Fix result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018 Ran by Gary_Linda (27-01-2018 20:47:36) Run:1 Running from C:\Users\Gary_Linda\Desktop Loaded Profiles: Gary_Linda (Available Profiles: Gary_Linda) Boot Mode: Normal ============================================== fixlist content: ***************** VirusTotal: C:\ProgramData\Uafdsiuirecri\1.0.7.1\diemiimu.exe HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-21-3615104535-3221751416-1031096358-1001\...\MountPoints2: {5ebcab6c-07d8-11e3-b927-6817296f8fb9} - E:\MotoCastSetup.exe -a HKU\S-1-5-21-3615104535-3221751416-1031096358-1001\...\MountPoints2: {7404b54a-051a-11e3-a545-6817296f8fb9} - E:\VZW_Software_upgrade_assistant.exe HKU\S-1-5-21-3615104535-3221751416-1031096358-1001\...\MountPoints2: {b463bb94-0e77-11e5-8893-6817296f8fb9} - E:\VZW_Software_upgrade_assistant.exe HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = SearchScopes: HKLM -> DefaultScope {6874A383-FB6D-4AAA-B1CB-C3E4BA38E365} URL = SearchScopes: HKLM -> OldSearch URL = SearchScopes: HKU\S-1-5-21-3615104535-3221751416-1031096358-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3615104535-3221751416-1031096358-1001 -> {6874A383-FB6D-4AAA-B1CB-C3E4BA38E365} URL = FF Extension: (Keepa - Amazon Price Tracker) - C:\Users\Gary_Linda\AppData\Roaming\Mozilla\Firefox\Profiles\bblby9lz.default-1448393382752\Extensions\amptra@keepa.com.xpi [2017-12-20] FF Extension: (Entrality) - C:\Users\Gary_Linda\AppData\Roaming\Mozilla\Firefox\Profiles\bblby9lz.default-1448393382752\Extensions\{eb260b8d-f7d3-48d8-a29a-c2b07e1ed36e}.xpi [2017-12-26] U3 aswbdisk; no ImagePath S3 dbx; system32\DRIVERS\dbx.sys [X] S3 SWDUMon; system32\DRIVERS\SWDUMon.sys [X] Task: {093721C9-CB57-4DC9-855B-042A6AA7DF93} - System32\Tasks\Uafdsiuirecri => C:\ProgramData\Uafdsiuirecri\1.0.7.1\diemiimu.exe Task: {1213541F-1274-4173-B3A7-A315AB3C9E91} - System32\Tasks\SDMsgUpdate (SD) => C:\PROGRA~2\SMARTD~1\Messages\SDNotify.exe Task: {2FDEED3D-1B13-4993-AD9D-5D7E254D3A57} - System32\Tasks\{69579E4F-76AF-454A-995C-3CAA87488A86} => C:\Windows\system32\pcalua.exe -a C:\Users\Gary_Linda\Downloads\VerizonWindowsInstaller.exe -d C:\Users\Gary_Linda\Downloads Task: {394FE171-C443-43F1-8E77-05E30D8A59DD} - System32\Tasks\{481DE801-0CAB-4D12-8D6F-4B6DEAE56310} => C:\Windows\system32\pcalua.exe -a C:\Users\Gary_Linda\Downloads\Install_PDFR_v224.exe -d C:\Users\Gary_Linda\Downloads Task: {65295EC3-F7D8-4E63-A58F-C4CFC2D5CBF9} - System32\Tasks\{51FECAA6-2F1D-4AEF-8CBD-AEB06C57A4D7} => C:\Windows\system32\pcalua.exe -a C:\Users\Gary_Linda\Desktop\jxpiinstall(1).exe -d C:\Users\Gary_Linda\Desktop Task: {C0D782D0-1CAA-4EB1-9166-F94AB9050B6E} - System32\Tasks\{DC01F332-3574-46B5-81D8-EE83EC4FC787} => C:\Windows\system32\pcalua.exe -a C:\Users\Gary_Linda\Documents\unInstaller.exe -d C:\Users\Gary_Linda\Documents Task: {C4B21A0E-97D9-41C9-A56A-90922B5CA654} - System32\Tasks\DriverDR Scheduled Scan => C:\Program Files\DriverDR.com\DriverDR\DriverDR.exe Task: {C730A888-8AFD-450D-B8D2-C68BEFFB264D} - System32\Tasks\0316avzUpdateInfo => C:\ProgramData\Avg_Update_0316avz\0316avz_AVG-Secure-Search-Update.exe Task: {DD69F097-B162-400B-BFEE-9412963CEFE4} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe Task: {F419FE61-5AB3-4FD1-8183-8E3A497CC4D0} - System32\Tasks\{660F0201-43FA-42C5-B960-486AF309956E} => C:\Windows\system32\pcalua.exe -a C:\ProgramData\CrimeWatch\uninstall.exe Task: {F60BF65B-0E71-4AFB-AB7A-92721282B5FB} - System32\Tasks\{E21FA52E-710A-4730-BE6D-BE35CDAB3617} => C:\Windows\system32\pcalua.exe -a C:\Users\Gary_Linda\Desktop\Audio_IDT_W74_A01_Setup-FKRT4_ZPE.exe -d C:\Users\Gary_Linda\Desktop Task: C:\Windows\Tasks\0316avzUpdateInfo.job => C:\ProgramData\Avg_Update_0316avz\0316avz_AVG-Secure-Search-Update.exe Task: C:\Windows\Tasks\DriverDR Scheduled Scan.job => C:\Program Files\DriverDR.com\DriverDR\DriverDR.exe--scan C:\Program Files\DriverDR.com Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\Windows\Tasks\SDMsgUpdate (SD).job => C:\PROGRA~2\SMARTD~1\Messages\SDNotify.exe\-PSD -V22000000 -SSDU.ini -A -Mhxxp:/www.smartdraw.com/msgs/messagecheck.asp ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File CustomCLSID: HKU\S-1-5-21-3615104535-3221751416-1031096358-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> "C:\Windows\system32\igfxEM.exe" => No File C:\ProgramData\Uafdsiuirecri ResetHosts: EmptyTemp: CMD: FOR /F "usebackq delims==" %i IN (`wevtutil el`) DO wevtutil cl "%i" ***************** "VirusTotal: C:\ProgramData\Uafdsiuirecri\1.0.7.1\diemiimu.exe" => not found "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run\\Sidebar" => removed successfully "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\\Sidebar" => removed successfully "HKU\S-1-5-21-3615104535-3221751416-1031096358-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ebcab6c-07d8-11e3-b927-6817296f8fb9}" => removed successfully HKLM\Software\Classes\CLSID\{5ebcab6c-07d8-11e3-b927-6817296f8fb9} => invalid subkey removed. "HKU\S-1-5-21-3615104535-3221751416-1031096358-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7404b54a-051a-11e3-a545-6817296f8fb9}" => removed successfully HKLM\Software\Classes\CLSID\{7404b54a-051a-11e3-a545-6817296f8fb9} => key not found "HKU\S-1-5-21-3615104535-3221751416-1031096358-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b463bb94-0e77-11e5-8893-6817296f8fb9}" => removed successfully HKLM\Software\Classes\CLSID\{b463bb94-0e77-11e5-8893-6817296f8fb9} => key not found HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\OldSearch" => removed successfully HKLM\Software\Classes\CLSID\OldSearch => key not found "HKU\S-1-5-21-3615104535-3221751416-1031096358-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully "HKU\S-1-5-21-3615104535-3221751416-1031096358-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6874A383-FB6D-4AAA-B1CB-C3E4BA38E365}" => removed successfully HKLM\Software\Classes\CLSID\{6874A383-FB6D-4AAA-B1CB-C3E4BA38E365} => key not found C:\Users\Gary_Linda\AppData\Roaming\Mozilla\Firefox\Profiles\bblby9lz.default-1448393382752\Extensions\amptra@keepa.com.xpi => moved successfully C:\Users\Gary_Linda\AppData\Roaming\Mozilla\Firefox\Profiles\bblby9lz.default-1448393382752\Extensions\{eb260b8d-f7d3-48d8-a29a-c2b07e1ed36e}.xpi => moved successfully "HKLM\System\CurrentControlSet\Services\aswbdisk" => removed successfully aswbdisk => service removed successfully "HKLM\System\CurrentControlSet\Services\dbx" => removed successfully dbx => service removed successfully "HKLM\System\CurrentControlSet\Services\SWDUMon" => removed successfully SWDUMon => service removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{093721C9-CB57-4DC9-855B-042A6AA7DF93} => could not remove key. ErrorCode1: 0x00000002 "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{093721C9-CB57-4DC9-855B-042A6AA7DF93}" => removed successfully C:\Windows\System32\Tasks\Uafdsiuirecri => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Uafdsiuirecri" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1213541F-1274-4173-B3A7-A315AB3C9E91}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1213541F-1274-4173-B3A7-A315AB3C9E91}" => removed successfully C:\Windows\System32\Tasks\SDMsgUpdate (SD) => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SDMsgUpdate (SD)" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2FDEED3D-1B13-4993-AD9D-5D7E254D3A57}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2FDEED3D-1B13-4993-AD9D-5D7E254D3A57}" => removed successfully C:\Windows\System32\Tasks\{69579E4F-76AF-454A-995C-3CAA87488A86} => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{69579E4F-76AF-454A-995C-3CAA87488A86}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{394FE171-C443-43F1-8E77-05E30D8A59DD}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{394FE171-C443-43F1-8E77-05E30D8A59DD}" => removed successfully C:\Windows\System32\Tasks\{481DE801-0CAB-4D12-8D6F-4B6DEAE56310} => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{481DE801-0CAB-4D12-8D6F-4B6DEAE56310}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{65295EC3-F7D8-4E63-A58F-C4CFC2D5CBF9}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{65295EC3-F7D8-4E63-A58F-C4CFC2D5CBF9}" => removed successfully C:\Windows\System32\Tasks\{51FECAA6-2F1D-4AEF-8CBD-AEB06C57A4D7} => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{51FECAA6-2F1D-4AEF-8CBD-AEB06C57A4D7}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C0D782D0-1CAA-4EB1-9166-F94AB9050B6E}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C0D782D0-1CAA-4EB1-9166-F94AB9050B6E}" => removed successfully C:\Windows\System32\Tasks\{DC01F332-3574-46B5-81D8-EE83EC4FC787} => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{DC01F332-3574-46B5-81D8-EE83EC4FC787}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C4B21A0E-97D9-41C9-A56A-90922B5CA654}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C4B21A0E-97D9-41C9-A56A-90922B5CA654}" => removed successfully C:\Windows\System32\Tasks\DriverDR Scheduled Scan => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DriverDR Scheduled Scan" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C730A888-8AFD-450D-B8D2-C68BEFFB264D}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C730A888-8AFD-450D-B8D2-C68BEFFB264D}" => removed successfully C:\Windows\System32\Tasks\0316avzUpdateInfo => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0316avzUpdateInfo" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DD69F097-B162-400B-BFEE-9412963CEFE4}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DD69F097-B162-400B-BFEE-9412963CEFE4}" => removed successfully C:\Windows\System32\Tasks\SidebarExecute => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SidebarExecute" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F419FE61-5AB3-4FD1-8183-8E3A497CC4D0}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F419FE61-5AB3-4FD1-8183-8E3A497CC4D0}" => removed successfully C:\Windows\System32\Tasks\{660F0201-43FA-42C5-B960-486AF309956E} => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{660F0201-43FA-42C5-B960-486AF309956E}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F60BF65B-0E71-4AFB-AB7A-92721282B5FB}" => removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F60BF65B-0E71-4AFB-AB7A-92721282B5FB}" => removed successfully C:\Windows\System32\Tasks\{E21FA52E-710A-4730-BE6D-BE35CDAB3617} => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E21FA52E-710A-4730-BE6D-BE35CDAB3617}" => removed successfully C:\Windows\Tasks\0316avzUpdateInfo.job => moved successfully C:\Windows\Tasks\DriverDR Scheduled Scan.job => moved successfully C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => moved successfully C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => moved successfully C:\Windows\Tasks\SDMsgUpdate (SD).job => moved successfully "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw" => removed successfully HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => removed successfully HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avg" => removed successfully HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found "HKU\S-1-5-21-3615104535-3221751416-1031096358-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}" => removed successfully "C:\ProgramData\Uafdsiuirecri" => not found ResetHosts: => Error: No automatic fix found for this entry. ========= FOR /F "usebackq delims==" %i IN (`wevtutil el`) DO wevtutil cl "%i" ========= ========= End of CMD: ========= =========== EmptyTemp: ========== BITS transfer queue => 8388608 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 30493474 B Java, Flash, Steam htmlcache => 506 B Windows/system/drivers => 152670633 B Edge => 0 B Chrome => 909512 B Firefox => 45926988 B Opera => 0 B Temp, IE cache, history, cookies, recent: Users => 0 B Default => 0 B Public => 0 B ProgramData => 0 B systemprofile => 16802 B systemprofile32 => 233943 B LocalService => 0 B NetworkService => 43346 B Gary_Linda => 68946668 B RecycleBin => 44589150 B EmptyTemp: => 335.9 MB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 20:48:53 ====