [110320 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [83792 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [848432 2019-10-08] (AVAST Software s.r.o. -> AVAST Software)

R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [460448 2019-10-08] (AVAST Software s.r.o. -> AVAST Software)

R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [236024 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [316528 2019-10-07] (AVAST Software s.r.o. -> AVAST Software)

R3 athr; C:\Windows\System32\DRIVERS\athrx.sys [2801664 2012-01-10] (Microsoft Windows Hardware Compatibility Publisher -> Atheros Communications, Inc.)

R3 clwvd; C:\Windows\System32\DRIVERS\clwvd.sys [31088 2010-07-28] (CyberLink -> CyberLink Corporation)

R0 hpdskflt; C:\Windows\System32\drivers\hpdskflt.sys [31040 2012-09-24] (Hewlett-Packard Company -> Hewlett-Packard Company)

R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [216544 2020-01-02] (Malwarebytes Inc -> Malwarebytes)

R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [278344 2020-01-02] (Malwarebytes Inc -> Malwarebytes)

R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [258664 2011-09-21] (Realtek Semiconductor Corp -> Realtek Semiconductor Corp.)

S3 SrvHsfHDA; C:\Windows\System32\DRIVERS\VSTAZL6.SYS [292864 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)

S3 SrvHsfV92; C:\Windows\System32\DRIVERS\VSTDPV6.SYS [1485312 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)

S3 SrvHsfWinac; C:\Windows\System32\DRIVERS\VSTCNXT6.SYS [740864 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)

R3 STHDA; C:\Windows\System32\DRIVERS\stwrt64.sys [540160 2012-10-29] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2015-06-17] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.)

R3 usbfilter; C:\Windows\System32\DRIVERS\usbfilter.sys [56448 2012-01-14] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-01-02 18:36 - 2020-01-02 18:36 - 002272256 _____ (Farbar) C:\Users\Dad\Downloads\FRST64.exe

2020-01-02 18:34 - 2020-01-02 18:34 - 002000896 _____ (Farbar) C:\Users\Dad\Downloads\FRST.exe

2020-01-02 18:30 - 2020-01-02 18:31 - 000001684 _____ C:\Users\Dad\Desktop\Rkill.txt

2020-01-02 18:30 - 2020-01-02 18:30 - 001802704 _____ (Bleeping Computer, LLC) C:\Users\Dad\Downloads\rkill.exe

2020-01-02 18:30 - 2020-01-02 18:30 - 000988112 _____ (Bleeping Computer, LLC) C:\Users\Dad\Downloads\rkill64-14014.exe

2020-01-02 18:30 - 2020-01-02 18:30 - 000988112 _____ (Bleeping Computer, LLC) C:\Users\Dad\Downloads\rkill64.exe

2020-01-02 18:28 - 2020-01-02 18:38 - 000000000 ____D C:\Users\Dad\Desktop\MalwareRemoval2020Jan

2020-01-02 18:04 - 2020-01-02 18:04 - 000000000 ____D C:\Users\Dad\AppData\Local\mbam

2020-01-02 18:04 - 2020-01-02 18:04 - 000000000 ____D C:\Users\Dad\AppData\Local\cache

2020-01-02 18:03 - 2020-01-02 18:03 - 000278344 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys

2020-01-02 18:03 - 2020-01-02 18:03 - 000216544 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys

2020-01-02 18:03 - 2020-01-02 18:03 - 000001908 _____ C:\Users\Public\Desktop\Malwarebytes.lnk

2020-01-02 18:03 - 2020-01-02 18:03 - 000001908 _____ C:\ProgramData\Desktop\Malwarebytes.lnk

2020-01-02 18:03 - 2020-01-02 18:03 - 000000000 ____D C:\Users\Dad\AppData\Local\mbamtray

2020-01-02 18:03 - 2020-01-02 18:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes

2020-01-02 18:03 - 2020-01-02 18:02 - 000153312 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys

2020-01-02 18:01 - 2020-01-02 18:01 - 000000000 ____D C:\Program Files\Malwarebytes

2020-01-02 18:00 - 2020-01-02 18:01 - 001883976 _____ (Malwarebytes) C:\Users\Dad\Downloads\MBSetup (1).exe

2020-01-02 17:51 - 2020-01-02 17:51 - 001883976 _____ (Malwarebytes) C:\Users\Dad\Downloads\MBSetup.exe

2019-12-29 12:48 - 2019-12-29 12:48 - 000000000 ____D C:\Users\Dad\AppData\Local\{27A4A69C-7F06-4832-8A42-5287B3F667ED}

2019-12-29 12:47 - 2019-12-29 12:47 - 000000000 ____D C:\Users\Dad\AppData\Local\{5FA10809-DD06-43BE-875F-AA1FC1CB4EF0}

2019-12-29 11:44 - 2019-12-29 11:44 - 000346616 _____ C:\Windows\system32\FNTCACHE.DAT

2019-12-19 18:12 - 2019-12-19 18:12 - 000000000 ____D C:\Users\Dad\AppData\Local\{423DCD8E-DCCB-42D4-9C95-0F129116D079}

2019-12-12 11:38 - 2019-12-12 11:38 - 000357000 _____ C:\Users\Mom\Desktop\Temescal Wellness Employee Handbook 2017.12.7.final.pdf

2019-12-12 10:55 - 2019-10-07 23:07 - 000355720 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-01-02 18:39 - 2015-03-13 14:30 - 000000000 ____D C:\FRST

2020-01-02 18:26 - 2013-12-25 05:44 - 000000000 ____D C:\Users\Dad\Desktop\Dad

2020-01-02 18:10 - 2009-07-13 23:45 - 000031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2020-01-02 18:10 - 2009-07-13 23:45 - 000031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2020-01-02 18:05 - 2012-09-29 21:04 - 000000000 ____D C:\Users\Dad\AppData\Local\CrashDumps

2020-01-02 18:05 - 2012-09-09 12:04 - 000003934 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{080211DC-3C06-4620-B782-F3CEFC0989D3}

2020-01-02 18:04 - 2012-09-21 17:13 - 000000000 ____D C:\ProgramData\AVAST Software

2020-01-02 18:02 - 2013-08-22 17:40 - 000000000 ____D C:\ProgramData\Malwarebytes

2020-01-02 18:00 - 2018-06-07 18:42 - 000000000 ____D C:\Users\Dad\AppData\Local\AVAST Software

2020-01-02 17:56 - 2009-07-14 00:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2020-01-02 15:38 - 2016-10-11 03:34 - 000000324 _____ C:\Windows\Tasks\HPCeeScheduleForDad.job

2020-01-01 04:22 - 2016-10-23 16:25 - 000003934 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{11815D3D-FE99-4F33-BA9D-6275ED4372B2}

2019-12-31 19:55 - 2009-07-14 00:13 - 000782510 _____ C:\Windows\system32\PerfStringBackup.INI

2019-12-31 19:55 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\inf

2019-12-29 12:09 - 2012-12-25 20:49 - 000000000 ____D C:\Users\Dad\AppData\Roaming\vlc

2019-12-29 11:49 - 2017-03-18 08:56 - 000004168 _____ C:\Windows\system32\Tasks\Avast Emergency Update

2019-12-21 19:34 - 2018-03-14 02:09 - 000004466 _____ C:\Windows\system32\Tasks\Adobe Flash Player NPAPI Notifier

2019-12-21 19:34 - 2017-04-05 16:28 - 000003934 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{D7665731-4F0B-42EC-A194-26AB7F71CE01}

2019-12-21 19:34 - 2017-04-05 15:46 - 000003934 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{60017BC0-8EA8-43E1-A9F9-338B7763FD5F}

2019-12-21 19:34 - 2017-03-18 12:03 - 000003934 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{E0FA49D2-57CF-492A-B9C6-A0AA9D0CBD8D}

2019-12-21 19:34 - 2017-03-18 10:38 - 000003934 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{9FB0C4BB-C498-4EF2-993B-9B103BFA3618}

2019-12-21 19:34 - 2016-10-11 03:34 - 000003174 _____ C:\Windows\system32\Tasks\HPCeeScheduleForDad

2019-12-21 19:34 - 2015-12-03 18:25 - 000000000 ____D C:\Windows\system32\Tasks\AVAST Software

2019-12-21 19:34 - 2012-09-21 17:14 - 000003334 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA

2019-12-21 19:34 - 2012-09-21 17:14 - 000003206 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore

2019-12-21 19:34 - 2012-07-16 04:49 - 000003148 _____ C:\Windows\system32\Tasks\MirageAgent

2019-12-21 19:34 - 2012-03-01 02:33 - 000004312 _____ C:\Windows\system32\Tasks\Adobe Flash Player Updater

2019-12-21 17:05 - 2009-07-14 00:08 - 000032588 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2019-12-19 23:53 - 2017-12-18 21:05 - 000002224 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2019-12-12 13:49 - 2012-10-29 16:18 - 000000000 ____D C:\Program Files\IDT

2019-12-12 13:49 - 2012-09-09 12:06 - 000000000 ____D C:\Users\Dad

2019-12-12 13:49 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\registration

2019-12-12 13:48 - 2012-09-09 12:16 - 000000000 __RHD C:\MSOCache

2019-12-12 11:44 - 2014-12-23 17:02 - 000004478 _____ C:\Windows\system32\Tasks\Adobe Acrobat Update Task

2019-12-12 11:32 - 2016-10-23 16:24 - 000000000 ____D C:\Users\Mom

2019-12-12 11:09 - 2012-03-01 02:33 - 000842296 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerApp.exe

2019-12-12 11:09 - 2012-03-01 02:33 - 000175160 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2019-12-12 11:09 - 2012-03-01 02:33 - 000000000 ____D C:\Windows\SysWOW64\Macromed

2019-12-12 11:09 - 2012-03-01 02:33 - 000000000 ____D C:\Windows\system32\Macromed

2019-12-12 10:58 - 2015-03-20 03:18 - 000001963 _____ C:\Users\Public\Desktop\Avast Internet Security.lnk

2019-12-12 10:58 - 2015-03-20 03:18 - 000001963 _____ C:\ProgramData\Desktop\Avast Internet Security.lnk

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

LastRegBack: 2019-12-31 22:05

==================== End of FRST.txt ========================

Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-12-2019

Ran by Dad (02-01-2020 18:40:24)

Running from C:\Users\Dad\Desktop\MalwareRemoval2020Jan

Windows 7 Home Premium Service Pack 1 (X64) (2012-09-09 17:06:48)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3620890968-501116891-2233395218-500 - Administrator - Disabled)

Dad (S-1-5-21-3620890968-501116891-2233395218-1001 - Administrator - Enabled) => C:\Users\Dad

Guest (S-1-5-21-3620890968-501116891-2233395218-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3620890968-501116891-2233395218-1003 - Limited - Enabled)

Mom (S-1-5-21-3620890968-501116891-2233395218-1793 - Administrator - Enabled) => C:\Users\Mom

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3620890968-501116891-2233395218-1001\...\uTorrent) (Version: 3.3.1.30017 - BitTorrent Inc.)

ACDSee (HKLM-x32\...\ACDSee) (Version: - )

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.012.20040 - Adobe Systems Incorporated)

Adobe Flash Player 32 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 32.0.0.303 - Adobe)

Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.303 - Adobe)

AMD Catalyst Install Manager (HKLM\...\{9D1400EC-5703-3983-53B7-AEFB8BFD1CFA}) (Version: 3.0.864.0 - Advanced Micro Devices, Inc.)

Apple Application Support (32-bit) (HKLM-x32\...\{C1BCFECF-6EC2-4750-9072-5E2489423F8F}) (Version: 7.5 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{B202C7F5-7DE3-4FBF-B259-E70E625F56FC}) (Version: 7.5 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{B5A46811-3612-4DA5-8A5A-E6DED5D7C523}) (Version: 12.2.1.12 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.)

Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.2 - Atheros)

Avast Cleanup Premium (HKLM-x32\...\{075CC190-59EE-499F-828B-0B5C098C8C15}_is1) (Version: 19.1.7734 - AVAST Software)

Avast Internet Security (HKLM-x32\...\Avast Antivirus) (Version: 19.8.2393 - AVAST Software)

Avast Secure Browser (HKLM-x32\...\Avast Secure Browser) (Version: 77.2.2153.120 - AVAST Software)

Bejeweled 3 (HKLM-x32\...\WTA-58deae98-7c9c-4f8e-91b8-45b955b48233) (Version: 2.2.0.97 - WildTangent) Hidden

Blackhawk Striker 2 (HKLM-x32\...\WTA-873e254b-4410-4194-90e3-605f8028f797) (Version: 2.2.0.95 - WildTangent) Hidden

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

Chuzzle Deluxe (HKLM-x32\...\WTA-77fc6c1e-34d6-46ba-8fb7-74f34939ec66) (Version: 2.2.0.95 - WildTangent) Hidden

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)

Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.3.100.10 - Citrix Systems, Inc.)

Coupon Printer for Windows (HKLM-x32\...\Coupon Printer for Windows5.0.1.9) (Version: 5.0.1.9 - Coupons.com Incorporated)

Cradle of Rome 2 (HKLM-x32\...\WTA-f3fe1a55-09a6-486e-8c86-1e23275bc059) (Version: 2.2.0.98 - WildTangent) Hidden

CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version: 3.0 - CutePDF.com)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.2.4725 - CyberLink Corp.)

D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden

Dora's World Adventure (HKLM-x32\...\WTA-945f9323-9fe6-45f7-834d-b22c919219fc) (Version: 2.2.0.95 - WildTangent) Hidden

Epson Event Manager (HKLM-x32\...\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION)

EPSON NX420 Series Printer Uninstall (HKLM\...\EPSON NX420 Series) (Version: - SEIKO EPSON Corporation)

EPSON NX620 Series Printer Uninstall (HKLM\...\EPSON NX620 Series) (Version: - SEIKO EPSON Corporation)

EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)

EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)

EpsonNet Setup 3.3 (HKLM-x32\...\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.3b - SEIKO EPSON CORPORATION)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )

ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{768A6276-5822-489C-8A2B-67190F745655}) (Version: 4.1.2 - Hewlett-Packard)

Evernote v. 4.5.2 (HKLM-x32\...\{8CE152BA-1D16-11E1-867D-984BE15F174E}) (Version: 4.5.2.5904 - Evernote Corp.)

Farm Frenzy (HKLM-x32\...\WTA-758db886-b670-4a4e-b552-8d93149fb05f) (Version: 2.2.0.98 - WildTangent) Hidden

Farmscapes (HKLM-x32\...\WTA-f2117a8d-2ae0-4404-b115-58b037c41b6b) (Version: 2.2.0.98 - WildTangent) Hidden

FATE (HKLM-x32\...\WTA-d5423aea-27c8-4663-952c-73ab0da3c765) (Version: 2.2.0.97 - WildTangent) Hidden

Final Drive Fury (HKLM-x32\...\WTA-e979f20f-d263-449b-9e36-512745533641) (Version: 2.2.0.95 - WildTangent) Hidden

FUJIFILM MyFinePix Studio 3.2 (HKLM-x32\...\MyFinePix Studio_is1) (Version: - )

GIMP 2.6.10 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.10 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 79.0.3945.88 - Google LLC)

Google Earth Plug-in (HKLM-x32\...\{57BB4801-61C8-4E74-9672-2160728A461E}) (Version: 7.1.5.1557 - Google)

Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.35.421 - Google LLC) Hidden

Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (HKLM-x32\...\{6F340107-F9AA-47C6-B54C-C3A19F11553F}) (Version: 1.00.0000 - Hewlett-Packard Company) Hidden

Hoyle Card Games (HKLM-x32\...\WTA-acde6728-9be8-4ae7-9bbf-7721c28ce33a) (Version: 2.2.0.95 - WildTangent) Hidden

HP 3D DriveGuard (HKLM\...\{54CE68A8-4F2D-4328-B1F7-D6C720405F7F}) (Version: 4.2.9.1 - Hewlett-Packard Company)

HP Application Assistant (HKLM\...\{0CE7EBAF-157D-4111-9146-057CB2A4023E}) (Version: 1.1.466.3970 - Hewlett-Packard)

HP CoolSense (HKLM-x32\...\{59F8C5AA-91BD-423D-BF05-09A80F39898F}) (Version: 2.10.62 - Hewlett-Packard Company)

HP Documentation (HKLM-x32\...\{EDA2B6DE-C67C-4FD7-AF6A-9D79E002707C}) (Version: 1.1.0.0 - Hewlett-Packard)

HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)

HP Launch Box (HKLM\...\{5A847522-375C-4D05-BD3D-88C450CC047F}) (Version: 1.1.5 - Hewlett-Packard Company)

HP MovieStore (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.1.21096.0 - Hewlett-Packard Company)

HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)

HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company)

HP Quick Launch (HKLM-x32\...\{E5823036-6F09-4D0A-B05C-E2BAA129288A}) (Version: 3.0.6 - Hewlett-Packard Company)

HP Security Assistant (HKLM\...\{F9DF0B5D-554B-45D2-8698-7C467FAF4BCA}) (Version: 2.0.2 - Hewlett-Packard Company)

HP Setup (HKLM-x32\...\{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}) (Version: 9.0.15109.3899 - Hewlett-Packard Company)

HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.2.14901.3869 - Hewlett-Packard Company)

HP Software Framework (HKLM-x32\...\{675D093B-815D-47FD-AB2C-192EC751E8E2}) (Version: 4.6.10.1 - Hewlett-Packard Company)

IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6417.0 - IDT)

iTunes (HKLM\...\{D9D08A8F-5A03-486A-AD4D-3A438D521F8B}) (Version: 12.9.3.3 - Apple Inc.)

Java 8 Update 201 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180201F0}) (Version: 8.0.2010.9 - Oracle Corporation)

Java 8 Update 201 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180201F0}) (Version: 8.0.2010.9 - Oracle Corporation)

Jewel Match 3 (HKLM-x32\...\WTA-6fb651a8-875b-490e-a2bf-33c04ebca357) (Version: 2.2.0.98 - WildTangent) Hidden

Jewel Quest Mysteries: The Seventh Gate Collector's Edition (HKLM-x32\...\WTA-68365846-4b17-4c75-a949-47e39fc84e56) (Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (HKLM-x32\...\WTA-73ee02d3-aa18-4cdf-bc13-facad5d73c8c) (Version: 2.2.0.95 - WildTangent) Hidden

Junk Mail filter update (HKLM-x32\...\{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}) (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Letters from Nowhere 2 (HKLM-x32\...\WTA-409de407-6228-436c-be99-31873d4596e2) (Version: 2.2.0.97 - WildTangent) Hidden

Luxor HD (HKLM-x32\...\WTA-7aa113b2-6009-40eb-9393-3c3967c2b587) (Version: 2.2.0.98 - WildTangent) Hidden

Mah Jong Medley (HKLM-x32\...\WTA-c8d4b554-c064-4dd6-bdcb-87a0d3c23690) (Version: 2.2.0.95 - WildTangent) Hidden

Malwarebytes version 4.0.4.49 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.0.4.49 - Malwarebytes)

Mesh Runtime (HKLM-x32\...\{8C6D6116-B724-4810-8F2D-D047E6B7D68E}) (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Mozilla Firefox 56.0.2 (x64 en-US) (HKLM\...\Mozilla Firefox 56.0.2 (x64 en-US)) (Version: 56.0.2 - Mozilla)

Mozil

Back to top

#2 brabirschorr

Member

Full Member
79 posts

Posted 03 January 2020 - 05:47 AM

eset.txt:

1/3/2020 6:43:58 AM

Files scanned: 415859

Detected files: 8

Cleaned files: 6

Total scan time 06:11:52

Scan status: Finished

C:\Program Files\AVAST Software\Avast\Setup\aswOfferTool.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application error while deleting (Access denied)

C:\Program Files\AVAST Software\Avast\Setup\offertool_x64_ais-959.vpx Win32/Bundled.Toolbar.Google.D potentially unsafe application error while deleting (Access denied)

C:\Program Files (x86)\Coupons\uninstall.exe a variant of Win32/Adware.Coupons.AA application cleaned by deleting

C:\Program Files (x86)\Mozilla Firefox\browser\plugins\npMozCouponPrinter.dll a variant of Win32/Adware.Coupons.AA application cleaned by deleting

C:\Users\Dad\AppData\LocalLow\Oracle\Java\jre1.8.0_60\java_sp.dll a variant of Win32/YahooSearch.C potentially unwanted application,a variant of Win32/Bundled.Toolbar.Ask.O potentially unsafe application deleted

C:\Users\Dad\AppData\Roaming\uTorrent\updates\3.3.1_30017.exe Win32/AdkDLLWrapper.A potentially unwanted application,a variant of Win32/Bunndle potentially unsafe application deleted

C:\Users\Dad\AppData\Roaming\uTorrent\uTorrent.exe Win32/AdkDLLWrapper.A potentially unwanted application,a variant of Win32/Bunndle potentially unsafe application deleted

C:\Windows\CouponPrinter.ocx a variant of Win32/Adware.Coupons.AA application cleaned by deleting

Back to top

#3 nasdaq

Forum Deity

Global Moderator
49,403 posts

Posted 03 January 2020 - 06:33 AM

Hello, Welcome to SpywareInfoForum.

I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.

===

Your logs are clean of malware.

Let me know if you need any additional help.

nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

Back to top

#4 brabirschorr

Member

Full Member
79 posts

Posted 03 January 2020 - 06:47 AM

Thank you nasdaq. Can I assume that I am also "virus-free", or is that a separate scanning effort? I do run Avast Internet Security.

Thanks

Back to top

#5 nasdaq

Forum Deity

Global Moderator
49,403 posts

Posted 03 January 2020 - 10:13 AM

Hi,

Looks like you are clean.

You can check further.

Sophos Virus Removal Tool

Please download Sophos Virus Removal Tool and save it to your computer's Desktop.

Right-click the icon and select Run as administrator.

Click Yes to accept any security warnings that may appear.

Click the Next button.

Select 'I accept the terms in the license agreement', then click Next twice.

Click the Install button and wait until the installation is complete.

Click the Finish button. The tool created a shortcut icon on the Desktop of your computer.

Now, double-click the Sophos Virus Removal Tool shortcut icon to run the tool.

Click Yes to accept any security warnings that may appear.

After it updates and a "Start Scanning" button appears in the lower right:

Disconnect from the Internet or physically unplug your Internet cable connection.

Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.

Temporarily disable your anti-virus and real-time anti-spyware protection.

[/*]

Click the "Start Scanning" button in the lower right to start the scan.

After starting the scan, do not use the computer until the scan has completed.

When finished, if it detected anything there will be a "Start Clean-up" button, click it and allow it to finish.

When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.

If any threats are found click Details, then View Log file (bottom left-hand corner).

Copy and paste its contents in your next reply and note any errors encountered.

Close the Notepad document, close the Threat Details screen, then click Start cleanup.

Click Exit to close the program.

If no threats were found, please confirm that result.

Note: Whenever necessary, the log will be in the following location:

Windows Vista and above:

C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log

Please post the contents of the log in your next reply and note any errors encountered.

===

nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

Back to top

#6 nasdaq

Forum Deity

Global Moderator
49,403 posts

Posted 17 March 2020 - 06:28 AM

Glad we could help. :)

If you need this topic reopened, please tell the moderating team by replying here with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760