[L1nd@]

I was getting popups for advertisements and surveys I unfortunately downloaded spyhunter to rid these pop ups unfortunately although I have removed SpyHunter from programs add and remove it still is present on my taskbar, and constantly keeps scanning my laptop. I have tried doing a search on my laptop and nothing is showing up for Spy

Hunter. I have downloaded and used spybot but this has done nothing to stop it. The window I get up is spyhunter4-hosts file monitor can anybody help me permanently remove this I am running windows 7 Thankyou for any help available. I have included the OTL log file I hope this is the correct thing to do.

OTL logfile created on: 07/01/2015 21:42:46 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\User\Desktop\Dowmloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17501)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

 

3.90 Gb Total Physical Memory | 2.18 Gb Available Physical Memory | 55.82% Memory free

7.80 Gb Paging File | 5.21 Gb Available in Paging File | 66.76% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 465.54 Gb Total Space | 411.75 Gb Free Space | 88.45% Space Free | Partition Type: NTFS

 

Computer Name: USER-PC | User Name: User | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2015/01/07 21:42:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\Dowmloads\OTL.exe

PRC - [2014/12/06 01:50:53 | 000,856,904 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

PRC - [2014/09/12 09:43:06 | 000,064,704 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2014/08/30 17:48:46 | 000,234,520 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe

PRC - [2014/08/30 17:47:54 | 000,193,128 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe

PRC - [2014/07/14 18:21:46 | 001,390,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

PRC - [2014/07/14 18:21:06 | 001,767,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

PRC - [2012/04/28 09:20:06 | 000,163,456 | ---- | M] (Atheros) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

PRC - [2012/02/29 08:20:04 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

PRC - [2012/02/29 08:19:58 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

PRC - [2012/02/29 08:19:48 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2014/12/06 01:50:50 | 009,009,480 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll

MOD - [2014/12/06 01:50:46 | 001,077,064 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll

MOD - [2014/12/06 01:50:45 | 000,211,272 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll

MOD - [2014/12/06 01:50:44 | 001,677,128 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll

 

 

========== Services (SafeList) ==========

 

SRV:64bit: - [2015/01/06 18:53:04 | 001,025,920 | ---- | M] (Enigma Software Group USA, LLC.) [Disabled | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe -- (SpyHunter 4 Service)

SRV:64bit: - [2014/11/22 02:35:29 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2013/11/12 15:37:51 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2012/02/02 21:29:52 | 000,628,448 | ---- | M] (Intel® Corporation) [Auto | Running] -- c:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel®

SRV:64bit: - [2010/12/17 15:46:00 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg)

SRV - [2015/01/03 01:56:55 | 002,726,256 | ---- | M] (Acute Angle Solutions Ltd) [Auto | Stopped] -- C:\ProgramData\EKAfRti\Zoqctjxcdc.exe -- (Zoqctjxcdc)

SRV - [2014/12/26 18:45:34 | 000,267,440 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014/12/11 10:30:48 | 000,315,496 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2014/09/12 09:43:06 | 000,064,704 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2014/08/30 17:48:46 | 000,234,520 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe -- (AVP15.0.1)

SRV - [2014/07/14 18:21:46 | 001,390,176 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)

SRV - [2014/07/14 18:21:06 | 001,767,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)

SRV - [2014/03/20 22:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2013/09/11 23:54:32 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2012/06/07 11:03:02 | 000,276,288 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)

SRV - [2012/04/28 09:20:06 | 000,163,456 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe -- (ZAtheros Bt&Wlan Coex Agent)

SRV - [2012/04/28 08:57:54 | 000,119,424 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\AdminService.exe -- (AtherosSvc)

SRV - [2012/02/29 08:20:04 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)

SRV - [2012/02/29 08:19:58 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)

SRV - [2012/02/29 08:19:48 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe -- (jhi_service)

 

 

========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2015/01/06 18:53:08 | 000,015,920 | ---- | M] (Enigma Software Group USA, LLC.) [Kernel | On_Demand | Running] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)

DRV:64bit: - [2015/01/06 18:53:07 | 000,022,704 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\EsgScanner.sys -- (EsgScanner)

DRV:64bit: - [2014/12/07 16:43:32 | 000,077,512 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klwtp.sys -- (Klwtp)

DRV:64bit: - [2014/12/07 16:43:31 | 000,818,888 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)

DRV:64bit: - [2014/12/07 16:43:30 | 000,150,536 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klflt.sys -- (klflt)

DRV:64bit: - [2014/10/29 13:22:57 | 000,039,008 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LhdX64.sys -- (LHDmgr)

DRV:64bit: - [2014/10/29 13:22:57 | 000,030,816 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC)

DRV:64bit: - [2014/08/12 18:33:02 | 000,246,456 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klhk.sys -- (klhk)

DRV:64bit: - [2014/07/09 16:23:54 | 000,179,776 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kneps.sys -- (kneps)

DRV:64bit: - [2014/07/02 16:10:38 | 000,046,144 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\kldisk.sys -- (kldisk)

DRV:64bit: - [2014/06/05 19:02:08 | 000,055,872 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kltdi.sys -- (kltdi)

DRV:64bit: - [2014/05/17 02:35:04 | 000,044,744 | ---- | M] (AnchorFree Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\hssdrv6.sys -- (HssDRV6)

DRV:64bit: - [2014/05/17 00:42:38 | 000,042,184 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss6.sys -- (taphss6)

DRV:64bit: - [2014/05/05 22:36:41 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2014/05/05 22:36:41 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2014/03/31 20:06:06 | 000,058,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)

DRV:64bit: - [2014/03/31 11:47:10 | 000,468,576 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (kl1)

DRV:64bit: - [2014/03/28 17:51:04 | 000,028,768 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klkbdflt.sys -- (klkbdflt)

DRV:64bit: - [2014/02/25 13:09:02 | 000,030,304 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)

DRV:64bit: - [2013/11/12 15:16:59 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2013/11/12 15:16:59 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2013/11/12 15:13:23 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2013/11/12 15:12:31 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)

DRV:64bit: - [2013/11/12 15:12:31 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2013/08/08 17:11:00 | 000,029,280 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)

DRV:64bit: - [2013/04/12 15:34:48 | 000,015,456 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klpd.sys -- (klpd)

DRV:64bit: - [2013/01/14 21:10:52 | 000,238,288 | ---- | M] (Kaspersky Lab UK Ltd) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\cm_km_w.sys -- (cm_km_w)

DRV:64bit: - [2012/11/27 03:46:02 | 000,569,152 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2012/08/20 08:38:12 | 000,416,072 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)

DRV:64bit: - [2012/08/20 08:38:12 | 000,138,568 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)

DRV:64bit: - [2012/07/20 16:09:40 | 000,043,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\irstrtdv.sys -- (irstrtdv)

DRV:64bit: - [2012/06/12 21:00:48 | 000,726,160 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2012/06/07 10:49:08 | 014,760,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2012/05/31 16:06:50 | 002,811,904 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2012/05/21 14:25:32 | 000,789,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)

DRV:64bit: - [2012/05/21 14:25:32 | 000,357,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)

DRV:64bit: - [2012/05/21 14:25:32 | 000,019,264 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)

DRV:64bit: - [2012/04/28 09:09:24 | 000,550,528 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)

DRV:64bit: - [2012/04/28 09:07:00 | 000,030,848 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)

DRV:64bit: - [2012/03/02 17:49:00 | 000,104,048 | ---- | M] (Qualcomm Atheros Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2012/01/31 12:17:00 | 001,601,152 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)

DRV:64bit: - [2011/12/06 18:23:10 | 000,331,264 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)

DRV:64bit: - [2011/11/15 17:24:20 | 000,313,960 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rtsuvstor.sys -- (RSUSBVSTOR)

DRV:64bit: - [2011/11/10 16:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)

DRV:64bit: - [2010/11/21 03:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010/08/28 00:53:32 | 000,023,080 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mv91cons.sys -- (mv91cons)

DRV:64bit: - [2010/08/28 00:53:22 | 000,297,000 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx)

DRV:64bit: - [2010/08/10 15:29:14 | 000,120,920 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)

DRV:64bit: - [2009/07/14 01:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/14 01:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/14 01:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/06/10 20:35:38 | 000,707,072 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364)

DRV:64bit: - [2009/06/10 20:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 20:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 20:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 20:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009/07/14 01:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-gb/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DF 7E D2 00 F9 29 D0 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77}: "URL" = http://www.bing.com/...Box&FORM=IESR02

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@exent.com/npExentCtl,version=7.0.0.0: C:\Program Files (x86)\Free Ride Games\npExentCtl.dll File not found

FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.25.2: C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.25.2: C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\[email protected] [2014/12/07 16:51:05 | 000,000,000 | ---D | M]

FF - HKLM\Software\MozillaPlugins\@kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\[email protected] [2014/12/07 16:51:05 | 000,000,000 | ---D | M]

FF - HKLM\Software\MozillaPlugins\@kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\[email protected] [2014/12/07 16:51:06 | 000,000,000 | ---D | M]

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKLM\Software\MozillaPlugins\www.exent.com/GameTreatWidget: C:\Program Files (x86)\Free Ride Games\NPGameTreatPlugin.dll File not found

FF - HKCU\Software\MozillaPlugins\www.exent.com/GameTreatWidget: C:\Program Files (x86)\Free Ride Games\npGameTreatWidget.dll File not found

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\[email protected] [2014/12/07 16:51:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\[email protected] [2014/12/07 16:51:06 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\[email protected] [2014/12/07 16:51:05 | 000,000,000 | ---D | M]

 

 

========== Chrome  ==========

 

CHR - default_search_provider:  ()

CHR - default_search_provider: search_url = 

CHR - default_search_provider: suggest_url = 

CHR - plugin: Error reading preferences file

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.8_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho\4.0.9.130_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.0_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: No name found = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2015/01/06 21:07:16 | 000,450,771 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.0scan.com

O1 - Hosts: 127.0.0.1 0scan.com

O1 - Hosts: 127.0.0.1 1000gratisproben.com

O1 - Hosts: 127.0.0.1 www.1000gratisproben.com

O1 - Hosts: 127.0.0.1 1001namen.com

O1 - Hosts: 127.0.0.1 www.1001namen.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 www.1-2005-search.com

O1 - Hosts: 127.0.0.1 1-2005-search.com

O1 - Hosts: 127.0.0.1 123fporn.info

O1 - Hosts: 15471 more lines...

O2:64bit: - BHO: (Content Blocker Plugin) - {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

O2:64bit: - BHO: (Virtual Keyboard Plugin) - {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

O2:64bit: - BHO: (Safe Money Plugin) - {E3D96E85-529D-4269-AC6A-97CF9E2221E3} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

O2 - BHO: (Content Blocker Plugin) - {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

O2 - BHO: (Virtual Keyboard Plugin) - {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Safe Money Plugin) - {E3D96E85-529D-4269-AC6A-97CF9E2221E3} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\athbttray.exe (Atheros Commnucations)

O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\btvstack.exe (Atheros Commnucations)

O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)

O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4 - HKCU..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)

O4 - HKCU..\Run: [SoftonicAssistant] C:\Users\User\AppData\Local\SoftonicAssistant\SoftonicAssistant.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1

O9:64bit: - Extra Button: Virtual Keyboard - {09A10376-994C-4BBF-9121-F50CF7BA237E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

O9:64bit: - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)

O9 - Extra Button: Virtual Keyboard - {09A10376-994C-4BBF-9121-F50CF7BA237E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

O9 - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}  (ExentInf Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{07D6EE41-9FC6-45EB-A1EA-5BADD17DA9C2}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9CF50E1C-03C9-4A40-A360-F03F18E5137A}: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2015/01/06 18:54:16 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2015/01/07 01:08:18 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\biscuits

[2015/01/06 20:06:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2015/01/06 20:06:24 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\ProcAlyzer Dumps

[2015/01/06 18:53:54 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Enigma Software Group

[2015/01/06 18:53:45 | 000,000,000 | ---D | C] -- C:\sh4ldr

[2015/01/06 18:52:59 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2015/01/06 01:53:54 | 000,000,000 | ---D | C] -- C:\SafeWeb

[2015/01/05 22:09:56 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\SafeWeb

[2015/01/05 22:04:29 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2015/01/03 19:01:08 | 000,000,000 | ---D | C] -- C:\ProgramData\2355320829

[2015/01/03 02:15:31 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Fuzzy Bug Interactive

[2015/01/03 02:14:46 | 000,058,264 | ---- | C] (Exent Technologies Ltd.) -- C:\Windows\ExentInfo.exe

[2015/01/03 02:14:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield

[2015/01/03 02:13:58 | 000,000,000 | ---D | C] -- C:\Remote Programs

[2015/01/03 02:11:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Unchecky

[2015/01/03 01:56:55 | 000,000,000 | ---D | C] -- C:\ProgramData\EKAfRti

[2015/01/03 01:55:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Granny in Paradise

[2015/01/03 01:55:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BFG

[2015/01/03 01:55:04 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\SoftonicAssistant

[2015/01/02 22:05:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

[2015/01/02 22:05:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle

[2015/01/02 22:04:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java

[2015/01/02 22:04:55 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\CrashDumps

[2015/01/02 13:00:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2015/01/02 13:00:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2015/01/02 13:00:16 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2014/12/30 18:13:11 | 000,044,744 | ---- | C] (AnchorFree Inc.) -- C:\Windows\SysNative\drivers\hssdrv6.sys

[2014/12/29 22:05:03 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\ElevatedDiagnostics

[2014/12/26 18:46:25 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Macromedia

[2014/12/26 18:45:32 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed

[2014/12/26 18:45:30 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed

[2014/12/18 16:38:06 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\steve hotmail

[2014/12/11 07:02:04 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appraiser

[2014/12/09 08:23:49 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Skype

[2014/12/09 08:23:46 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Skype

[2014/12/09 08:23:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

 

========== Files - Modified Within 30 Days ==========

 

[2015/01/07 21:13:09 | 000,028,528 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2015/01/07 21:13:09 | 000,028,528 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2015/01/07 21:12:52 | 000,781,298 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2015/01/07 21:12:52 | 000,666,176 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2015/01/07 21:12:52 | 000,125,820 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2015/01/07 21:08:10 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job

[2015/01/07 21:07:19 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2015/01/07 21:06:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2015/01/07 21:06:12 | 3140,444,160 | -HS- | M] () -- C:\hiberfil.sys

[2015/01/07 20:49:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2015/01/07 20:48:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2015/01/07 20:45:33 | 000,000,543 | ---- | M] () -- C:\Users\User\Desktop\AOL Mail - New Mail.website

[2015/01/07 20:44:48 | 000,000,479 | ---- | M] () -- C:\Users\User\Desktop\Outlook.com.website

[2015/01/07 15:09:35 | 000,000,156 | ---- | M] () -- C:\Users\User\Desktop\VIDEO- Rural road blocked as 44 ton lorry overturns - Halifax Courier.url

[2015/01/06 21:07:16 | 000,450,771 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2015/01/06 18:54:16 | 000,000,000 | ---- | M] () -- C:\autoexec.bat

[2015/01/06 18:53:07 | 000,022,704 | ---- | M] () -- C:\Windows\SysNative\drivers\EsgScanner.sys

[2015/01/06 00:05:57 | 000,000,496 | ---- | M] () -- C:\Users\User\Desktop\HotUKDeals - Deals, Discounts & Voucher Codes.website

[2015/01/05 22:35:09 | 000,000,545 | ---- | M] () -- C:\Users\User\Desktop\Expat Forum For People Moving Overseas And Living Abroad - Search Results.website

[2015/01/05 00:32:18 | 000,000,521 | ---- | M] () -- C:\Users\User\Desktop\The Freecycle Network.website

[2015/01/03 19:01:52 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20150106-210716.backup

[2015/01/03 11:12:03 | 000,000,042 | ---- | M] () -- C:\Users\User\AppData\Roaming\WB.CFG

[2015/01/03 02:14:53 | 000,000,064 | ---- | M] () -- C:\Windows\GPlrLanc.dat

[2015/01/03 02:11:32 | 000,002,183 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014/12/30 18:13:45 | 000,001,120 | ---- | M] () -- C:\Users\Public\Desktop\Hotspot Shield.lnk

[2014/12/30 18:06:55 | 000,000,055 | ---- | M] () -- C:\Users\User\Desktop\FILMON TV FREE LIVE TV MOVIES AND SOCIAL TELEVISION.url

[2014/12/30 17:34:19 | 000,000,159 | ---- | M] () -- C:\Users\User\Desktop\You’ve Been Cleaning Your Oven The Wrong Way Your Entire Life. This Is So Brilliant! - Newsner.url

[2014/12/16 17:39:57 | 000,000,053 | ---- | M] () -- C:\Users\User\Desktop\My Quidco.url

[2014/12/12 11:42:51 | 000,000,077 | ---- | M] () -- C:\Users\User\Desktop\Search Results for ebay.url

[2014/12/11 09:08:38 | 000,000,103 | ---- | M] () -- C:\Users\User\Desktop\Bradford Freegle Reuse Group - Yahoo Groups.url

[2014/12/10 09:10:20 | 000,000,089 | ---- | M] () -- C:\Users\User\Desktop\Playworld Under 5’s Christmas Party - Playworld Huddersfield.url

 

========== Files Created - No Company Name ==========

 

[2015/01/07 15:09:35 | 000,000,156 | ---- | C] () -- C:\Users\User\Desktop\VIDEO- Rural road blocked as 44 ton lorry overturns - Halifax Courier.url

[2015/01/06 18:54:16 | 000,000,000 | ---- | C] () -- C:\autoexec.bat

[2015/01/06 18:53:07 | 000,022,704 | ---- | C] () -- C:\Windows\SysNative\drivers\EsgScanner.sys

[2015/01/03 11:12:03 | 000,000,042 | ---- | C] () -- C:\Users\User\AppData\Roaming\WB.CFG

[2015/01/03 02:14:53 | 000,000,064 | ---- | C] () -- C:\Windows\GPlrLanc.dat

[2015/01/02 12:09:38 | 000,000,545 | ---- | C] () -- C:\Users\User\Desktop\Expat Forum For People Moving Overseas And Living Abroad - Search Results.website

[2014/12/30 18:13:45 | 000,001,120 | ---- | C] () -- C:\Users\Public\Desktop\Hotspot Shield.lnk

[2014/12/30 18:06:55 | 000,000,055 | ---- | C] () -- C:\Users\User\Desktop\FILMON TV FREE LIVE TV MOVIES AND SOCIAL TELEVISION.url

[2014/12/30 17:34:19 | 000,000,159 | ---- | C] () -- C:\Users\User\Desktop\You’ve Been Cleaning Your Oven The Wrong Way Your Entire Life. This Is So Brilliant! - Newsner.url

[2014/12/26 18:45:35 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/12/16 17:39:57 | 000,000,053 | ---- | C] () -- C:\Users\User\Desktop\My Quidco.url

[2014/12/15 04:13:39 | 000,000,521 | ---- | C] () -- C:\Users\User\Desktop\The Freecycle Network.website

[2014/12/12 11:42:50 | 000,000,077 | ---- | C] () -- C:\Users\User\Desktop\Search Results for ebay.url

[2014/12/11 09:08:38 | 000,000,103 | ---- | C] () -- C:\Users\User\Desktop\Bradford Freegle Reuse Group - Yahoo Groups.url

[2014/12/11 01:21:11 | 000,000,496 | ---- | C] () -- C:\Users\User\Desktop\HotUKDeals - Deals, Discounts & Voucher Codes.website

[2014/12/10 09:10:20 | 000,000,089 | ---- | C] () -- C:\Users\User\Desktop\Playworld Under 5’s Christmas Party - Playworld Huddersfield.url

[2014/10/30 18:08:22 | 000,007,605 | ---- | C] () -- C:\Users\User\AppData\Local\Resmon.ResmonCfg

[2013/12/05 10:49:40 | 000,765,700 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

 

========== ZeroAccess Check ==========

 

[2009/07/14 04:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014/06/25 02:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014/06/25 01:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 01:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 03:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 01:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 

========== LOP Check ==========

 

[2015/01/06 18:53:54 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Enigma Software Group

[2015/01/03 02:15:31 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Fuzzy Bug Interactive

 

========== Purity Check ==========

 

 

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 7886 bytes -> C:\Users\User\Desktop\Outlook.com.website:TASKICON_4OLFavIE91410631431

@Alternate Data Stream - 7886 bytes -> C:\Users\User\Desktop\Outlook.com.website:TASKICON_3SkyDriveFav-1311630743

@Alternate Data Stream - 7886 bytes -> C:\Users\User\Desktop\Outlook.com.website:TASKICON_0OLFavIE91284348923

@Alternate Data Stream - 34494 bytes -> C:\Users\User\Desktop\Outlook.com.website:TASKICON_1OCalFavIE91545382048

@Alternate Data Stream - 1150 bytes -> C:\Users\User\Desktop\Outlook.com.website:TASKICON_2PeopleFav302369383

 

< End of report >

[Advertisements]

Greetings and

My nickname is Ruggie and I will be assisting you in cleaning your computer.
Please be aware I am currently in the final stages of training right now and all my work will be checked by an instructor so there may be a slight delay between posts. The added benefit to this is that you will have 2 sets of eyes looking at your problem so you can be assured you will get the best possible help.

• Malware removal can be a long process and will at times get complicated with multiple steps to perform to ensure that your system is no longer infected.
• When we start the process, the list of instructions must be followed closely, it may seem difficult at times but it is important that you stay with me until your computer is declared clean.
• If you are receiving help elsewhere, please let me know so we can close this thread and help someone else.

Before going any further, I recommend that you print out (or save to a file) these guidelines and also the instructions when I post them, as part of the repair process may involve going into safe mode and therefore you will not have internet access.

The following guidelines are important but the ones highlighted in RED are of the highest importance and must not be skipped.

Please save all tools to the desktop,. Our tools are updated very regularly, sometimes several times per day so always download the latest version from the links I provide.

Please be aware, the fixes we perform are specific to this machine, at this moment in time. They must not be used on another computer or unsupervised at another time. This can render your computer unbootable.

If at all possible, Make backups of all your important files, whilst we will do our best to ensure that no files are lost or damaged, sometimes things can go wrong.

I will do everything in my power to ensure that this clean is successful, but occasionally failure hits us all. In this event, please have your original installation disks to hand and be prepared to have to format and reinstall your computer.

Refrain from using any tool that hasn't been instructed as it could alter the process that we are working through and cause further problems. Also only use the tools I instruct in the manner provided as they are very powerful and if not used properly can cause even more problems. It is best if you can avoid using the computer at all, apart from to perform the cleaning steps to ensure that any infections aren't spread.

Please stick with me until the end. malware removal is difficult and time consuming. We have to analyse hundreds of lines in log files. This takes time which we give freely so I ask that you do us the courtesy of seeing it through.

Only paste the contents of log files into your reply, DO NOT attach any log files unless requested to do so.

If you have any questions or get stuck, stop and ask....I am here to help you make this go as smoothly as possible.

If you do not reply within 3 days, your topic will be closed. It can be reopened if you ask. But if you plan on being gone for a longer period, just let me know and I will hold it open for you.

Ready? Now lets get to work
 

I am currently reviewing your log and will be back as soon as I can with the start to your fixes.

 

Can you please also post the extras.txt file that was created when you run OTL.

It is located here:

 

C:\Users\User\Desktop\Dowmloads\extras.txt

 

To make life easier, for future downloads we may perform, please save the files directly to your desktop - we will clear them once we are finished but it makes life easier when we know where all our files will be located.

[ruggie_uk]

Greetings and

My nickname is Ruggie and I will be assisting you in cleaning your computer.
Please be aware I am currently in the final stages of training right now and all my work will be checked by an instructor so there may be a slight delay between posts. The added benefit to this is that you will have 2 sets of eyes looking at your problem so you can be assured you will get the best possible help.

• Malware removal can be a long process and will at times get complicated with multiple steps to perform to ensure that your system is no longer infected.
• When we start the process, the list of instructions must be followed closely, it may seem difficult at times but it is important that you stay with me until your computer is declared clean.
• If you are receiving help elsewhere, please let me know so we can close this thread and help someone else.

Before going any further, I recommend that you print out (or save to a file) these guidelines and also the instructions when I post them, as part of the repair process may involve going into safe mode and therefore you will not have internet access.

The following guidelines are important but the ones highlighted in RED are of the highest importance and must not be skipped.

Please save all tools to the desktop,. Our tools are updated very regularly, sometimes several times per day so always download the latest version from the links I provide.

Please be aware, the fixes we perform are specific to this machine, at this moment in time. They must not be used on another computer or unsupervised at another time. This can render your computer unbootable.

If at all possible, Make backups of all your important files, whilst we will do our best to ensure that no files are lost or damaged, sometimes things can go wrong.

I will do everything in my power to ensure that this clean is successful, but occasionally failure hits us all. In this event, please have your original installation disks to hand and be prepared to have to format and reinstall your computer.

Refrain from using any tool that hasn't been instructed as it could alter the process that we are working through and cause further problems. Also only use the tools I instruct in the manner provided as they are very powerful and if not used properly can cause even more problems. It is best if you can avoid using the computer at all, apart from to perform the cleaning steps to ensure that any infections aren't spread.

Please stick with me until the end. malware removal is difficult and time consuming. We have to analyse hundreds of lines in log files. This takes time which we give freely so I ask that you do us the courtesy of seeing it through.

Only paste the contents of log files into your reply, DO NOT attach any log files unless requested to do so.

If you have any questions or get stuck, stop and ask....I am here to help you make this go as smoothly as possible.

If you do not reply within 3 days, your topic will be closed. It can be reopened if you ask. But if you plan on being gone for a longer period, just let me know and I will hold it open for you.

Ready? Now lets get to work
 

I am currently reviewing your log and will be back as soon as I can with the start to your fixes.

 

Can you please also post the extras.txt file that was created when you run OTL.

It is located here:

 

C:\Users\User\Desktop\Dowmloads\extras.txt

 

To make life easier, for future downloads we may perform, please save the files directly to your desktop - we will clear them once we are finished but it makes life easier when we know where all our files will be located.

[L1nd@]

Hi Ruggie and thankyou for helping me.I don't seem to be able to find the extras txt file sorry

 

 

 

Edited by L1nd@, 07 January 2015 - 06:52 PM.

[ruggie_uk]

No problem, if you could run OTL again we can obtain one.
 
use the method below.
 
New OTL Scan

OTL

• Ensure OTL is located on your desktop. If it is not, then please download from http://oldtimer.geekstogo.com/OTL.exe and save it to your desktop.
• Right-Click on the OTL icon and select Run as Administrator to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Ensure Extra Registry - Use safelist option is selected as in the image.
  

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
• When the scan completes, it will open a notepad window. OTL.Txt . This is saved in the same location as OTL.
  There will also be another file opened at the same time called extras.txt. Please also paste the content of this file.
  Please copy (Edit->Select All, Edit->Copy) the contents of this file, and paste it into your reply.

[L1nd@]

Ok hopefully this is the right one

 

OTL Extras logfile created on: 08/01/2015 00:56:09 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\User\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17501)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

 

3.90 Gb Total Physical Memory | 2.54 Gb Available Physical Memory | 65.12% Memory free

7.80 Gb Paging File | 5.76 Gb Available in Paging File | 73.88% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 465.54 Gb Total Space | 411.67 Gb Free Space | 88.43% Space Free | Partition Type: NTFS

 

Computer Name: USER-PC | User Name: User | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- C:\Users\User\AppData\Local\SoftonicAssistant\SoftonicAssistant.exe %1 ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- C:\Users\User\AppData\Local\SoftonicAssistant\SoftonicAssistant.exe %1 ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 

========== Security Center Settings ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

========== Authorized Applications List ==========

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{86B6B025-8B18-437B-B720-E507C59CD682}" = lport=5353 | protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe | 

"{A0F52D7D-487C-42CE-A5A1-8852316F000A}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 

"{CF3C9E71-9B57-41BE-9330-C3C96D7C54AB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

"{CF850381-E020-464F-9D34-EFC0AB46B818}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{42A5B233-8578-459E-820F-DEA42A73FDC4}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 

"{6D897F17-032F-4DFF-8AE5-6B2DEB18F2FF}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{8AA21EEA-E6AD-4F74-B17D-D743034087F7}" = dir=in | app=c:\users\user\appdata\local\microsoft\skydrive\skydrive.exe | 

"{9736C3FE-A30B-4BA4-B79F-4BDA0E1CC1FC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{CC2E9021-29D1-4B6E-BFC7-B47951AC5939}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{E9BBC0B4-F830-4DA4-A815-E995CC09F292}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 

"TCP Query User{2DA0E955-25DC-4BE7-90A7-DE2EDFDA7285}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" = protocol=6 | dir=in | app=c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe | 

"UDP Query User{DF021401-C31D-4829-B16B-FC99B476B45F}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" = protocol=17 | dir=in | app=c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe | 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{09536BA1-E498-4CC3-B834-D884A67D7E34}" = Intel® Trusted Connect Service Client

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Atheros Bluetooth Suite (64)

"{25058321-C33E-496B-8915-6FD64D362CAF}" = Windows Live MIME IFilter

"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{7E59919F-564E-3FB5-B1FC-884251B18B06}" = Microsoft .NET Framework 4.5.1

"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010

"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010

"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{CB3CA48C-95CB-412B-B7AE-6F2EA8F89907}" = Windows Live Family Safety

"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant

"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64

"99841829BE839365AA67B2AD0E50D371F59F8A1E" = Windows Driver Package - Lenovo (ACPIVPC) System  (12/15/2011 7.1.0.1)

"CCleaner" = CCleaner

"CNXT_AUDIO_HDA" = Conexant HD Audio

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00F9DB8C-65D7-4D47-AB5F-F698EE38580D}" = Windows Live UX Platform

"{04BE4035-3C8E-4B48-BFB8-1655849C0C8B}" = Windows Live Writer

"{07AAB66E-4718-422D-9218-4AFB3C922A71}" = Photo Gallery

"{0BE9E708-5DC0-4963-9CFD-0AA519090E79}" = Junk Mail filter update

"{0F974770-76EB-4C38-986E-E7BDD9C0DFC4}" = Windows Live Writer Resources

"{1D6432B4-E24D-405E-A4AB-D7E6D088CBC9}" = Windows Live Photo Common

"{240C3DDD-C5E9-4029-9DF7-95650D040CF2}" = Intel® USB 3.0 eXtensible Host Controller Driver

"{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}" = Skype™ 7.0

"{26A24AE4-039D-4CA4-87B4-2F83218025F0}" = Java 8 Update 25

"{277DE249-EA23-43F1-888B-19CE25D708C3}" = Windows Live Family Safety

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros WLAN Client Installation Program

"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver

"{38F03569-A636-4CF3-BDDE-032C8C251304}" = Movie Maker

"{41C61308-6CFD-4D54-AB6A-7136ED08A18E}" = Windows Live Communications Platform

"{48781AC2-0939-4D66-98F2-235328E46790}" = Windows Live Messenger

"{4BAB923C-1ACA-4697-ACA5-C1B5037091BF}" = Windows Live Mail

"{6152DEA9-EA0C-4013-9DBF-4A8881A7F722}" = Windows Live Family Safety

"{62BBB2F0-E220-4821-A564-730807D2C34D}" = Realtek USB 2.0 Reader Driver

"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components

"{6522F5F9-411B-4513-A75B-CEA00395F032}" = Windows Live UX Platform Language Pack

"{659CB81C-B54E-4DF1-B618-F35777393A54}" = Windows Live Installer

"{66B5819D-DE70-42BE-B40F-978FBA12452E}" = Windows Live Essentials

"{6D1221A9-17BF-4EC0-81F2-27D30EC30701}" = Skype Click to Call

"{714E162E-CD4F-4F1B-8302-7F5179409C25}" = Windows Live Writer

"{7171E82A-E90A-4155-9040-6006CEE64DDC}" = Windows Live Writer Resources

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110

"{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}" = Kaspersky Internet Security

"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010

"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010

"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010

"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010

"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010

"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010

"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010

"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010

"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010

"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010

"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010

"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010

"{95C33D2E-8892-40CC-B8FB-E8CC68530D8B}" = Windows Live Writer

"{A0332229-4EF7-4A36-AED8-E5876EB2DF86}" = Windows Live UX Platform Language Pack

"{A2DC527D-FA79-46E9-973F-920897CA55E9}" = Windows Live Writer

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.09)

"{B1D0122C-6BE2-47A2-82AE-0BB3F6C91C49}" = Photo Common

"{B2611F8A-EFE7-4E88-875D-19F0EFAE87E4}" = Windows Live PIMT Platform

"{B6A96E8C-FC88-46F5-800E-6845B4ACA459}" = Photo Gallery

"{B775C26B-EAA8-4A11-ACBF-76E52DF6B805}" = Windows Live Mail

"{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}" = Dolby Advanced Audio v2

"{BAD27F0E-5165-49A5-BE66-AF5BF73F2FEE}" = Windows Live Mail

"{BAD984EE-790E-4513-A428-3BE2D426DCA7}" = Windows Live Messenger

"{C992FFE0-AC32-4FA9-BC9A-F1637B9E655D}" = Photo Gallery

"{CAA0F57A-BA8C-4AD8-AA03-F32B0E4F5623}" = Photo Common

"{CDC1AB00-01FF-4FC7-816A-16C67F0923C0}" = Windows Live SOXE

"{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management

"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64

"{D1893000-EA77-493C-8DDD-E262436E959B}" = Windows Live SOXE Definitions

"{DD67BE4B-7E62-4215-AFA3-F123A800A389}" = Movie Maker

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E703613B-BDAB-433E-A66A-DE0263E3D35D}" = Windows Live Messenger

"{EB3DF0F0-0525-4C5A-A2F8-DEC868A3075D}" = Movie Maker

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics

"{F8F630A7-6789-44D5-8653-3B27969CF337}" = Windows Live Essentials

"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel® OpenCL CPU Runtime

"Adobe Flash Player ActiveX" = Adobe Flash Player 16 ActiveX

"Google Chrome" = Google Chrome

"InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management

"InstallWIX_{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}" = Kaspersky Internet Security

"Office14.SingleImage" = Microsoft Office Professional 2010

"WinLiveSuite" = Windows Live Essentials

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"OneDriveSetup.exe" = Microsoft OneDrive

"SoftonicAssistant" = Softonic Assistant

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 06/01/2015 17:42:26 | Computer Name = User-PC | Source = Windows Search Service | ID = 3029

Description = 

 

Error - 06/01/2015 17:42:27 | Computer Name = User-PC | Source = Windows Search Service | ID = 3029

Description = 

 

Error - 06/01/2015 17:42:27 | Computer Name = User-PC | Source = Windows Search Service | ID = 3028

Description = 

 

Error - 06/01/2015 17:42:27 | Computer Name = User-PC | Source = Windows Search Service | ID = 3058

Description = 

 

Error - 06/01/2015 17:42:27 | Computer Name = User-PC | Source = Windows Search Service | ID = 7010

Description = 

 

Error - 06/01/2015 17:43:31 | Computer Name = User-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 06/01/2015 18:12:24 | Computer Name = User-PC | Source = SideBySide | ID = 16842832

Description = Activation context generation failed for "C:\Users\User\Downloads\SoftonicDownloader_for_granny-in-paradise.exe".Error

 in manifest or policy file "" on line .  A component version required by the application

 conflicts with another component version already active.  Conflicting components 

are:.  Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 06/01/2015 18:12:25 | Computer Name = User-PC | Source = SideBySide | ID = 16842832

Description = Activation context generation failed for "C:\Users\User\Downloads\SoftonicDownloader_for_super-granny.exe".Error

 in manifest or policy file "" on line .  A component version required by the application

 conflicts with another component version already active.  Conflicting components 

are:.  Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 06/01/2015 21:01:31 | Computer Name = User-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 07/01/2015 08:36:00 | Computer Name = User-PC | Source = WinMgmt | ID = 10

Description = 

 

[ Media Center Events ]

Error - 03/12/2014 05:04:48 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 10:04:48 - Error connecting to the internet.  10:04:48 -     Unable 

to contact server..  

 

Error - 14/12/2014 14:54:33 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 18:54:26 - Failed to retrieve Broadband (Error: Unable to connect 

to the remote server)  

 

Error - 15/12/2014 14:37:09 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 18:36:58 - Failed to retrieve Broadband (Error: Unable to connect 

to the remote server)  

 

Error - 16/12/2014 11:55:09 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 15:55:09 - Failed to retrieve Directory (Error: Unable to connect 

to the remote server)  

 

Error - 16/12/2014 11:55:15 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 15:55:12 - Failed to retrieve MCEClientUX (Error: Unable to connect

 to the remote server)  

 

Error - 17/12/2014 15:13:06 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 19:13:05 - Failed to retrieve MCESpotlight (Error: Unable to connect

 to the remote server)  

 

Error - 17/12/2014 15:13:08 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 19:13:08 - Failed to retrieve MCEClientUX (Error: Unable to connect

 to the remote server)  

 

Error - 17/12/2014 15:13:17 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 19:13:11 - Failed to retrieve Broadband (Error: Unable to connect 

to the remote server)  

 

Error - 03/01/2015 09:28:39 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 13:28:39 - Failed to retrieve Directory (Error: Unable to connect 

to the remote server)  

 

Error - 03/01/2015 10:33:34 | Computer Name = User-PC | Source = MCUpdate | ID = 0

Description = 14:33:28 - Failed to retrieve Directory (Error: Unable to connect 

to the remote server)  

 

[ System Events ]

Error - 06/01/2015 04:44:47 | Computer Name = User-PC | Source = BTHUSB | ID = 327697

Description = The local Bluetooth adapter has failed in an undetermined manner and

 will not be used. The driver has been unloaded.

 

Error - 06/01/2015 04:44:53 | Computer Name = User-PC | Source = Service Control Manager | ID = 7000

Description = The X5XSEx_Pr143 service failed to start due to the following error:

   %%3

 

Error - 06/01/2015 13:56:31 | Computer Name = User-PC | Source = BTHUSB | ID = 327697

Description = The local Bluetooth adapter has failed in an undetermined manner and

 will not be used. The driver has been unloaded.

 

Error - 06/01/2015 13:56:36 | Computer Name = User-PC | Source = Service Control Manager | ID = 7000

Description = The X5XSEx_Pr143 service failed to start due to the following error:

   %%3

 

Error - 06/01/2015 17:42:02 | Computer Name = User-PC | Source = Service Control Manager | ID = 7000

Description = The X5XSEx_Pr143 service failed to start due to the following error:

   %%3

 

Error - 06/01/2015 17:42:27 | Computer Name = User-PC | Source = Service Control Manager | ID = 7024

Description = The Windows Search service terminated with service-specific error 

%%-1073473535.

 

Error - 06/01/2015 17:42:27 | Computer Name = User-PC | Source = Service Control Manager | ID = 7031

Description = The Windows Search service terminated unexpectedly.  It has done this

 1 time(s).  The following corrective action will be taken in 30000 milliseconds:

 Restart the service.

 

Error - 06/01/2015 19:02:16 | Computer Name = User-PC | Source = Schannel | ID = 36888

Description = The following fatal alert was generated: 20. The internal error state

 is 960.

 

Error - 06/01/2015 21:00:06 | Computer Name = User-PC | Source = BTHUSB | ID = 327697

Description = The local Bluetooth adapter has failed in an undetermined manner and

 will not be used. The driver has been unloaded.

 

Error - 06/01/2015 21:00:28 | Computer Name = User-PC | Source = Service Control Manager | ID = 7000

Description = The X5XSEx_Pr143 service failed to start due to the following error:

   %%3

 

 

< End of report >

[ruggie_uk]

That's the one thanks.

It's late now and my responses need to be verified by my mentor so it will likely be tomorrow before I have a fix for you.

See you soon

[L1nd@]

 once again Thank You yes it is getting late sleep well spk tomorrow

[ruggie_uk]

Hi L1nd@, a few steps to start with.

Step 1

We need to uninstall some programs.

Open Programs and Features by clicking the Start button, clicking Control Panel, clicking Programs, and then clicking Programs and Features.

Select the following programs from the list below, one at a time and click Uninstall.

• SoftonicAssistant

Step 2

OTL fix

Ensure OTL is located on your desktop. If it is not, then please download from http://oldtimer.geekstogo.com/OTL.exe and save it to your desktop.

If you are using Windows Vista/7/8 then right click it and select Run As Administrator. If you are using XP then please double click on OTL.exe to start it.

Copy the text in the following box (do not include the word Quote). To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:commands
[createrestorepoint]

:OTL
SRV:64bit: - [2015/01/06 18:53:04 | 001,025,920 | ---- | M] (Enigma Software Group USA, LLC.) [Disabled | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe -- (SpyHunter 4 Service)
SRV - [2015/01/03 01:56:55 | 002,726,256 | ---- | M] (Acute Angle Solutions Ltd) [Auto | Stopped] -- C:\ProgramData\EKAfRti\Zoqctjxcdc.exe -- (Zoqctjxcdc)
DRV:64bit: - [2015/01/06 18:53:08 | 000,015,920 | ---- | M] (Enigma Software Group USA, LLC.) [Kernel | On_Demand | Running] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV:64bit: - [2015/01/06 18:53:07 | 000,022,704 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\EsgScanner.sys -- (EsgScanner)
O4 - HKCU..\Run: [SoftonicAssistant] C:\Users\User\AppData\Local\SoftonicAssistant\SoftonicAssistant.exe ()
[2015/01/06 20:06:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2015/01/06 18:52:59 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2015/01/03 01:56:55 | 000,000,000 | ---D | C] -- C:\ProgramData\EKAfRti
[2015/01/03 01:55:04 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\SoftonicAssistant
[2015/01/06 18:53:54 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Enigma Software Group

:commands
[resethosts]

[emptytemp]

Next, right click in the box named Custom Scans/Fixes and select paste.



This will insert the code into OTL.

Now click Run Fix

OTL will generate a report when it has finished. Please paste the contents of this report in your next post.

Step 3

Security Check

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED! try rebooting the system and then run SecurityCheck again.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Items I need to see in your next post:

• Did the uninstall go ok?
• OTL fix log
• Security Check log
  Is Spyhunter still showing at all?

[L1nd@]

Good Afternoon just to let you know what is happening with the laptop today incase it changes the fix........Spy Hunter seems to have gone in its place I am now back to the popups asking me to do surveys and that my laptop is running slow and to leave a phone number so that they can ring me ( I have not responded to these ) also my inbox tray has flashed and asked me to download a programme to make it work faster. Should I still do the fix above are is there now something else I should be doing?? thought I better ask rather than just go ahead Thankyou 

[ruggie_uk]

Please go ahead. We will perform a full clean up as we go along as well.

Once this section is concluded we will scan again with alternative utilities and make sure your computer is fully clean.

There is some malware that I have already identified and is in th efix above so it may well be the source of your current issue.

[L1nd@]

All processes killed

========== COMMANDS ==========

Restore point Set: OTL Restore Point

========== OTL ==========

Service SpyHunter 4 Service stopped successfully!

Service SpyHunter 4 Service deleted successfully!

C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe moved successfully.

Error: Unable to stop service Zoqctjxcdc!

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Zoqctjxcdc deleted successfully.

C:\ProgramData\EKAfRti\Zoqctjxcdc.exe moved successfully.

Service esgiguard stopped successfully!

Service esgiguard deleted successfully!

C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys moved successfully.

Service EsgScanner stopped successfully!

Service EsgScanner deleted successfully!

C:\Windows\SysNative\drivers\EsgScanner.sys moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SoftonicAssistant not found.

File C:\Users\User\AppData\Local\SoftonicAssistant\SoftonicAssistant.exe not found.

C:\ProgramData\Spybot - Search & Destroy\Quarantine folder moved successfully.

C:\ProgramData\Spybot - Search & Destroy\Logs folder moved successfully.

C:\ProgramData\Spybot - Search & Destroy\Cleaning folder moved successfully.

C:\ProgramData\Spybot - Search & Destroy folder moved successfully.

C:\Program Files\Enigma Software Group\SpyHunter\mon folder moved successfully.

C:\Program Files\Enigma Software Group\SpyHunter\Log folder moved successfully.

C:\Program Files\Enigma Software Group\SpyHunter\Downloads folder moved successfully.

C:\Program Files\Enigma Software Group\SpyHunter\defs folder moved successfully.

C:\Program Files\Enigma Software Group\SpyHunter\Data folder moved successfully.

C:\Program Files\Enigma Software Group\SpyHunter folder moved successfully.

C:\Program Files\Enigma Software Group folder moved successfully.

Folder move failed. C:\ProgramData\EKAfRti\dat scheduled to be moved on reboot.

Folder move failed. C:\ProgramData\EKAfRti scheduled to be moved on reboot.

Folder C:\Users\User\AppData\Local\SoftonicAssistant\ not found.

C:\Users\User\AppData\Roaming\Enigma Software Group folder moved successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: User

->Temp folder emptied: 8149782 bytes

->Temporary Internet Files folder emptied: 2796147 bytes

->Java cache emptied: 0 bytes

->Google Chrome cache emptied: 371399741 bytes

->Flash cache emptied: 523 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 4871085 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 369.00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 01082015_150945

 

Files\Folders moved on Reboot...

C:\ProgramData\EKAfRti\dat folder moved successfully.

C:\ProgramData\EKAfRti folder moved successfully.

C:\Users\User\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

File move failed. C:\Windows\temp\Low\SkypeClickToCall\Logs\AutoUpdateSvc.log scheduled to be moved on reboot.

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

 

 Results of screen317's Security Check version 0.99.93  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

Kaspersky Internet Security   

 Antivirus up to date!   

`````````Anti-malware/Other Utilities Check:````````` 

 Java 8 Update 25  

 Java version 32-bit out of Date! 

 Adobe Reader XI  

 Google Chrome (39.0.2171.71) 

 Google Chrome (39.0.2171.95) 

````````Process Check: objlist.exe by Laurent````````  

 Kaspersky Lab Kaspersky Internet Security 15.0.1 avp.exe  

 Kaspersky Lab Kaspersky Internet Security 15.0.1 avpui.exe  

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 6% 

````````````````````End of Log`````````````````````` 

 

[ruggie_uk]

That's great - how is the pc behaving at the moment?

[L1nd@]

seems to be ok thankyou not sure if the popups will come back yet time will tell

[ruggie_uk]

Good to hear - we will check a few other areas and see what may be lingering, in my next post.

[L1nd@]

Just to let you know know popups