Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Daughters laptop running extremely slow and popups [Closed]


  • This topic is locked This topic is locked

#1
busymomof4kids

busymomof4kids

    Member

  • Member
  • PipPip
  • 39 posts

If someone could help my daughters laptop is running extremely slow and is having a lot of popups. Any help would be greatly appreciated..

 

Thank you

Tracy


  • 0

Advertisements


#2
23red

23red

    Trusted Helper

  • Malware Removal
  • 1,797 posts

Hi busymomof4kids :)

 

I'm 23red, and it'll be my pleasure to assist you with your problem. 

 

Please keep these guidelines in mind as we proceed :

 

•  Please make sure to carefully read every post completely before doing anything.
 
•  If you're not sure, or if something unexpected happens do not continue! Stop and ask!  It is not a problem.
 
•  Please do not run any other scans or other software on your computer unless asked as it may make this repair more difficult.
 
•  Please stick with me until all malware is gone from your system.  Malware removal is not an instant process, just because you no longer see any symptoms it does not necessarily mean your system is completely clear.

 

•  Please copy/paste to Notepad and save my instructions as a text file on your desktop, or print them out, as you may not be able to access this thread at times.

 

Back up your data. I will not knowingly suggest your any course that might damage your system but sometimes Malware infections are so severe that only option we have is to re-format and re-install the operating system.

 

•  As I am currently in training, I will be helping you under the supervision of our Expert Teachers.   As such, there will likely be a delay between posts.   I do my best to respond as quick as I can.  I, like everyone else here am also a volunteer and sometimes life keeps me busy  ;)

 

•  Thank you for your understanding and I appreciate your patience.

 

 

Let's do this so we can have a look:

 

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

 

  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will produce a log called FRST.txt in the same directory the tool is run from.
  • Please copy and paste log back here.
  • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

 

 

 


  • 0

#3
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-09-2014
Ran by Sarah (administrator) on SARAH-HP on 12-09-2014 11:34:06
Running from C:\Users\Sarah\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\ccsvchst.exe
(Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\Whilokii\updateWhilokii.exe
() C:\Program Files (x86)\Whilokii\bin\utilWhilokii.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\ccsvchst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(ooVoo LLC) C:\Program Files (x86)\ooVoo\ooVoo.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(MyPCBackup.com) C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Whilokii\bin\Whilokii.PurBrowse64.exe
() C:\Program Files (x86)\Whilokii\bin\Whilokii.BrowserAdapter.exe
() C:\Program Files (x86)\Whilokii\bin\Whilokii.BrowserAdapter64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicatorCom.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Temp\GoogleUpdateSetup.exe5aa832
(Google Inc.) C:\Users\Sarah\AppData\Local\Temp\GUM3716.tmp\GoogleUpdate.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Apple Inc.) C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
(Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\symerr.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Sarah\Downloads\FRST64 (2).exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-09] (Synaptics Incorporated)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-06-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2844608 2012-10-15] (Eastman Kodak Company)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe [2640408 2014-09-12] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-21-2789968882-3570388344-1764720213-1001\...\Run: [Google Update] => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-12-25] (Google Inc.)
HKU\S-1-5-21-2789968882-3570388344-1764720213-1001\...\Run: [ooVoo.exe] => C:\Program Files (x86)\ooVoo\oovoo.exe [37904960 2013-04-02] (ooVoo LLC)
HKU\S-1-5-21-2789968882-3570388344-1764720213-1001\...\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-2789968882-3570388344-1764720213-1001\...\MountPoints2: {9581de0b-ea57-11e1-a685-806e6f6e6963} - G:\setup.exe -a
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk
ShortcutTarget: Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk -> C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine64\20.5.0.28\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine64\20.5.0.28\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine64\20.5.0.28\buShell.dll (Symantec Corporation)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/CQNOT/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/CQNOT/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/CQNOT/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/CQNOT/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/CQNOT/1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...w={searchTerms}
SearchScopes: HKLM - {E59F3F0D-2F9A-41DB-BB93-898062EAD357} URL = http://www.amazon.co...s={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...w={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://mysearch.avg.com/search?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=17.0.1.12&pid=safeguard&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...w={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: AVG SafeGuard toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG SafeGuard toolbar\18.1.9.799\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
BHO-x32: GreatArcadeHits Add-on -> {D0C21091-FF8E-432C-9006-0540E81BA9D7} -> C:\Users\Sarah\AppData\Local\GreatArcadeHits\GreatArcadeHitsIE.dll (GreatArcadeHits)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\18.1.9.799\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 
FireFox:
========
FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default
FF DefaultSearchEngine: AVG Secure Search
FF SelectedSearchEngine: AVG Secure Search
FF Homepage: hxxp://mysearch.avg.com?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=&v=18.1.7.598&pid=safeguard&sg=0&sap=hp
FF Keyword.URL: user_pref("keyword.URL", "");
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Sarah\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Sarah\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF SearchPlugin: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn [2014-09-12]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn [2013-04-02]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\18.1.9.799
FF Extension: AVG SafeGuard toolbar - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\18.1.9.799 [2014-09-12]
FF HKCU\...\Firefox\Extensions: [{B21F5E31-B8E8-41CD-B74C-168A71A10E49}] - C:\Users\Sarah\AppData\Local\GreatArcadeHits\gahff.xpi
FF Extension: GreatArcadeHits Add-on - C:\Users\Sarah\AppData\Local\GreatArcadeHits\gahff.xpi [2013-08-14]
FF Extension: No Name - C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\extensions\[email protected] [Not Found]
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://mysearch.avg.com?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=18.1.7.598&pid=safeguard&sg=0&sap=hp
CHR StartupUrls: Default -> "hxxp://mysearch.avg.com?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=18.1.7.598&pid=safeguard&sg=0&sap=hp"
CHR DefaultSearchKeyword: Default -> mysearch.avg.com
CHR DefaultSearchProvider: Default -> AVG Secure Search
CHR DefaultSearchURL: Default -> http://mysearch.avg.com/search?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=17.0.0.12&pid=safeguard&sg=0&sap=dsp&q={searchTerms}
CHR DefaultSuggestURL: Default -> http://toolbar.avg.c...earchTerms}&o=1
CHR Profile: C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-15]
CHR Extension: (Google Drive) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-15]
CHR Extension: (Norton Security Toolbar) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\bejnhdlplbjhffionohbdnpcbobfejcc [2014-06-27]
CHR Extension: (YouTube) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-25]
CHR Extension: (Google Search) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-25]
CHR Extension: (Skype Click to Call) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-02-18]
CHR Extension: (Google Wallet) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-18]
CHR Extension: (GreatArcadeHits) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh [2013-10-19]
CHR Extension: (Gmail) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-25]
CHR HKLM-x32\...\Chrome\Extension: [bejnhdlplbjhffionohbdnpcbobfejcc] - C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\Exts\Chrome.crx [2014-05-31]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-01-17]
CHR StartMenuInternet: Google Chrome - C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-06-17] (Advanced Micro Devices, Inc.) [File not signed]
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-27] (Realsil Microelectronics Inc.) [File not signed]
R2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 Update Whilokii; C:\Program Files (x86)\Whilokii\updateWhilokii.exe [323352 2014-09-12] ()
R2 Util Whilokii; C:\Program Files (x86)\Whilokii\bin\utilWhilokii.exe [323352 2014-09-12] ()
R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-09-12] (AVG Secure Search)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-09-12] (AVG Technologies)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130924.001\BHDrvx64.sys [1525848 2013-09-24] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1405000.01C\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130927.002\IDSvia64.sys [520280 2013-08-25] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130927.018\ENG64.SYS [126040 2013-09-02] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130927.018\EX64.SYS [2099288 2013-09-02] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\1405000.01C\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1405000.01C\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1405000.01C\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1405000.01C\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-07-17] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1405000.01C\Ironx64.SYS [224416 2012-07-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1405000.01C\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
R1 {fed5e6b2-4fc4-43ba-8e95-001d959d8008}w64; C:\Windows\System32\drivers\{fed5e6b2-4fc4-43ba-8e95-001d959d8008}w64.sys [61112 2014-06-09] (StdLib)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-09-12 11:32 - 2014-09-12 11:33 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64 (2).exe
2014-09-12 10:44 - 2014-09-12 11:36 - 00026524 _____ () C:\Users\Sarah\Downloads\FRST.txt
2014-09-12 10:43 - 2014-09-12 11:34 - 00000000 ____D () C:\FRST
2014-09-12 10:42 - 2014-09-12 10:42 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64.exe
2014-09-12 10:42 - 2014-09-12 10:42 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64 (1).exe
2014-09-12 10:41 - 2014-09-12 10:41 - 01097728 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2014-09-12 10:39 - 2014-09-12 10:39 - 00003304 _____ () C:\Windows\System32\Tasks\PCHB_WaitAndStartAfter
2014-09-12 10:38 - 2014-09-12 10:38 - 00001078 _____ () C:\Users\Public\Desktop\PC HealthBoost.lnk
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HealthBoost
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\ProgramData\BoostSoftware
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\Program Files (x86)\PC HealthBoost
2014-09-12 10:35 - 2014-09-12 10:36 - 03079136 _____ (BoostSoftware Inc. ) C:\Users\Sarah\Downloads\PCHealthBoost-Setup.exe
2014-09-12 09:51 - 2014-09-12 09:51 - 00003480 ____N () C:\bootsqm.dat
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 __SHD () C:\found.000
2014-09-12 09:07 - 2014-05-14 12:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-12 09:07 - 2014-05-14 12:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-12 09:07 - 2014-05-14 12:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-12 09:07 - 2014-05-14 12:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-12 09:02 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-12 09:02 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-12 09:02 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-12 09:02 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-09-12 08:48 - 2014-09-12 08:48 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-09-12 11:37 - 2011-12-25 13:37 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9603BC86-A81E-4F00-97E9-24E3BAAE7AF6}
2014-09-12 11:36 - 2014-09-12 10:44 - 00026524 _____ () C:\Users\Sarah\Downloads\FRST.txt
2014-09-12 11:35 - 2011-08-21 10:06 - 00430807 _____ () C:\Windows\WindowsUpdate.log
2014-09-12 11:34 - 2014-09-12 10:43 - 00000000 ____D () C:\FRST
2014-09-12 11:33 - 2014-09-12 11:32 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64 (2).exe
2014-09-12 11:24 - 2013-10-19 10:24 - 00000292 _____ () C:\Windows\Tasks\DigitalSite.job
2014-09-12 11:12 - 2011-12-25 13:53 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001UA.job
2014-09-12 10:51 - 2009-07-14 00:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-12 10:51 - 2009-07-14 00:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-12 10:42 - 2014-09-12 10:42 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64.exe
2014-09-12 10:42 - 2014-09-12 10:42 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64 (1).exe
2014-09-12 10:41 - 2014-09-12 10:41 - 01097728 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2014-09-12 10:39 - 2014-09-12 10:39 - 00003304 _____ () C:\Windows\System32\Tasks\PCHB_WaitAndStartAfter
2014-09-12 10:38 - 2014-09-12 10:38 - 00001078 _____ () C:\Users\Public\Desktop\PC HealthBoost.lnk
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HealthBoost
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\ProgramData\BoostSoftware
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\Program Files (x86)\PC HealthBoost
2014-09-12 10:36 - 2014-09-12 10:35 - 03079136 _____ (BoostSoftware Inc. ) C:\Users\Sarah\Downloads\PCHealthBoost-Setup.exe
2014-09-12 10:12 - 2011-12-25 13:53 - 00000856 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001Core.job
2014-09-12 10:07 - 2011-12-25 13:53 - 00003878 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001UA
2014-09-12 10:07 - 2011-12-25 13:53 - 00003482 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001Core
2014-09-12 10:01 - 2009-07-14 01:13 - 00006426 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-12 09:55 - 2009-07-13 22:34 - 00000505 _____ () C:\Windows\win.ini
2014-09-12 09:53 - 2012-01-04 23:37 - 00000000 ____D () C:\ProgramData\Kodak
2014-09-12 09:52 - 2013-10-19 10:24 - 00000000 ____D () C:\Program Files (x86)\Whilokii
2014-09-12 09:52 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-12 09:52 - 2009-07-14 00:51 - 00081625 _____ () C:\Windows\setupact.log
2014-09-12 09:51 - 2014-09-12 09:51 - 00003480 ____N () C:\bootsqm.dat
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 __SHD () C:\found.000
2014-09-12 09:18 - 2014-06-30 00:38 - 00000000 ____D () C:\da7b97d4a0d433610240e4
2014-09-12 08:56 - 2013-10-19 10:25 - 00000276 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-09-12 08:52 - 2013-10-19 10:26 - 00000000 ____D () C:\Program Files (x86)\AVG SafeGuard toolbar
2014-09-12 08:48 - 2014-09-12 08:48 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-09-12 08:46 - 2013-08-02 16:32 - 00000000 ____D () C:\Users\Sarah\AppData\Roaming\HpUpdate
2014-09-12 08:45 - 2013-10-26 20:23 - 00001350 _____ () C:\Users\Sarah\Desktop\Clean Registry for Free!.lnk
2014-09-12 08:45 - 2013-10-19 10:25 - 00000272 _____ () C:\Windows\Tasks\GreatArcadeHits.job
2014-09-12 08:43 - 2013-10-19 11:24 - 00000143 _____ () C:\Users\Sarah\AppData\Roaming\WB.CFG
2014-09-12 08:42 - 2013-10-19 10:27 - 00050976 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-01-13 19:42
 
==================== End Of Log ============================

  • 0

#4
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-09-2014
Ran by Sarah at 2014-09-12 11:38:16
Running from C:\Users\Sarah\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Norton Security Suite (Disabled - Out of date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton Security Suite (Disabled - Out of date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton Security Suite (Disabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.1.0.4880 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.6 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.0.6 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.3.181.14 - Adobe Systems Incorporated)
Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
aioprnt (Version: 5.3.1.0 - Eastman Kodak Company) Hidden
aioscnnr (x32 Version: 6.2.3.10 - Your Company Name) Hidden
aioscnnr (x32 Version: 7.3.4.0 - Your Company Name) Hidden
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Fuel (Version: 2011.0616.2209.37946 - AMD) Hidden
AMD Media Foundation Decoders (Version: 1.0.60616.2211 - ATI Technologies Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0616.2209.37946 - ATI) Hidden
Apple Application Support (HKLM-x32\...\{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}) (Version: 2.3.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{72927D2A-ADEF-786D-91E3-06CEFD60D107}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
AVG SafeGuard toolbar (HKLM-x32\...\AVG SafeGuard toolbar) (Version: 18.1.9.799 - AVG Technologies)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Blio (HKLM-x32\...\{9368DDD5-CE7F-4BD7-A83A-F00FABE338EC}) (Version: 2.2.6699 - K-NFB Reading Technology, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0616.2209.37946 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0616.2209.37946 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0616.2209.37946 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help English (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help French (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help German (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0616.2208.37946 - ATI) Hidden
ccc-utility64 (Version: 2011.0616.2209.37946 - ATI) Hidden
center (x32 Version: 6.2.5.0 - Eastman Kodak Company) Hidden
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
Coupon Printer for Windows (HKLM-x32\...\Coupon Printer for Windows5.0.0.3) (Version: 5.0.0.3 - Coupons.com Incorporated)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.1.4119 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
essentials (x32 Version: 6.0.14.0 - Eastman Kodak Company) Hidden
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
File Type Assistant (HKLM-x32\...\Trusted Software Assistant_is1) (Version: 2012.11.9.0 - ) <==== ATTENTION
Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.146 - Google Inc.)
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
GreatArcadeHits (HKCU\...\{856AD396-519D-4C7A-BED6-6785F64924BC}) (Version: 1.0 - GreatArcadeHits) <==== ATTENTION
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Deskjet 3510 series Basic Device Software (HKLM\...\{7F20F2D1-C425-4432-96BA-EBD0C2181493}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Deskjet 3510 series Help (HKLM-x32\...\{97C1C98D-6AE5-4C71-9B00-EBBD9E014450}) (Version: 28.0.0 - Hewlett Packard)
HP Deskjet 3510 series Product Improvement Study (HKLM\...\{791D3241-C6A4-417F-82E6-00543B6E5012}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Documentation (HKLM-x32\...\{68A55875-B6DD-41E8-8CF6-F193D9C47051}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{5A847522-375C-4D05-BD3D-88C450CC047F}) (Version: 1.1.5 - Hewlett-Packard Company)
HP MovieStore (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.0 - Hewlett-Packard Company)
HP MovieStore (x32 Version: 1.0.057 - Hewlett-Packard) Hidden
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Power Manager (HKLM-x32\...\{E44578C7-4667-4124-8BC2-1161BCA54978}) (Version: 1.4.4 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{8B52057C-15DB-433E-957C-E279BC7D07E3}) (Version: 3.1.0.9742 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{28FE073B-1230-4BF6-830C-7434FD0C0069}) (Version: 4.1.13.1 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
iTunes (HKLM\...\{0225AD21-F3E2-4916-BFF3-65D3F9052582}) (Version: 11.0.2.26 - Apple Inc.)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kodak AIO Printer (Version: 7.0.3.0 - Eastman Kodak Company) Hidden
KODAK AiO Software (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.6.12.20 - Eastman Kodak Company)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Expression Encoder 4 (HKLM-x32\...\Encoder_4.0.3205.0) (Version: 4.0.3205.0 - Microsoft Corporation)
Microsoft Expression Encoder 4 (x32 Version: 4.0.3205.0 - Microsoft Corporation) Hidden
Microsoft Expression Encoder 4 Screen Capture Codec (HKLM-x32\...\{F9EC30D1-F688-4708-9850-CB5120074AAA}) (Version: 4.0.3205.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 - English (HKLM-x32\...\{90140011-0061-0409-0000-0000000FF1CE}) (Version: 14.0.6114.5002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 1.0.0.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\...\{172423F9-522A-483A-AD65-03600CE4CA4F}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.) Hidden
Mozilla Firefox 24.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 24.0 (x86 en-US)) (Version: 24.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - MyPC Backup) <==== ATTENTION
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Norton Security Suite (HKLM-x32\...\N360) (Version: 20.5.0.28 - Symantec Corporation)
ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden
ooVoo (HKLM-x32\...\{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}) (Version: 3.5.7046 - ooVoo LLC.)
Open It! (HKLM-x32\...\OpenIt Open It!) (Version: 1.1.1 - OpenIt)
OpenOffice.org 3.1 (HKLM-x32\...\{E6B87DC4-2B3D-4483-ADFF-E483BF718991}) (Version: 3.1.9399 - OpenOffice.org)
[email protected] (HKLM-x32\...\{CF594DB8-CFB0-45B4-86DA-8BB4AC0941F8}) (Version: 3.0.7.0 - Valassis)
PC HealthBoost 3.0.5 (HKLM-x32\...\PCHealthBoost_is1) (Version: 3.0.5 - Boost Software Inc.)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
PreReq (x32 Version: 6.2.3.0 - Eastman Kodak Company) Hidden
PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.)
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 3.02.07.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6287 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
RegClean Pro (HKLM-x32\...\RegClean Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION
RoxioNow Player (HKLM-x32\...\{0EDEB615-1A60-425E-8306-0E10519C7B55}) (Version: 1.9.5.103 - RoxioNow)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Slingo Supreme (x32 Version: 2.2.0.97 - WildTangent) Hidden
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Zip Extractor (HKCU\...\DigitalSite) (Version:  - ) <==== ATTENTION
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
Virtual Villagers 5 - New Believers (x32 Version: 2.2.0.97 - WildTangent) Hidden
Whilokii 1.0.0 (HKLM\...\Whilokii) (Version: 1.0.0 - Whilokii) <==== ATTENTION
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Zip Extractor Packages (HKCU\...\Zip Extractor Packages) (Version:  - ) <==== ATTENTION
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
CustomCLSID: HKU\S-1-5-21-2789968882-3570388344-1764720213-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Sarah\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2789968882-3570388344-1764720213-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Sarah\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2789968882-3570388344-1764720213-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Sarah\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
 
==================== Restore Points  =========================
 
19-10-2013 07:00:22 Windows Update
20-10-2013 07:00:26 Windows Update
24-10-2013 17:33:40 Installed Java 7 Update 45
25-10-2013 07:02:26 Windows Update
08-01-2014 01:02:57 Windows Update
08-01-2014 15:59:32 Windows Update
09-03-2014 14:08:36 Windows Update
31-05-2014 19:49:19 Windows Update
31-05-2014 19:54:57 Installed Java 7 Update 60
12-09-2014 12:54:06 Windows Update
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 22:34 - 2013-10-15 11:16 - 00000098 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1       localhost
 
==================== Scheduled Tasks (whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
Task: {23C99716-438E-483F-BB05-277C3A9BF959} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {34C50D24-EA8F-4286-9788-4637B82CB11F} - System32\Tasks\Norton Security Suite\Norton Error Analyzer => C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\SymErr.exe [2013-06-03] (Symantec Corporation)
Task: {5882B356-E4D2-4A0E-AF40-110DD9C7817C} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\WSCStub.exe [2014-04-29] (Symantec Corporation)
Task: {5E601138-2C69-46BB-BB66-A45744F6450A} - System32\Tasks\HPCustParticipation HP Deskjet 3510 series => C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {5EF799C5-E02C-4E8C-95B3-99C79A9F14B2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001Core => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-25] (Google Inc.)
Task: {8457E2CE-A566-42CD-B1E7-B1E78D299566} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) <==== ATTENTION
Task: {91B6E374-DDC0-4DEF-80C0-D784F26CEE72} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) <==== ATTENTION
Task: {91DE14E4-BF4D-45F6-B36B-D3DC51F58C26} - System32\Tasks\Norton Security Suite\Norton Error Processor => C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\SymErr.exe [2013-06-03] (Symantec Corporation)
Task: {96BF8A59-FA09-4DE7-997B-0076E665918B} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {9E857B23-8BF9-4634-A56C-AE82C4D5D29D} - System32\Tasks\ProgramUpdateCheck => C:\Program Files (x86)\File Type Assistant\TSAssist.exe [2012-11-09] (Trusted Software ApS) <==== ATTENTION
Task: {A8197B8C-C993-4FC7-8667-553022A1D991} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) <==== ATTENTION
Task: {C2A83697-7519-402A-80BD-BED9DF09BE05} - System32\Tasks\PCHB_WaitAndStartAfter => \PCHealthBoost.exe
Task: {E85A7901-16E7-44DE-AB8F-F0B49C0B0151} - System32\Tasks\GreatArcadeHits => C:\Users\Sarah\AppData\Local\GreatArcadeHits\GAHUpdate.exe [2013-08-14] () <==== ATTENTION
Task: {E955B2F0-FEB9-4998-9B09-F68CC7F24D4C} - System32\Tasks\0414cUpdateInfo => C:\ProgramData\Avg_Update_0414c\0414c_{3483784A-BBF1-40C0-811B-73E239A6D24F}.exe [2014-05-31] ()
Task: {EB124D1E-3B79-45E6-B479-04894E72DB69} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001UA => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-25] (Google Inc.)
Task: {F930284D-7017-47D9-9C53-BA93ECDFB061} - System32\Tasks\DigitalSite => C:\Users\Sarah\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {FE92BB01-FDDA-4DC4-BA8A-30B4D227F1A0} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files (x86)\File Type Assistant\tsasetup.exe [2012-11-09] (                                                            ) <==== ATTENTION
Task: C:\Windows\Tasks\0414cUpdateInfo.job => C:\ProgramData\Avg_Update_0414c\0414c_{3483784A-BBF1-40C0-811B-73E239A6D24F}.exe
Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\Sarah\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001Core.job => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001UA.job => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GreatArcadeHits.job => C:\Users\Sarah\AppData\Local\GreatArcadeHits\GAHUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
 
==================== Loaded Modules (whitelisted) =============
 
2011-06-17 01:20 - 2011-06-17 01:20 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-10-04 21:05 - 2014-09-12 08:44 - 00323352 _____ () C:\Program Files (x86)\Whilokii\updateWhilokii.exe
2013-10-20 17:26 - 2014-09-12 08:48 - 00323352 _____ () C:\Program Files (x86)\Whilokii\bin\utilWhilokii.exe
2014-09-12 08:58 - 2014-09-12 08:42 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
2011-12-19 23:34 - 2011-12-19 23:34 - 00108880 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2013-09-19 18:37 - 2013-09-19 18:37 - 00012288 _____ () C:\Program Files (x86)\MyPC Backup\GetText.dll
2013-09-19 18:32 - 2013-09-19 18:32 - 01102336 _____ () C:\Program Files (x86)\MyPC Backup\x64\System.Data.SQLite.dll
2013-10-19 10:26 - 2014-09-12 08:42 - 02640408 _____ () C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe
2014-09-12 09:55 - 2014-09-05 14:57 - 00287000 _____ () C:\Program Files (x86)\Whilokii\bin\Whilokii.PurBrowse64.exe
2014-06-27 11:33 - 2014-09-11 19:47 - 00098584 _____ () C:\Program Files (x86)\Whilokii\bin\Whilokii.BrowserAdapter.exe
2014-09-12 08:42 - 2014-09-11 19:47 - 00114968 _____ () C:\Program Files (x86)\Whilokii\bin\Whilokii.BrowserAdapter64.exe
2011-06-17 01:20 - 2011-06-17 01:20 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-06-17 01:08 - 2011-06-17 01:08 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 16:42 - 2011-06-17 16:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-01-28 13:08 - 2013-01-28 13:08 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-01-28 13:08 - 2013-01-28 13:08 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-12 08:58 - 2014-09-12 08:42 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\log4cplusU.dll
2014-05-31 16:04 - 2012-05-30 10:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON SECURITY SUITE\ENGINE\20.5.0.28\wincfi39.dll
2009-04-16 14:02 - 2009-04-16 14:02 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2014-03-09 10:51 - 2014-03-01 22:35 - 00051016 _____ () C:\Users\Sarah\AppData\Local\Google\Chrome\Application\33.0.1750.146\chrome_elf.dll
2014-09-12 08:42 - 2014-09-11 19:47 - 00195352 _____ () C:\Program Files (x86)\Whilokii\bin\fed5e6b24fc443ba8e95.dll
2014-03-09 10:51 - 2014-03-01 22:35 - 00716616 _____ () C:\Users\Sarah\AppData\Local\Google\Chrome\Application\33.0.1750.146\libglesv2.dll
2014-03-09 10:51 - 2014-03-01 22:35 - 00100168 _____ () C:\Users\Sarah\AppData\Local\Google\Chrome\Application\33.0.1750.146\libegl.dll
2014-03-09 10:51 - 2014-03-01 22:35 - 04061000 _____ () C:\Users\Sarah\AppData\Local\Google\Chrome\Application\33.0.1750.146\pdf.dll
2014-03-09 10:52 - 2014-03-01 22:35 - 00394568 _____ () C:\Users\Sarah\AppData\Local\Google\Chrome\Application\33.0.1750.146\ppGoogleNaClPluginChrome.dll
2014-03-09 10:51 - 2014-03-01 22:35 - 01647432 _____ () C:\Users\Sarah\AppData\Local\Google\Chrome\Application\33.0.1750.146\ffmpegsumo.dll
2014-03-09 10:52 - 2014-03-01 22:35 - 13632840 _____ () C:\Users\Sarah\AppData\Local\Google\Chrome\Application\33.0.1750.146\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 
==================== Safe Mode (whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (whitelisted) =============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== MSCONFIG/TASK MANAGER disabled items =========
 
(Currently there is no automatic fix for this section.)
 
 
==================== Faulty Device Manager Devices =============
 
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (09/12/2014 11:15:39 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64 (1).exe version 10.9.2014.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: 1094
 
Start Time: 01cfce97e3af9b3f
 
Termination Time: 60000
 
Application Path: C:\Users\Sarah\Downloads\FRST64 (1).exe
 
Report Id: 42b806fd-3a8f-11e4-ac53-441ea1c678e2
 
Error: (09/12/2014 10:29:46 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
Error: invalid descriptor, filepath = C:\ProgramData\VirtualizedApplications\Patch_ready\{90140011-0061-0409-0000-0000000FF1CE}\descriptor.xml Type: 45::InvalidMetadataFile.
 
Error: (09/12/2014 10:29:46 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
Error: XML document load failed for file: C:\ProgramData\VirtualizedApplications\Patch_ready\{90140011-0061-0409-0000-0000000FF1CE}\descriptor.xml HResult: 0x1. OException caught while loading the descriptor xml
 
Error: (09/12/2014 10:29:19 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
The action cannot be completed. Try the action again. If the problem continues, contact Microsoft Product Support.
 
Error: (09/12/2014 10:29:15 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
Error: XML document load failed for file: C:\ProgramData\VirtualizedApplications\Patch_ready\{90140011-0061-0409-0000-0000000FF1CE}\descriptor.xml HResult: 0x1. OException caught while loading the descriptor xml
 
Error: (09/12/2014 10:01:42 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.
 
Error: (09/12/2014 10:01:42 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.
 
Error: (09/12/2014 09:54:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/12/2014 09:53:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   16 24.1.168.192.in-addr.arpa. PTR Sarah-HP.local.
 
Error: (09/12/2014 09:53:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.1.24:5353   18 24.1.168.192.in-addr.arpa. PTR Sarah-HP-2.local.
 
 
System errors:
=============
Error: (09/12/2014 10:03:39 AM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer HOME-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6C4E4336-ADC9-44E9-B695-60D3071EA01D}.
The master browser is stopping or an election is being forced.
 
Error: (09/12/2014 09:58:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Assistant Service service failed to start due to the following error: 
%%2
 
Error: (09/12/2014 09:53:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Computer Backup (MyPC Backup) service failed to start due to the following error: 
%%1053
 
Error: (09/12/2014 09:53:29 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Computer Backup (MyPC Backup) service to connect.
 
Error: (09/12/2014 09:52:49 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:39:28 AM on ‎9/‎12/‎2014 was unexpected.
 
Error: (09/12/2014 09:38:24 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 4.5.1 for Windows 7 x64-based Systems (KB2858725).
 
Error: (09/12/2014 09:38:11 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
 
Error: (09/12/2014 08:51:41 AM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer HOME-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6C4E4336-ADC9-44E9-B695-60D3071EA01D}.
The master browser is stopping or an election is being forced.
 
Error: (09/12/2014 08:46:47 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume C:.
 
Error: (09/12/2014 08:46:46 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume \Device\HarddiskVolume2.
 
 
Microsoft Office Sessions:
=========================
Error: (09/12/2014 11:15:39 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64 (1).exe10.9.2014.0109401cfce97e3af9b3f60000C:\Users\Sarah\Downloads\FRST64 (1).exe42b806fd-3a8f-11e4-ac53-441ea1c678e2
 
Error: (09/12/2014 10:29:46 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Error: invalid descriptor, filepath = C:\ProgramData\VirtualizedApplications\Patch_ready\{90140011-0061-0409-0000-0000000FF1CE}\descriptor.xml Type: 45::InvalidMetadataFile.
 
Error: (09/12/2014 10:29:46 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Error: XML document load failed for file: C:\ProgramData\VirtualizedApplications\Patch_ready\{90140011-0061-0409-0000-0000000FF1CE}\descriptor.xml HResult: 0x1. OException caught while loading the descriptor xml
 
Error: (09/12/2014 10:29:19 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: The action cannot be completed. Try the action again. If the problem continues, contact Microsoft Product Support.
 
Error: (09/12/2014 10:29:15 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Error: XML document load failed for file: C:\ProgramData\VirtualizedApplications\Patch_ready\{90140011-0061-0409-0000-0000000FF1CE}\descriptor.xml HResult: 0x1. OException caught while loading the descriptor xml
 
Error: (09/12/2014 10:01:42 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F20300004D070000
 
Error: (09/12/2014 10:01:42 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance1637070000000000000000000009030000
 
Error: (09/12/2014 09:54:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/12/2014 09:53:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   16 24.1.168.192.in-addr.arpa. PTR Sarah-HP.local.
 
Error: (09/12/2014 09:53:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.1.24:5353   18 24.1.168.192.in-addr.arpa. PTR Sarah-HP-2.local.
 
 
==================== Memory info =========================== 
 
Processor: AMD C-50 Processor
Percentage of memory in use: 88%
Total physical RAM: 1642.91 MB
Available physical RAM: 196.83 MB
Total Pagefile: 3397.81 MB
Available Pagefile: 1052.38 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:214.16 GB) (Free:154.63 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:14.56 GB) (Free:1.62 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 16CC72E1)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=214.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
 
==================== End Of Log ============================

  • 0

#5
23red

23red

    Trusted Helper

  • Malware Removal
  • 1,797 posts

Hi busymomof4kids :)

 

Thank you for the logs, I'm about finished going through them and preparing a fix for you.  If you click on the Follow this Topic button at the top of this page, you'll be notified by email when a post is made for you here. 

I'm going quick as I can!  Thank you for your patience, it shouldn't be too much longer ;)


  • 0

#6
23red

23red

    Trusted Helper

  • Malware Removal
  • 1,797 posts

Hi Tracy :)

 

Welcome!

 

Thank you again for the logs :)

There is a bit of junk on the computer that would actually cause the described symptoms ;)

 

Norton Security Suite is outdated and off, Windows Defender is not enabled.  Therefor you have no enabled protection.

Best to keep surfing on the internet to a minimum until you're protected.

 

When you return, please let me know if you'd like to keep Norton Security Suite or use Windows Defender and Windows Firewall, either of which are fine for Windows 7.
We'll get that properly set up then.

Also, we'll do some work on Chrome to clean it out.

 

 

In the mean time, let's clean up!

Before we get started, FRST needs to be on the Desktop.

 
It is currently located at C:\Users\Sarah\Downloads
Please cut and paste it onto the Desktop <~ Very important! 
It needs to be there for the fix to work correctly.

 

 

Please let me know how it runs after these steps:

 

 

Step 1
Uninstalls

 
Please go to Start ~> Control Panel ~> Programs and Features uninstall each of the following if found:

 

AVG SafeGuard toolbar
Coupon Printer for Windows
File Type Assistant
GreatArcadeHits
Java 7 Update 45
MyPC Backup
RegClean Pro
Update for Zip Extractor
Whilokii 1.0.0
Zip Extractor Packages

 

 

Step 2
FRST Fix

 

Download attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

 

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

 

Run FRST/FRST64 and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Attached File  fixlist.txt   8.18KB   165 downloads

 

 

Step 3
ADWCleaner

 

1.  Please download AdwCleaner from this link to your Desktop.

 

To Download to the Desktop do the following:

 

When the Download window pops up on the bottom of your screen first click the arrow button

 

saveastrianglearrow.jpg

 

Then click Save As

 savesaveasvistaup.jpg

 

Then choose Desktop from the left side panel.

 

 savetodesktopvistaup.jpg

 

This will set ADWCleaner to your Desktop.

 

•  If it happens to save to another location, right click the ADWCleaner icon and select Cut then right click on Desktop and select Paste.

 

2.  Right click adwcleanericon.jpg on your Desktop, choose Run as Administrator.

 

3.  Accept UAC prompt.

 

4.  Accept AdwCleaner's Terms of Use.  And the AdwCleaner window opens:

 

newAdwCleanerwindow.jpg

 

5.  Click on the newAdwCleanerScanbutton.jpg <~ Scan button and wait for the scan to finish.

 

6.  After the Scan has finished the window may or may not show what it found and above the progress bar you will see Pending..... Please uncheck elements you don't want to remove. Please check to be sure no good items accidentally got picked up.

 

7.  Once that is complete, click the acwcleanerCleanbutton.jpg <~ Clean button

 

8.  Once it has finished Cleaning, click the newadwcleanerreportbutton.jpg <~ Report button to get the log.

 

9.  Copy and Paste it into your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[R0].txt.

 

 

Step 4
Fresh FRST Log

 

  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

     

  • Press Scan button.

     

  • It will produce a log called FRST.txt in the same directory the tool is run from.

     

  • Please copy and paste log back here.

Step 5
Post!

When you return, please post:

1. FRST fix log
2. ADWCleaner.txt
3. Fresh FRST log

4. Let me know how the computer running is now

 

Thank you :)

 

 

 

 


  • 0

#7
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts

FIXLOG

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-09-2014
Ran by Sarah at 2014-09-15 15:12:07 Run:1
Running from C:\Users\Sarah\Desktop
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
Start:
() C:\Program Files (x86)\Whilokii\updateWhilokii.exe
() C:\Program Files (x86)\Whilokii\bin\utilWhilokii.exe
C:\Program Files (x86)\Whilokii
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe
C:\Program Files (x86)\Common Files\AVG Secure Search
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
C:\Program Files (x86)\Common Files\AVG Secure Search
(MyPCBackup.com) C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
C:\Program Files (x86)\MyPC Backup
() C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe
C:\Program Files (x86)\AVG SafeGuard toolbar
(Google Inc.) C:\Users\Sarah\AppData\Local\Temp\GoogleUpdateSetup.exe5aa832
C:\Users\Sarah\AppData\Local\Temp\GoogleUpdateSetup.exe5aa832
(Google Inc.) C:\Users\Sarah\AppData\Local\Temp\GUM3716.tmp\GoogleUpdate.exe
C:\Users\Sarah\AppData\Local\Temp\GUM3716.tmp
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
C:\Program Files (x86)\Mobogenie
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe [2640408 2014-09-12] ()
HKU\S-1-5-21-2789968882-3570388344-1764720213-1001\...\MountPoints2: {9581de0b-ea57-11e1-a685-806e6f6e6963} - G:\setup.exe -a
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...w={searchTerms}
SearchScopes: HKLM - {E59F3F0D-2F9A-41DB-BB93-898062EAD357} URL = http://www.amazon.co...s={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...w={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://mysearch.avg.com/search?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=17.0.1.12&pid=safeguard&sg=0&sap=dsp&q={searchTerms} 
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...w={searchTerms}
BHO-x32: AVG SafeGuard toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG SafeGuard toolbar\18.1.9.799\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
Toolbar: HKLM-x32 - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\18.1.9.799\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
FF DefaultSearchEngine: AVG Secure Search
FF SelectedSearchEngine: AVG Secure Search
FF Homepage: hxxp://mysearch.avg.com?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=&v=18.1.7.598&pid=safeguard&sg=0&sap=hp
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File
FF SearchPlugin: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\searchplugins\safeguard-secure-search.xml
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\18.1.9.799
FF Extension: AVG SafeGuard toolbar - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\18.1.9.799 [2014-09-12]
FF Extension: No Name - C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\extensions\[email protected] [Not Found]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
R2 Update Whilokii; C:\Program Files (x86)\Whilokii\updateWhilokii.exe [323352 2014-09-12] ()
R2 Util Whilokii; C:\Program Files (x86)\Whilokii\bin\utilWhilokii.exe [323352 2014-09-12] ()
R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-09-12] (AVG Secure Search)
R1 {fed5e6b2-4fc4-43ba-8e95-001d959d8008}w64; C:\Windows\System32\drivers\{fed5e6b2-4fc4-43ba-8e95-001d959d8008}w64.sys [61112 2014-06-09] (StdLib)
C:\Windows\System32\drivers\{fed5e6b2-4fc4-43ba-8e95-001d959d8008}w64.sys
2014-09-12 08:48 - 2014-09-12 08:48 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-09-12 11:35 - 2011-08-21 10:06 - 00430807 _____ () C:\Windows\WindowsUpdate.log
2014-09-12 11:37 - 2011-12-25 13:37 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9603BC86-A81E-4F00-97E9-24E3BAAE7AF6}
2014-09-12 11:24 - 2013-10-19 10:24 - 00000292 _____ () C:\Windows\Tasks\DigitalSite.job
2014-09-12 09:52 - 2013-10-19 10:24 - 00000000 ____D () C:\Program Files (x86)\Whilokii
2014-09-12 09:18 - 2014-06-30 00:38 - 00000000 ____D () C:\da7b97d4a0d433610240e4
2014-09-12 08:56 - 2013-10-19 10:25 - 00000276 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-09-12 08:52 - 2013-10-19 10:26 - 00000000 ____D () C:\Program Files (x86)\AVG SafeGuard toolbar
2014-09-12 08:48 - 2014-09-12 08:48 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-09-12 08:45 - 2013-10-26 20:23 - 00001350 _____ () C:\Users\Sarah\Desktop\Clean Registry for Free!.lnk
2014-09-12 08:42 - 2013-10-19 10:27 - 00050976 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
File Type Assistant (HKLM-x32\...\Trusted Software Assistant_is1) (Version: 2012.11.9.0 - ) <==== ATTENTION
GreatArcadeHits (HKCU\...\{856AD396-519D-4C7A-BED6-6785F64924BC}) (Version: 1.0 - GreatArcadeHits) <==== ATTENTION
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - MyPC Backup) <==== ATTENTION
RegClean Pro (HKLM-x32\...\RegClean Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION
Whilokii 1.0.0 (HKLM\...\Whilokii) (Version: 1.0.0 - Whilokii) <==== ATTENTION
Zip Extractor Packages (HKCU\...\Zip Extractor Packages) (Version:  - ) <==== ATTENTION
Task: {8457E2CE-A566-42CD-B1E7-B1E78D299566} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) <==== ATTENTION
Task: {91B6E374-DDC0-4DEF-80C0-D784F26CEE72} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) <==== ATTENTION
Task: {9E857B23-8BF9-4634-A56C-AE82C4D5D29D} - System32\Tasks\ProgramUpdateCheck => C:\Program Files (x86)\File Type Assistant\TSAssist.exe [2012-11-09] (Trusted Software ApS) <==== ATTENTION
Task: {A8197B8C-C993-4FC7-8667-553022A1D991} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) <==== ATTENTION
Task: {E85A7901-16E7-44DE-AB8F-F0B49C0B0151} - System32\Tasks\GreatArcadeHits => C:\Users\Sarah\AppData\Local\GreatArcadeHits\GAHUpdate.exe [2013-08-14] () <==== ATTENTION
Task: {E955B2F0-FEB9-4998-9B09-F68CC7F24D4C} - System32\Tasks\0414cUpdateInfo => C:\ProgramData\Avg_Update_0414c\0414c_{3483784A-BBF1-40C0-811B-73E239A6D24F}.exe [2014-05-31] ()
Task: {F930284D-7017-47D9-9C53-BA93ECDFB061} - System32\Tasks\DigitalSite => C:\Users\Sarah\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {FE92BB01-FDDA-4DC4-BA8A-30B4D227F1A0} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files (x86)\File Type Assistant\tsasetup.exe [2012-11-09] () <==== ATTENTION
Task: C:\Windows\Tasks\0414cUpdateInfo.job => C:\ProgramData\Avg_Update_0414c\0414c_{3483784A-BBF1-40C0-811B-73E239A6D24F}.exe
Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\Sarah\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GreatArcadeHits.job => C:\Users\Sarah\AppData\Local\GreatArcadeHits\GAHUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
emptytemp:
end
 
*****************
 
Start: => Error: No automatic fix found for this entry.
C:\Program Files (x86)\Whilokii\updateWhilokii.exe => No running process found
C:\Program Files (x86)\Whilokii\bin\utilWhilokii.exe => No running process found
"C:\Program Files (x86)\Whilokii" => File/Directory not found.
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe => No running process found
"C:\Program Files (x86)\Common Files\AVG Secure Search" => File/Directory not found.
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe => No running process found
"C:\Program Files (x86)\Common Files\AVG Secure Search" => File/Directory not found.
C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe => No running process found
C:\Program Files (x86)\MyPC Backup => Moved successfully.
C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe => No running process found
"C:\Program Files (x86)\AVG SafeGuard toolbar" => File/Directory not found.
C:\Users\Sarah\AppData\Local\Temp\GoogleUpdateSetup.exe5aa832 => No running process found
C:\Users\Sarah\AppData\Local\Temp\GoogleUpdateSetup.exe5aa832 => Moved successfully.
C:\Users\Sarah\AppData\Local\Temp\GUM3716.tmp\GoogleUpdate.exe => No running process found
"C:\Users\Sarah\AppData\Local\Temp\GUM3716.tmp" => File/Directory not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => value deleted successfully.
"C:\Program Files (x86)\Mobogenie" => File/Directory not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\vProt => Value not found.
"HKU\S-1-5-21-2789968882-3570388344-1764720213-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9581de0b-ea57-11e1-a685-806e6f6e6963}" => Key deleted successfully.
"HKCR\CLSID\{9581de0b-ea57-11e1-a685-806e6f6e6963}" => Key not found.
C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk not found.
C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => Key deleted successfully.
"HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E59F3F0D-2F9A-41DB-BB93-898062EAD357}" => Key deleted successfully.
"HKCR\CLSID\{E59F3F0D-2F9A-41DB-BB93-898062EAD357}" => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found.
"HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => Key deleted successfully.
"HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} => Value not found.
"HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found.
Firefox DefaultSearchEngine deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml => Moved successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin" => Key not found.
C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\searchplugins\safeguard-secure-search.xml => Moved successfully.
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\[email protected] => Value not found.
C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\18.1.9.799 not found.
C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\extensions\[email protected] not found.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
BackupStack => Service not found.
Update Whilokii => Service not found.
Util Whilokii => Service not found.
vToolbarUpdater18.1.9 => Service not found.
{fed5e6b2-4fc4-43ba-8e95-001d959d8008}w64 => Service stopped successfully.
{fed5e6b2-4fc4-43ba-8e95-001d959d8008}w64 => Service deleted successfully.
C:\Windows\System32\drivers\{fed5e6b2-4fc4-43ba-8e95-001d959d8008}w64.sys => Moved successfully.
"C:\Windows\System32\Tasks\RegClean Pro" => File/Directory not found.
Could not move "C:\Windows\WindowsUpdate.log" => Scheduled to move on reboot.
C:\Windows\System32\Tasks\User_Feed_Synchronization-{9603BC86-A81E-4F00-97E9-24E3BAAE7AF6} => Moved successfully.
C:\Windows\Tasks\DigitalSite.job => Moved successfully.
"C:\Program Files (x86)\Whilokii" => File/Directory not found.
C:\da7b97d4a0d433610240e4 => Moved successfully.
"C:\Windows\Tasks\RegClean Pro_DEFAULT.job" => File/Directory not found.
"C:\Program Files (x86)\AVG SafeGuard toolbar" => File/Directory not found.
"C:\Windows\System32\Tasks\RegClean Pro" => File/Directory not found.
"C:\Users\Sarah\Desktop\Clean Registry for Free!.lnk" => File/Directory not found.
"C:\Windows\system32\Drivers\avgtpx64.sys" => File/Directory not found.
File Type Assistant (HKLM-x32\...\Trusted Software Assistant_is1) (Version: 2012.11.9.0 - ) <==== ATTENTION => Error: No automatic fix found for this entry.
GreatArcadeHits (HKCU\...\{856AD396-519D-4C7A-BED6-6785F64924BC}) (Version: 1.0 - GreatArcadeHits) <==== ATTENTION => Error: No automatic fix found for this entry.
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - MyPC Backup) <==== ATTENTION => Error: No automatic fix found for this entry.
RegClean Pro (HKLM-x32\...\RegClean Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION => Error: No automatic fix found for this entry.
Whilokii 1.0.0 (HKLM\...\Whilokii) (Version: 1.0.0 - Whilokii) <==== ATTENTION => Error: No automatic fix found for this entry.
Zip Extractor Packages (HKCU\...\Zip Extractor Packages) (Version:  - ) <==== ATTENTION => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8457E2CE-A566-42CD-B1E7-B1E78D299566}" => Key not found.
C:\Windows\System32\Tasks\RegClean Pro_UPDATES not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_UPDATES" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{91B6E374-DDC0-4DEF-80C0-D784F26CEE72}" => Key not found.
C:\Windows\System32\Tasks\RegClean Pro_DEFAULT not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_DEFAULT" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9E857B23-8BF9-4634-A56C-AE82C4D5D29D}" => Key not found.
C:\Windows\System32\Tasks\ProgramUpdateCheck not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProgramUpdateCheck" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A8197B8C-C993-4FC7-8667-553022A1D991}" => Key not found.
C:\Windows\System32\Tasks\RegClean Pro not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E85A7901-16E7-44DE-AB8F-F0B49C0B0151}" => Key not found.
C:\Windows\System32\Tasks\GreatArcadeHits not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GreatArcadeHits" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E955B2F0-FEB9-4998-9B09-F68CC7F24D4C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E955B2F0-FEB9-4998-9B09-F68CC7F24D4C}" => Key deleted successfully.
C:\Windows\System32\Tasks\0414cUpdateInfo => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0414cUpdateInfo" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F930284D-7017-47D9-9C53-BA93ECDFB061}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F930284D-7017-47D9-9C53-BA93ECDFB061}" => Key deleted successfully.
C:\Windows\System32\Tasks\DigitalSite => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DigitalSite" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FE92BB01-FDDA-4DC4-BA8A-30B4D227F1A0}" => Key not found.
C:\Windows\System32\Tasks\ProgramRefresh-ATFST not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProgramRefresh-ATFST" => Key not found.
C:\Windows\Tasks\0414cUpdateInfo.job => Moved successfully.
C:\Windows\Tasks\DigitalSite.job not found.
C:\Windows\Tasks\GreatArcadeHits.job not found.
C:\Windows\Tasks\RegClean Pro_DEFAULT.job not found.
C:\Windows\Tasks\RegClean Pro_UPDATES.job not found.
EmptyTemp: => Removed 997.5 MB temporary data.
 
=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-09-15 15:23:11)<=
 
C:\Windows\WindowsUpdate.log => Is moved successfully.
 
==== End of Fixlog ====

  • 0

#8
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts

Here are the two of the logs.


Edited by busymomof4kids, 15 September 2014 - 01:59 PM.

  • 0

#9
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts

ADWCleaner log

 

# AdwCleaner v3.310 - Report created 15/09/2014 at 15:41:39
# Updated 12/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Sarah - SARAH-HP
# Running from : C:\Users\Sarah\Desktop\AdwCleaner (1).exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
Folder Deleted : C:\ProgramData\NCH Software
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\open it!
Folder Deleted : C:\Program Files (x86)\File Type Assistant
Folder Deleted : C:\Program Files (x86)\NCH Software
Folder Deleted : C:\Program Files (x86)\openit
Folder Deleted : C:\Users\Sarah\AppData\Local\AVG SafeGuard toolbar
Folder Deleted : C:\Users\Sarah\AppData\Local\GreatArcadeHits
Folder Deleted : C:\Users\Sarah\AppData\Local\Mobogenie
Folder Deleted : C:\Users\Sarah\AppData\Roaming\digitalsite
Folder Deleted : C:\Users\Sarah\AppData\Roaming\Systweak
Folder Deleted : C:\Users\Sarah\Documents\Mobogenie
File Deleted : C:\Users\Public\Desktop\Open It!.lnk
File Deleted : C:\Windows\System32\roboot64.exe
File Deleted : C:\Users\Sarah\daemonprocess.txt
File Deleted : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\user.js
File Deleted : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage
File Deleted : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_fastcontent.conduit.com_0.localstorage
File Deleted : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_lyrics.wikia.com_0.localstorage
File Deleted : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.boostsaves.com_0.localstorage
File Deleted : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.saltarsmart.biz_0.localstorage
File Deleted : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage
File Deleted : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Deleted : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.boostsaves.com_0.localstorage
 
***** [ Scheduled Tasks ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updateSaltarSmart_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updateSaltarSmart_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatewhilokii_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatewhilokii_rasmancs
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{FEB62B15-CC00-4736-AAEC-BA046C9DFF73}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKCU\Software\Bitberry
Key Deleted : HKCU\Software\dsiteproducts
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKLM\SOFTWARE\systweak
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\openit open it!
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v9.0.8112.16540
 
 
-\\ Mozilla Firefox v24.0 (en-US)
 
[ File : C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\prefs.js ]
 
 
-\\ Google Chrome v
 
[ File : C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN28965888516356657&ctid=CT3303000&UM=2
Deleted [Search Provider] : hxxp://start.funmoods.com/results.php?f=4&a=axl&q={searchTerms}
Deleted [Search Provider] : hxxp://dts.search-results.com/sr?src=crb&gct=ds&appid=341&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=7301375034184569&q={searchTerms}
Deleted [Search Provider] : hxxp://moneysavingmom.com/money-saving-mom-search-results?cx=007411191005105397513%3Aunk5vrqj0se&cof=FORID%3A11&ie=UTF-8&q={searchTerms}
Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
 
*************************
 
AdwCleaner[R0].txt - [14067 octets] - [15/10/2013 11:33:42]
AdwCleaner[R1].txt - [6050 octets] - [15/09/2014 15:36:47]
AdwCleaner[S0].txt - [14082 octets] - [15/10/2013 11:39:46]
AdwCleaner[S1].txt - [6674 octets] - [15/09/2014 15:41:39]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [6734 octets] ##########

  • 0

#10
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts

fresh frst log

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-09-2014
Ran by Sarah (administrator) on SARAH-HP on 15-09-2014 16:00:17
Running from C:\Users\Sarah\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\ccsvchst.exe
(Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\ccsvchst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicatorCom.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\consent.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-09] (Synaptics Incorporated)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-06-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-21-2789968882-3570388344-1764720213-1001\...\Run: [Google Update] => C:\Users\Sarah\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-12-25] (Google Inc.)
HKU\S-1-5-21-2789968882-3570388344-1764720213-1001\...\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk
ShortcutTarget: Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk -> C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine64\20.5.0.28\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine64\20.5.0.28\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine64\20.5.0.28\buShell.dll (Symantec Corporation)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/CQNOT/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/CQNOT/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/CQNOT/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/CQNOT/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/CQNOT/1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\coIEPlg.dll (Symantec Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 
FireFox:
========
FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Sarah\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Sarah\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF Extension: Whilokii - C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\Extensions\{fed5e6b2-4fc4-43ba-8e95-001d959d8008}.xpi [2014-09-15]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn [2014-09-15]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn [2013-04-02]
 
Chrome: 
=======
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://mysearch.avg.com?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=18.1.9.799&pid=safeguard&sg=0&sap=hp"
CHR DefaultSearchKeyword: Default -> mysearch.avg.com
CHR DefaultSearchProvider: Default -> AVG Secure Search
CHR DefaultSearchURL: Default -> http://mysearch.avg.com/search?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=17.0.0.12&pid=safeguard&sg=0&sap=dsp&q={searchTerms}
CHR DefaultSuggestURL: Default -> http://toolbar.avg.c...earchTerms}&o=1
CHR Profile: C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Norton Security Toolbar) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\bejnhdlplbjhffionohbdnpcbobfejcc [2014-06-27]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-15]
CHR Extension: (Skype Click to Call) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-02-18]
CHR Extension: (Google Wallet) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-18]
CHR HKLM-x32\...\Chrome\Extension: [bejnhdlplbjhffionohbdnpcbobfejcc] - C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\Exts\Chrome.crx [2014-05-31]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-01-17]
CHR StartMenuInternet: Google Chrome - C:\Users\Sarah\AppData\Local\Google\Chrome\Application\chrome.exe
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-06-17] (Advanced Micro Devices, Inc.) [File not signed]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-27] (Realsil Microelectronics Inc.) [File not signed]
R2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\20.5.0.28\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130924.001\BHDrvx64.sys [1525848 2013-09-24] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1405000.01C\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130927.002\IDSvia64.sys [520280 2013-08-25] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130927.018\ENG64.SYS [126040 2013-09-02] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130927.018\EX64.SYS [2099288 2013-09-02] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\1405000.01C\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1405000.01C\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1405000.01C\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1405000.01C\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-07-17] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1405000.01C\Ironx64.SYS [224416 2012-07-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1405000.01C\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-09-15 16:00 - 2014-09-15 16:00 - 00019111 _____ () C:\Users\Sarah\Desktop\FRST.txt
2014-09-15 15:40 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-09-15 15:29 - 2014-09-15 15:30 - 01373475 _____ () C:\Users\Sarah\Desktop\AdwCleaner (1).exe
2014-09-15 15:24 - 2014-09-15 15:44 - 00047266 _____ () C:\Windows\WindowsUpdate.log
2014-09-12 11:38 - 2014-09-12 11:42 - 00040573 _____ () C:\Users\Sarah\Downloads\Addition.txt
2014-09-12 11:32 - 2014-09-12 11:33 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64 (2).exe
2014-09-12 10:44 - 2014-09-12 11:42 - 00034182 _____ () C:\Users\Sarah\Downloads\FRST.txt
2014-09-12 10:43 - 2014-09-15 16:00 - 00000000 ____D () C:\FRST
2014-09-12 10:42 - 2014-09-12 10:42 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64 (1).exe
2014-09-12 10:42 - 2014-09-12 10:42 - 02105856 _____ (Farbar) C:\Users\Sarah\Desktop\FRST64.exe
2014-09-12 10:41 - 2014-09-12 10:41 - 01097728 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2014-09-12 10:39 - 2014-09-12 10:39 - 00003304 _____ () C:\Windows\System32\Tasks\PCHB_WaitAndStartAfter
2014-09-12 10:38 - 2014-09-12 10:38 - 00001078 _____ () C:\Users\Public\Desktop\PC HealthBoost.lnk
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HealthBoost
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\ProgramData\BoostSoftware
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\Program Files (x86)\PC HealthBoost
2014-09-12 10:35 - 2014-09-12 10:36 - 03079136 _____ (BoostSoftware Inc. ) C:\Users\Sarah\Downloads\PCHealthBoost-Setup.exe
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 __SHD () C:\found.000
2014-09-12 09:07 - 2014-05-14 12:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-12 09:07 - 2014-05-14 12:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-12 09:07 - 2014-05-14 12:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-12 09:07 - 2014-05-14 12:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-12 09:05 - 2014-05-14 12:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-12 09:05 - 2014-05-14 12:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-09-12 09:05 - 2014-05-14 12:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-09-12 09:05 - 2014-05-14 12:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-09-12 09:05 - 2014-05-14 12:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-12 09:05 - 2014-05-14 12:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-09-12 09:02 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-12 09:02 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-12 09:02 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-12 09:02 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-09-15 16:02 - 2014-09-15 16:00 - 00019111 _____ () C:\Users\Sarah\Desktop\FRST.txt
2014-09-15 16:00 - 2014-09-12 10:43 - 00000000 ____D () C:\FRST
2014-09-15 15:58 - 2014-09-15 15:24 - 00047266 _____ () C:\Windows\WindowsUpdate.log
2014-09-15 15:53 - 2009-07-14 01:13 - 00006426 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-15 15:53 - 2009-07-14 00:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-15 15:53 - 2009-07-14 00:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-15 15:45 - 2010-11-20 23:47 - 00457558 _____ () C:\Windows\PFRO.log
2014-09-15 15:45 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-15 15:45 - 2009-07-14 00:51 - 00081737 _____ () C:\Windows\setupact.log
2014-09-15 15:42 - 2013-10-15 11:29 - 00000000 ____D () C:\AdwCleaner
2014-09-15 15:41 - 2011-12-25 13:30 - 00000000 ____D () C:\Users\Sarah
2014-09-15 15:30 - 2014-09-15 15:29 - 01373475 _____ () C:\Users\Sarah\Desktop\AdwCleaner (1).exe
2014-09-15 15:12 - 2011-12-25 13:53 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001UA.job
2014-09-15 15:06 - 2012-01-04 23:40 - 00000000 ____D () C:\Program Files (x86)\Kodak
2014-09-15 15:06 - 2012-01-04 23:37 - 00000000 ____D () C:\ProgramData\Kodak
2014-09-15 15:05 - 2012-01-04 23:46 - 00000000 ____D () C:\Users\Sarah\AppData\Local\Eastman_Kodak_Company
2014-09-15 14:12 - 2012-02-17 20:16 - 00000000 ____D () C:\Users\Sarah\AppData\Local\CrashDumps
2014-09-15 13:57 - 2011-12-25 13:53 - 00000856 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001Core.job
2014-09-15 13:56 - 2009-07-13 22:34 - 00000505 _____ () C:\Windows\win.ini
2014-09-15 13:55 - 2013-10-19 11:24 - 00000151 _____ () C:\Users\Sarah\AppData\Roaming\WB.CFG
2014-09-12 12:14 - 2011-12-25 13:54 - 00002368 _____ () C:\Users\Sarah\Desktop\Google Chrome.lnk
2014-09-12 11:42 - 2014-09-12 11:38 - 00040573 _____ () C:\Users\Sarah\Downloads\Addition.txt
2014-09-12 11:42 - 2014-09-12 10:44 - 00034182 _____ () C:\Users\Sarah\Downloads\FRST.txt
2014-09-12 11:33 - 2014-09-12 11:32 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64 (2).exe
2014-09-12 10:42 - 2014-09-12 10:42 - 02105856 _____ (Farbar) C:\Users\Sarah\Downloads\FRST64 (1).exe
2014-09-12 10:42 - 2014-09-12 10:42 - 02105856 _____ (Farbar) C:\Users\Sarah\Desktop\FRST64.exe
2014-09-12 10:41 - 2014-09-12 10:41 - 01097728 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2014-09-12 10:39 - 2014-09-12 10:39 - 00003304 _____ () C:\Windows\System32\Tasks\PCHB_WaitAndStartAfter
2014-09-12 10:38 - 2014-09-12 10:38 - 00001078 _____ () C:\Users\Public\Desktop\PC HealthBoost.lnk
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HealthBoost
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\ProgramData\BoostSoftware
2014-09-12 10:38 - 2014-09-12 10:38 - 00000000 ____D () C:\Program Files (x86)\PC HealthBoost
2014-09-12 10:36 - 2014-09-12 10:35 - 03079136 _____ (BoostSoftware Inc. ) C:\Users\Sarah\Downloads\PCHealthBoost-Setup.exe
2014-09-12 10:07 - 2011-12-25 13:53 - 00003878 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001UA
2014-09-12 10:07 - 2011-12-25 13:53 - 00003482 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2789968882-3570388344-1764720213-1001Core
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 __SHD () C:\found.000
2014-09-12 08:46 - 2013-08-02 16:32 - 00000000 ____D () C:\Users\Sarah\AppData\Roaming\HpUpdate
 
Some content of TEMP:
====================
C:\Users\Sarah\AppData\Local\Temp\Quarantine.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-09-12 12:55
 
==================== End Of Log ============================

  • 0

Advertisements


#11
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts

The laptop seems to be running, better, I'm not getting annoying popups anymore..


  • 0

#12
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts

I also downloaded the free antivirus software thru my internet provider.  Constant guard protection suite with Norton


  • 0

#13
23red

23red

    Trusted Helper

  • Malware Removal
  • 1,797 posts

Hi Tracy :)

Excellent work! :thumbsup: The Log looks much better! :)

 

 

I also downloaded the free antivirus software thru my internet provider.  Constant guard protection suite with Norton

 

 

If you are comfortable with that, it is fine ;) 
If wanted or needed, you do have other free choices.

 

Let's fix Chrome:

 

We'll use FRST to remove some not so good settings:

 

Step 1
FRST Fix

 

Download attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

 

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

 

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Attached File  fixlist.txt   735bytes   67 downloads

 

Then:

 

In Chrome you will need to reset your default search option manually.
To do this:

 

1.  Click the Chrome menu on the browser toolbar chromechanges.jpg
2.  Select Settings.
3.  In  the Search section, click Manage search engines.
4.  Check if (Default) is displayed next to your preferred search engine (such as Google). If not, hover the mouse over it and click to make Google default.
5.  Hover the mouse over any other suspicious search engine entries (such as AVG Secure Search) and any others that are not familiar and click X to remove them.
6.  Reboot

 

Check chrome and make sure it functions correctly.

 

Let's do a bit more checking to be sure looking for items we don't necessarily see with other programs:

 

Step 2
Malwarebytes

 

•Please download Malwarebytes Anti-Malware to your desktop.
•Double-click mbam-setup-version.exe and follow the prompts to install the program.
•At the end, be sure a check-mark is placed next to the following:

 

1.  Enable free trial of Malwarebytes Anti-Malware Premium
2.  Launch Malwarebytes Anti-Malware

 

•Then click Finish.
•If an update is found, you will be prompted to download and install the latest version.
•Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
•Once the scan completes click the View detailed log link
•Then click the Copy to clipboard button and paste into your next post.
•When the scan is complete , make sure that everything is set to go to "Quarantine", and click Apply Actions.
•Reboot your computer if prompted.

 

Step 3
SecurityCheck by Screen317:

 

Please also download Security Check by screen317.

•Save it to your Desktop.

•Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.

•A Notepad document should open automatically called checkup.txt; please also post the contents of that document.

NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!  Try rebooting the system and then run SecurityCheck again.

 

Step 4
ESET Online Scan
 


  • Please go here and click on 1.JPG
  • Note: This site is optimized for Internet Explorer. Please use it for this scan. If you wish to use Firefox or Chrome you will be asked to download the ESET Smart Installer first (esetsmartinstaller_enu.exe). Go ahead and download and run this file.
  • Please accept the ESET Online Scanner EULA and click Start.
  • If prompted, allow the Add-On/Active X to install. If you have problems with this step please see this link.
  • Make sure Enable detection of potentially unwanted applications is selected.
  • Click the Advanced Settings link.
  • Make sure Remove found threats is NOT checked.
  • Make sure Scan archives IS checked.
  • Make sure Scan for potentially unsafe applications IS checked.
  • Make sure Enable Anti-Stealth technology IS checked
  • 2.JPG
  • Click on Start
  • The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed make sure you first copy the contents of the logfile located at C:\Program Files\ESET\Eset Online Scanner\log.txt
    Note: Copy/Paste the contents of the log.txt file before going on to the next step or the log file will be removed.
  • Also be sure to check Uninstall Application on Close before clicking finish.
  • Paste that log as a part of your next post.

 

 

Step 5
Post!

 

When you return, please post:

 

1. Fixlog.txt
2. Malwarebytes log
3. checkup.txt
4. Eset Online Scanner\log.txt
5. Are you currently experiencing any issues?

 

Thank you :)

 

 


  • 0

#14
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts

FRST Log

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-09-2014
Ran by Sarah at 2014-09-17 22:34:00 Run:2
Running from C:\Users\Sarah\Desktop
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://mysearch.avg.com?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=18.1.9.799&pid=safeguard&sg=0&sap=hp"
CHR DefaultSearchKeyword: Default -> mysearch.avg.com
CHR DefaultSearchURL: Default -> http://mysearch.avg.com/search?cid={180BD476-E6DC-419E-8D98-E266A453859E}&mid=7025a5a86ed847d3838b9557e7229111-23912a78c79a119d8485070cf919c90e618646cb&lang=en&ds=co011&coid=avgtbdisco&pr=sa&d=2013-10-19 10:27:27&v=17.0.0.12&pid=safeguard&sg=0&sap=dsp&q={searchTerms} 
CHR DefaultSuggestURL: Default -> http://toolbar.avg.c...earchTerms}&o=1
 
*****************
 
Chrome HomePage deleted successfully.
Chrome StartupUrls deleted successfully.
Chrome DefaultSearchKeyword deleted successfully.
Chrome DefaultSearchURL deleted successfully.
Chrome DefaultSuggestURL deleted successfully.
 
==== End of Fixlog ====

  • 0

#15
busymomof4kids

busymomof4kids

    Member

  • Topic Starter
  • Member
  • PipPip
  • 39 posts

Malwarebytes log

 

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 9/17/2014
Scan Time: 11:30:41 PM
Logfile: Scan log.txt
Administrator: Yes
 
Version: 2.00.2.1012
Malware Database: v2014.09.18.01
Rootkit Database: v2014.09.15.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sarah
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 314943
Time Elapsed: 7 hr, 40 min, 34 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 3
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\${dtUserElevationPolicyID}, Quarantined, [0415935ccdae8fa7ac0caac4ad571ee2], 
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\${dtUserElevationPolicyID}, Quarantined, [6bae11de87f4b28444743f2f5fa544bc], 
PUP.Optional.SevereWeatherAlerts.A, HKU\S-1-5-21-2789968882-3570388344-1764720213-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SevereWeatherAlerts.exe, Quarantined, [dd3ce00f196292a44f1e2a3a04007e82], 
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 5
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\_metadata, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\toolbarImages, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
 
Files: 55
PUP.Optional.InstallCore, C:\Users\Sarah\Downloads\ZipExtractorSetup.exe, Quarantined, [a9708f60275495a1990eceaad62e6c94], 
PUP.Optional.Superfish.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Delete-on-Reboot, [5dbc727d413ac57116098c928380be42], 
PUP.Optional.Superfish.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [839616d975068caaae7136e84db65fa1], 
PUP.Optional.Whilokii.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\extensions\{fed5e6b2-4fc4-43ba-8e95-001d959d8008}.xpi, Quarantined, [dd3c6689b0cb9f97112f52da19eac13f], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\background.js, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\cs.js, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\icon128.png, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\icon16.png, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\icon48.png, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\info.js, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\manifest.json, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.GreatArcadeHits.A, C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcogajbgikalbpphmoedjlcfjkhgh\1.0.7_0\_metadata\verified_contents.json, Quarantined, [0a0ffbf40c6f0234526e02d3fb0722de], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.1000082.currentList, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.1000082.localStations, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.1000082.nowPlaying, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.1000082.publisherStations, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.130136188917021865.search.selectedEngineId, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.130136188917021865.search.settings, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.appOptions, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.fullUserID, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.installUsageEarly, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.NotificationSettings, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_toolbarContextMenu, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_toolbarSettings, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_translation, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_serviceMap, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_setupAPI, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_toolbarContextMenu, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_toolbarSettings, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_translation, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_appsMetadata, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_appTrackingFirstTime, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_Configuration, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_gottenAppsContextMenu, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_otherAppsContextMenu, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_searchAPI, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_serviceMap, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\serviceLayer_userApps_added, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\toolbar_initializing_logger.txt, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\uninstallData, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\uninstallUrl, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.NOTIFICATION_ID.notifications-repository, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_searchAPI, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_RAW.serviceLayer_services_setupAPI, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.NOTIFICATION_ID.notifications-servicemap, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.NOTIFICATION_ID.notifications-service_1787912, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.pg_conf_global, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.searchProtectorData, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.searchUserMode, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000.UserID, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_appsMetadata, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_appTrackingFirstTime, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_Configuration, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_gottenAppsContextMenu, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
PUP.Optional.Conduit.A, C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\5ppafeze.default\CT3303000\CT3303000_10.20.1.508.serviceLayer_services_otherAppsContextMenu, Quarantined, [14058f60f08bf34346f56c6de61cbb45], 
 
Physical Sectors: 0
(No malicious items detected)

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP