[JustKay]

 Just a few days ago I suddenly started noticing sexual pop up ads popping up every time i surfed the net and refresh a page. The only web-sites these ads do not show up on is http sites, like facebook and twitter and main search pages like google, bing, Yahoo, etc. Ugh! iv tried everything. I did a virus scan in safe mode and in regular mode but it showed up nothing. I reinstalled another spyware program after uninstalling my old anti virus and did a scan but it found nothing as well. I also rolled my computer back to an earlier time before I got this malware but that didn't help either. Finally last night i restored my laptop back to factory settings, but the crap is STILL there. What can I do? by the way my laptop is an

 

Hp compaq 6910

 

it runs windows 7.

 

 

[Advertisements]

Hello, JustKay. My nickname is Nevan and I will be helping you getting your system back on its electronic feet.

Before we get started, please keep these things in mind:

• Always read every part of my post carefully. If you don't, you may do something wrong and there could be more problems to solve.
• If your security programs give you any warnings when using tools I asked you to, don't be afraid. Every tool I provide to you is 100% safe.
• Only run tools that I ask you to. Some of them can be dangerous to your system as they have much power.
• You should save or print my instructions. It is possible that we will be using Safe mode, which will cut you off from your internet connection and without access to them, you might be stuck.
• Malware removal is a complicated process that takes multiple steps to be completed. Don't give up, be patient.
• The tools we are going to use and your software may cause unwanted interactions. Because of that, I recommend you to make backups of any important files from your machine before proceeding as they might be lost.
• I recommend you to stay with me until I tell you that we are done. It is important because when your system does not show any bad symptoms anymore it does not mean that it is 100% clean.
• Your time to reply is limited. If you don't reply within 3 days, your topic will be closed and you will have to request it to be reopened by contacting one of Moderator group members with the link to this topic.
• Every program I ask you to download should be saved to and run from desktop. If you don't know how to choose the direction of where a download is saved, check this site. You can also just copy these programs to your desktop manually and then run them from there.
• Remember that the fixes I give you are only for your machine. Using it on other systems may (and probably will) cause problems.
• Finally, if you have any questions or are unsure about something, just ask. I will not blame you for it. It is better to ask rather than regret it later.

Also, please note that I'm currently in training, so my answers to you will have to be checked first by an experienced helper before I can post them. This can lengthen the time between my answers to you, but in return you will have an extra person reviewing your log.

Let's get started

 
First, I'd like to have a look at your system. Please, do the following:

FRST Scan

Download Farbar Recovery Scan Tool and save it to your Desktop. There are two different versions:

• Click here to download the 32-bit version.
• Click here to download the 64-bit version.

If you don't know which version you should use, download one of them and check if it's working or not. If it doesn't, download the second one. Once you have the right one, perform the instructions below.

• Right click FRST.exe (or FRST64.exe) and click Run as administrator. When the tool opens click Yes to disclaimer.
• Make sure that Addition.txt is checked and press the Scan button.
• It will produce two logs - one called FRST.txt and another one called Addition.txt in the same directory the tool is run from.
• Select all (CTRL+A) the content of the logs, copy them (CTRL+C) and paste (CTRL+V) them into your next reply.

 
Things that should appear in your next post:

• FRST.txt log content
• Addition.txt log content

[Nevan]

Hello, JustKay. My nickname is Nevan and I will be helping you getting your system back on its electronic feet.

Before we get started, please keep these things in mind:

• Always read every part of my post carefully. If you don't, you may do something wrong and there could be more problems to solve.
• If your security programs give you any warnings when using tools I asked you to, don't be afraid. Every tool I provide to you is 100% safe.
• Only run tools that I ask you to. Some of them can be dangerous to your system as they have much power.
• You should save or print my instructions. It is possible that we will be using Safe mode, which will cut you off from your internet connection and without access to them, you might be stuck.
• Malware removal is a complicated process that takes multiple steps to be completed. Don't give up, be patient.
• The tools we are going to use and your software may cause unwanted interactions. Because of that, I recommend you to make backups of any important files from your machine before proceeding as they might be lost.
• I recommend you to stay with me until I tell you that we are done. It is important because when your system does not show any bad symptoms anymore it does not mean that it is 100% clean.
• Your time to reply is limited. If you don't reply within 3 days, your topic will be closed and you will have to request it to be reopened by contacting one of Moderator group members with the link to this topic.
• Every program I ask you to download should be saved to and run from desktop. If you don't know how to choose the direction of where a download is saved, check this site. You can also just copy these programs to your desktop manually and then run them from there.
• Remember that the fixes I give you are only for your machine. Using it on other systems may (and probably will) cause problems.
• Finally, if you have any questions or are unsure about something, just ask. I will not blame you for it. It is better to ask rather than regret it later.

Also, please note that I'm currently in training, so my answers to you will have to be checked first by an experienced helper before I can post them. This can lengthen the time between my answers to you, but in return you will have an extra person reviewing your log.

Let's get started

 
First, I'd like to have a look at your system. Please, do the following:

FRST Scan

Download Farbar Recovery Scan Tool and save it to your Desktop. There are two different versions:

• Click here to download the 32-bit version.
• Click here to download the 64-bit version.

If you don't know which version you should use, download one of them and check if it's working or not. If it doesn't, download the second one. Once you have the right one, perform the instructions below.

• Right click FRST.exe (or FRST64.exe) and click Run as administrator. When the tool opens click Yes to disclaimer.
• Make sure that Addition.txt is checked and press the Scan button.
• It will produce two logs - one called FRST.txt and another one called Addition.txt in the same directory the tool is run from.
• Select all (CTRL+A) the content of the logs, copy them (CTRL+C) and paste (CTRL+V) them into your next reply.

 
Things that should appear in your next post:

• FRST.txt log content
• Addition.txt log content

[JustKay]

Ok  I hope i did this right. First time i tired my anit virus said ti was infected and deleted it so i then disabled my anti virus and it worked teh second time.

 

********

 

first text log

 

****

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:28-08-2015

Ran by moon (administrator) on MOON-PC (28-08-2015 20:45:58)

Running from C:\Users\moon\Downloads

Loaded Profiles: moon (Available Profiles: moon)

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) Language: English (United States)

Internet Explorer Version 8 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

(Intel Corporation) C:\Program Files\Intel\AMT\atchksrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe

(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe

(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe

(Visicom Media Inc.) C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe

(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe

(Intel Corporation) C:\Program Files\Intel\AMT\UNS.exe

( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Program Files\Intel\AMT\atchk.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe

(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe

( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [QlbCtrl.exe] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2010-02-25] ( Hewlett-Packard Development Company, L.P.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1791272 2010-06-04] (Synaptics Incorporated)

HKLM\...\Run: [atchk] => C:\Program Files\Intel\AMT\atchk.exe [408088 2008-05-25] (Intel Corporation)

HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [116040 2008-07-22] (Apple Inc.)

HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [413696 2008-05-27] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [289064 2008-07-30] (Apple Inc.)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM\...\Run: [SoundMAXPnP] => C:\Program Files\Analog Devices\Core\smax4pnp.exe [1183744 2007-02-21] (Analog Devices, Inc.)

HKLM\...\Run: [PSUAMain] => C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe [54520 2015-07-28] (Panda Security, S.L.)

HKU\S-1-5-21-3543589704-2342267129-4126857868-1001\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKU\S-1-5-21-3543589704-2342267129-4126857868-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://pandasecurity.mystart.com/?pr=vmn&id=pandasecuritytb&v=4_3&utm_campaign=671&idate=2015-08-28&ent=hp_671&u=AFC8A9D592AFEA2A2FC80155E0B3DCED

HKU\S-1-5-21-3543589704-2342267129-4126857868-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

URLSearchHook: [S-1-5-21-3543589704-2342267129-4126857868-1001] ATTENTION => Default URLSearchHook is missing

URLSearchHook: HKU\S-1-5-21-3543589704-2342267129-4126857868-1001 - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files\pandasecuritytb\pandasecurityDx.dll ()

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2012-11-16] (Oracle Corporation)

BHO: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files\pandasecuritytb\pandasecurityDx.dll [2015-05-27] ()

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-11-16] (Oracle Corporation)

Toolbar: HKLM - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files\pandasecuritytb\pandasecurityDx.dll [2015-05-27] ()

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [147456 2007-07-24] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 93.158.216.105 8.8.8.8

Tcpip\..\Interfaces\{EC278819-03CF-4709-B7F4-0256EC054F81}: [DhcpNameServer] 93.158.216.105 8.8.8.8

 

FireFox:

========

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2008-07-30] ()

FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll [2012-11-16] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2012-11-16] (Oracle Corporation)

FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-28] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-28] (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)

 

Chrome: 

=======

CHR Profile: C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-08-27]

CHR Extension: (Google Docs) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-08-27]

CHR Extension: (Google Drive) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-08-27]

CHR Extension: (YouTube) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-08-27]

CHR Extension: (Google Search) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-08-27]

CHR Extension: (Google Sheets) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-08-27]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-08-27]

CHR Extension: (Panda Security on MyStart) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkhenjnndhepemgkiblghfminjdmbkdf [2015-08-28]

CHR Extension: (Chrome Web Store Payments) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-27]

CHR Extension: (Gmail) - C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-27]

CHR HKLM\...\Chrome\Extension: [lkhenjnndhepemgkiblghfminjdmbkdf] - https://clients2.goo...ice/update2/crx

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [116040 2008-07-22] (Apple Inc.)

R2 atchksrv; C:\Program Files\Intel\AMT\atchksrv.exe [182808 2008-05-25] (Intel Corporation)

R2 Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [229376 2007-07-24] (Apple Inc.) [File not signed]

R2 NanoServiceMain; C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe [142072 2015-07-29] (Panda Security, S.L.)

R2 PandaAgent; C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe [73464 2015-07-23] (Panda Security, S.L.)

R2 panda_url_filtering; C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe [279560 2015-05-19] (Visicom Media Inc.)

R2 PSUAService; C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe [38136 2015-07-28] (Panda Security, S.L.)

R2 UNS; C:\Program Files\Intel\AMT\UNS.exe [1464856 2008-05-25] (Intel Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)

R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [87032 2015-07-09] (Panda Security, S.L.)

R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [202104 2015-07-09] (Panda Security, S.L.)

R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [109688 2015-07-09] (Panda Security, S.L.)

R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [121720 2015-07-09] (Panda Security, S.L.)

R1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [50992 2015-05-20] (Panda Security, S.L.)

R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [102264 2015-07-09] (Panda Security, S.L.)

R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [64760 2015-07-09] ()

R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [120568 2015-07-09] (Panda Security, S.L.)

R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [281720 2015-07-09] (Panda Security, S.L.)

R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [209016 2015-07-09] (Panda Security, S.L.)

R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [108408 2015-07-09] (Panda Security, S.L.)

R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [240376 2015-07-09] (Panda Security, S.L.)

R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [94968 2015-07-09] (Panda Security, S.L.)

R3 panda_url_filteringd; C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys [40024 2014-02-18] (Visicom Media Inc.)

R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [140024 2015-07-19] (Panda Security, S.L.)

R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [105208 2015-07-19] (Panda Security, S.L.)

R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [168696 2015-07-19] (Panda Security, S.L.)

R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [113912 2015-07-19] (Panda Security, S.L.)

R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [124664 2015-07-19] (Panda Security, S.L.)

R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [100600 2015-07-19] (Panda Security, S.L.)

U3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50832 2015-05-22] (Panda Security, S.L.)

S3 RICOH SmartCard Reader; C:\Windows\System32\DRIVERS\rismc32.sys [49152 2009-07-20] (RICOH Company, Ltd.)

S3 risdpcie; C:\Windows\system32\drivers\risdpe86.sys [49152 2009-06-30] (REDC)

R3 rismc32; C:\Windows\System32\DRIVERS\rismc32.sys [49152 2009-07-20] (RICOH Company, Ltd.)

S3 rixdpcie; C:\Windows\system32\drivers\rixdpe86.sys [38400 2009-07-04] (REDC)

U4 eabfiltr; no ImagePath

S3 HSF_DPV; system32\DRIVERS\HSX_DPV.sys [X]

S3 HSXHWAZL; system32\DRIVERS\HSXHWAZL.sys [X]

S2 mdmxsdk; system32\DRIVERS\mdmxsdk.sys [X]

S3 winachsf; system32\DRIVERS\HSX_CNXT.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-08-28 20:45 - 2015-08-28 20:46 - 00013512 _____ C:\Users\moon\Downloads\FRST.txt

2015-08-28 20:45 - 2015-08-28 20:46 - 00000000 ____D C:\FRST

2015-08-28 20:45 - 2015-08-28 20:45 - 01690624 _____ (Farbar) C:\Users\moon\Downloads\FRST.exe

2015-08-28 20:10 - 2015-05-22 03:45 - 00050832 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys

2015-08-28 14:23 - 2015-08-28 14:23 - 00001251 _____ C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk

2015-08-28 14:22 - 2015-08-28 14:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security

2015-08-28 14:16 - 2015-08-28 20:08 - 00000000 ____D C:\ProgramData\panda_url_filtering

2015-08-28 14:16 - 2015-08-28 14:16 - 00000000 ____D C:\Users\moon\AppData\Roaming\Panda Security

2015-08-28 14:16 - 2015-08-28 14:16 - 00000000 ____D C:\ProgramData\Panda Security URL Filtering

2015-08-28 14:16 - 2015-08-28 14:16 - 00000000 ____D C:\Program Files\pandasecuritytb

2015-08-28 14:15 - 2015-08-28 14:22 - 00000000 ____D C:\Program Files\Panda Security

2015-08-28 14:15 - 2015-08-28 14:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Antivirus Pro 2016

2015-08-28 14:13 - 2015-08-28 14:16 - 00000000 ____D C:\ProgramData\Panda Security

2015-08-28 14:12 - 2015-08-28 14:12 - 01726800 _____ C:\Users\moon\Downloads\PANDAAP16.exe

2015-08-28 13:40 - 2015-08-28 13:40 - 00001118 _____ C:\Users\Public\Desktop\Yahoo! Messenger.lnk

2015-08-28 13:40 - 2015-08-28 13:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger

2015-08-28 13:38 - 2015-08-28 13:38 - 00691576 _____ (Yahoo! Inc.) C:\Users\moon\Downloads\msgr11us.exe

2015-08-28 13:36 - 2015-08-28 13:36 - 00002212 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-08-28 13:36 - 2015-08-28 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-08-28 13:35 - 2015-08-28 20:40 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-08-28 13:35 - 2015-08-28 20:10 - 00000878 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-08-28 13:19 - 2014-05-14 11:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-08-28 13:19 - 2014-05-14 11:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-08-28 13:19 - 2014-05-14 11:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-08-28 13:19 - 2014-05-14 11:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2015-08-28 13:19 - 2014-05-14 11:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2015-08-28 13:19 - 2014-05-14 11:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-08-28 13:19 - 2014-05-14 11:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-08-28 13:18 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-08-28 13:18 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-08-28 13:16 - 2015-08-28 13:16 - 00001424 _____ C:\Users\moon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-08-28 12:49 - 2015-08-28 12:49 - 00000000 ____D C:\Users\moon\AppData\Local\WindowsUpdate

2015-08-28 10:51 - 2015-08-28 10:51 - 00000000 ____D C:\ProgramData\BitDefender

2015-08-28 10:46 - 2015-08-28 10:46 - 00000000 ____D C:\Users\moon\AppData\Roaming\LavasoftStatistics

2015-08-28 10:46 - 2015-08-28 10:46 - 00000000 ____D C:\searchplugins

2015-08-28 10:45 - 2015-08-28 10:57 - 00000000 ____D C:\Users\moon\AppData\Roaming\Lavasoft

2015-08-28 10:44 - 2015-08-28 13:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft

2015-08-28 10:42 - 2015-08-28 10:45 - 00000000 ____D C:\Program Files\Lavasoft

2015-08-28 10:39 - 2015-08-28 10:39 - 00000000 ____D C:\Program Files\Common Files\Lavasoft

2015-08-28 10:38 - 2015-08-28 10:45 - 00000000 ____D C:\ProgramData\Lavasoft

2015-08-28 00:23 - 2012-11-16 14:39 - 00000000 ____D C:\Users\Default\AppData\Local\Apple Computer

2015-08-28 00:23 - 2012-11-16 14:39 - 00000000 ____D C:\Users\Default User\AppData\Local\Apple Computer

2015-08-28 00:23 - 2012-11-16 14:34 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia

2015-08-28 00:23 - 2012-11-16 14:34 - 00000000 ____D C:\Users\Default\AppData\Roaming\Adobe

2015-08-28 00:23 - 2012-11-16 14:34 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia

2015-08-28 00:23 - 2012-11-16 14:34 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Adobe

2015-08-28 00:23 - 2012-11-16 14:31 - 00000000 ____D C:\Users\Default\AppData\Roaming\Apple Computer

2015-08-28 00:23 - 2012-11-16 14:31 - 00000000 ____D C:\Users\Default\AppData\Local\Apple

2015-08-28 00:23 - 2012-11-16 14:31 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Apple Computer

2015-08-28 00:23 - 2012-11-16 14:31 - 00000000 ____D C:\Users\Default User\AppData\Local\Apple

2015-08-28 00:23 - 2012-11-16 14:22 - 00000000 ____D C:\Users\Default\AppData\Roaming\Roxio Log Files

2015-08-28 00:23 - 2012-11-16 14:22 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Roxio Log Files

2015-08-28 00:23 - 2012-11-16 14:09 - 00057560 _____ C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT

2015-08-28 00:23 - 2012-11-16 14:09 - 00057560 _____ C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT

2015-08-28 00:23 - 2012-11-16 14:09 - 00000000 _____ C:\Users\Default\AppData\Local\QSwitch.txt

2015-08-28 00:23 - 2012-11-16 14:09 - 00000000 _____ C:\Users\Default\AppData\Local\DSwitch.txt

2015-08-28 00:23 - 2012-11-16 14:09 - 00000000 _____ C:\Users\Default\AppData\Local\AtStart.txt

2015-08-28 00:23 - 2012-11-16 14:09 - 00000000 _____ C:\Users\Default User\AppData\Local\QSwitch.txt

2015-08-28 00:23 - 2012-11-16 14:09 - 00000000 _____ C:\Users\Default User\AppData\Local\DSwitch.txt

2015-08-28 00:23 - 2012-11-16 14:09 - 00000000 _____ C:\Users\Default User\AppData\Local\AtStart.txt

2015-08-28 00:22 - 2015-08-28 20:15 - 01313835 _____ C:\Windows\WindowsUpdate.log

2015-08-27 22:30 - 2015-08-28 14:16 - 00064040 _____ C:\Users\moon\AppData\Local\GDIPFONTCACHEV1.DAT

2015-08-27 22:30 - 2015-08-28 13:15 - 00000000 ____D C:\Users\moon

2015-08-27 22:30 - 2015-08-27 22:30 - 00000000 __SHD C:\Recovery

2015-08-27 22:30 - 2015-08-27 21:51 - 00000000 ____D C:\Users\moon\AppData\Local\VirtualStore

2015-08-27 22:30 - 2012-11-16 14:39 - 00000000 ____D C:\Users\moon\AppData\Local\Apple Computer

2015-08-27 22:30 - 2012-11-16 14:34 - 00000000 ____D C:\Users\moon\AppData\Roaming\Macromedia

2015-08-27 22:30 - 2012-11-16 14:34 - 00000000 ____D C:\Users\moon\AppData\Roaming\Adobe

2015-08-27 22:30 - 2012-11-16 14:31 - 00000000 ____D C:\Users\moon\AppData\Roaming\Apple Computer

2015-08-27 22:30 - 2012-11-16 14:31 - 00000000 ____D C:\Users\moon\AppData\Local\Apple

2015-08-27 22:30 - 2012-11-16 14:22 - 00000000 ____D C:\Users\moon\AppData\Roaming\Roxio Log Files

2015-08-27 22:30 - 2012-11-16 14:13 - 00000000 ____D C:\Users\moon\AppData\Roaming\hpqLog

2015-08-27 22:30 - 2012-11-16 14:09 - 00000000 _____ C:\Users\moon\AppData\Local\QSwitch.txt

2015-08-27 22:30 - 2012-11-16 14:09 - 00000000 _____ C:\Users\moon\AppData\Local\DSwitch.txt

2015-08-27 22:30 - 2012-11-16 14:09 - 00000000 _____ C:\Users\moon\AppData\Local\AtStart.txt

2015-08-27 22:30 - 2010-11-20 15:57 - 00000020 ___SH C:\Users\moon\ntuser.ini

2015-08-27 22:30 - 2009-07-13 23:42 - 00000000 ___RD C:\Users\moon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-27 22:30 - 2009-07-13 23:37 - 00000000 ___RD C:\Users\moon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-08-27 21:51 - 2015-08-27 21:51 - 00000000 ____D C:\Users\moon\AppData\Roaming\Yahoo!

2015-08-27 21:48 - 2015-08-28 13:40 - 00000000 ____D C:\ProgramData\Yahoo!

2015-08-27 21:47 - 2015-08-28 13:40 - 00000000 ____D C:\Program Files\Yahoo!

2015-08-27 21:39 - 2015-08-28 13:35 - 00000000 ____D C:\Program Files\Google

2015-08-27 21:39 - 2015-08-28 13:34 - 00000000 ____D C:\Users\moon\AppData\Local\Deployment

2015-08-27 21:39 - 2015-08-28 13:34 - 00000000 ____D C:\Users\moon\AppData\Local\Apps\2.0

2015-08-27 21:39 - 2015-08-27 21:40 - 00000000 ____D C:\Users\moon\AppData\Local\Google

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-08-28 20:39 - 2012-11-16 14:34 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-08-28 20:16 - 2010-11-20 16:01 - 00713888 _____ C:\Windows\system32\PerfStringBackup.INI

2015-08-28 20:09 - 2009-07-13 23:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-08-28 20:09 - 2009-07-13 23:39 - 00034996 _____ C:\Windows\setupact.log

2015-08-28 20:08 - 2009-07-13 23:34 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-08-28 20:08 - 2009-07-13 23:34 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-08-28 14:38 - 2010-11-20 16:48 - 00009322 _____ C:\Windows\PFRO.log

2015-08-28 14:38 - 2009-07-13 23:33 - 00324008 _____ C:\Windows\system32\FNTCACHE.DAT

2015-08-28 13:42 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\system32\LogFiles

2015-08-28 13:39 - 2012-11-16 14:34 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2015-08-28 13:39 - 2012-11-16 14:34 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2015-08-28 13:15 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\system32\wfp

2015-08-28 13:14 - 2012-11-16 14:34 - 00000000 ____D C:\Windows\system32\Macromed

2015-08-28 13:14 - 2011-04-11 21:24 - 00000000 ___RD C:\Users\Public\Recorded TV

2015-08-28 13:14 - 2009-07-13 21:37 - 00000000 __RHD C:\Users\Public\Libraries

2015-08-28 13:14 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\registration

2015-08-28 13:13 - 2012-11-16 14:31 - 00000000 ____D C:\Program Files\QuickTime

2015-08-28 00:27 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\rescache

2015-08-28 00:23 - 2012-11-16 17:44 - 00003652 _____ C:\Windows\TSSysprep.log

2015-08-28 00:23 - 2009-07-13 21:37 - 00000000 __RHD C:\Users\Default

2015-08-28 00:23 - 2009-07-13 21:37 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-28 00:22 - 2012-11-16 14:06 - 00000000 ____D C:\Program Files\Analog Devices

2015-08-28 00:21 - 2012-11-16 14:05 - 00000000 ____D C:\Windows\QLB

2015-08-28 00:19 - 2009-07-13 23:34 - 00003806 _____ C:\Windows\DtcInstall.log

2015-08-27 22:32 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\system32\NDF

2015-08-27 22:30 - 2012-11-16 17:42 - 00000000 ____D C:\Windows\Panther

2015-08-27 22:30 - 2009-07-13 23:52 - 00000000 ____D C:\Windows\system32\restore

2015-08-27 22:30 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\system32\Recovery

 

==================== Files in the root of some directories =======

 

2015-08-27 22:30 - 2012-11-16 14:09 - 0000000 _____ () C:\Users\moon\AppData\Local\AtStart.txt

2015-08-27 22:30 - 2012-11-16 14:09 - 0000000 _____ () C:\Users\moon\AppData\Local\DSwitch.txt

2015-08-27 22:30 - 2012-11-16 14:09 - 0000000 _____ () C:\Users\moon\AppData\Local\QSwitch.txt

 

Some files in TEMP:

====================

C:\Users\moon\AppData\Local\Temp\{253F11A4-5FB8-4CCD-AB02-E8F76A0B0B4E}.exe

 

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2012-11-16 17:43

 

==================== End of FRST.txt ============================

 

 

 

 

ADDITIONAL TEXT

 

***

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version:28-08-2015

Ran by moon (2015-08-28 20:46:37)

Running from C:\Users\moon\Downloads

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-3543589704-2342267129-4126857868-500 - Administrator - Disabled)

Guest (S-1-5-21-3543589704-2342267129-4126857868-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3543589704-2342267129-4126857868-1002 - Limited - Enabled)

moon (S-1-5-21-3543589704-2342267129-4126857868-1001 - Administrator - Enabled) => C:\Users\moon

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Panda Antivirus Pro 2016 (Disabled - Up to date) {AAF74A68-8713-CDF1-004F-30003398BE9E}

AS: Panda Antivirus Pro 2016 (Disabled - Up to date) {1196AB8C-A129-C27F-3AFF-0B72481FF423}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Panda Firewall (Enabled) {92CCCB4D-CD7C-CCA9-2B10-9935CD4BF9E5}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)

Adobe Reader XI (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)

Apple Mobile Device Support (HKLM\...\{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}) (Version: 2.0.1.5 - Apple Inc.)

Apple Software Update (HKLM\...\{02DFF6B1-1654-411C-8D7B-FD6052EF016F}) (Version: 2.1.0.110 - Apple Inc.)

Bonjour (HKLM\...\{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}) (Version: 1.0.104 - Apple Inc.)

Google Chrome (HKLM\...\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)

Google Update Helper (Version: 1.3.28.13 - Google Inc.) Hidden

HP Quick Launch Buttons (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.50.17.1 - Hewlett-Packard Company)

Intel® Active Management Technology Device Software (HKLM\...\MESOL) (Version:  - )

Intel® Management Engine Interface (HKLM\...\HECI) (Version:  - )

Intel® TV Wizard (HKLM\...\TVWiz) (Version:  - Intel Corporation)

iTunes (HKLM\...\{3DE0053C-FD9A-483E-B7C9-B06E4392206E}) (Version: 7.7.1.11 - Apple Inc.)

Java 7 Update 9 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

NetZero Preloader (HKLM\...\{352310C3-E46B-42D3-8F32-54721FDD72D9}) (Version: 1.0.0 - NetZero, Inc.)

OpenOffice.org 3.4.1 (HKLM\...\{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}) (Version: 3.41.9593 - Apache Software Foundation)

Panda Antivirus Pro 2016 (HKLM\...\Panda Universal Agent Endpoint) (Version: 16.00.01.0000 - Panda Security)

Panda Antivirus Pro 2016 (Version: 8.03.00.0000 - Panda Security) Hidden

Panda Cloud Cleaner (HKLM\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.107 - Panda Security)

Panda Devices Agent (Version: 1.03.05 - Panda Security) Hidden

Panda Devices Agent (Version: 1.06.00 - Panda Security) Hidden

Panda Security Toolbar (HKLM\...\pandasecuritytb) (Version: 4.3.0.3 - Panda Security and Visicom Media Inc.)

QLBCASL (Version: 6.40.17.2 - Hewlett-Packard) Hidden

QuickTime (HKLM\...\{08CA9554-B5FE-4313-938F-D4A417B81175}) (Version: 7.50.61.0 - Apple Inc.)

RICOH Media Driver (HKLM\...\{F5CC2EF8-20A4-4366-A681-3FE849E65809}) (Version: 2.10.00.04 - RICOH)

Roxio Creator DE 10.3 (HKLM\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.3 - Roxio)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)

Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== Restore Points =========================

 

27-08-2015 22:30:38 Windows Update

28-08-2015 10:38:37 AA11

28-08-2015 13:11:49 Restore Operation

28-08-2015 13:18:36 Windows Update

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 21:04 - 2009-06-10 16:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {2384C780-7D02-4A21-97A9-1479C06B7368} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-28] (Adobe Systems Incorporated)

Task: {24FF3934-3DCC-4FB5-8D32-D218BA433C4D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11] (Apple Inc.)

Task: {430D19D8-C289-4A72-A8DB-10C4CA815192} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

Task: {55D60D2B-86ED-424A-B180-48440D1DB62C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

Task: {B314610A-0F57-46D8-B93F-5DA82195FF42} - System32\Tasks\Microsoft\Windows\SetupSQMTask => C:\Windows\SYSTEM32\OOBE\SETUPSQM.EXE [2010-11-20] (Microsoft Corporation)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (Whitelisted) ==============

 

2013-04-12 12:23 - 2013-04-12 12:23 - 00612664 _____ () C:\Program Files\Panda Security\Panda Security Protection\SQLite3.dll

2015-08-28 13:58 - 2014-02-10 13:44 - 04592128 _____ () C:\Users\moon\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll

2015-08-28 13:58 - 2014-02-10 13:44 - 00112128 _____ () C:\Users\moon\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll

2015-08-28 13:36 - 2015-08-18 00:23 - 16393032 _____ () C:\Program Files\Google\Chrome\Application\44.0.2403.157\PepperFlash\pepflashplayer.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

 

==================== EXE Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-3543589704-2342267129-4126857868-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\moon\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 93.158.216.105 - 8.8.8.8

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is disabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{A17AF945-DC37-4D29-9DBB-FCA8D6B1733E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{9005C965-BA08-4D5C-9E10-6CF4593C69CE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7178515F-30EC-4214-BA03-717B1BA8C0DB}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{4988AD7B-2A42-46A0-865E-64D2837D5159}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{5DF881C4-E032-4A73-B878-C9FFF147C2BD}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

FirewallRules: [{D3F04678-5069-4707-AC90-23F86F3C5175}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{048DA674-4DA8-4B7A-B13C-AD4DC278D08F}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{C3D19D2B-F94F-489C-8224-0D9A9D068696}] => (Allow) C:\Program Files\pandasecuritytb\dtuser.exe

FirewallRules: [{13BDBA59-776E-4E3B-B4F5-84F121B27FA7}] => (Allow) C:\Program Files\pandasecuritytb\dtuser.exe

FirewallRules: [{320F6494-02E1-4EF9-ACDC-1675BA43344C}] => (Allow) C:\Program Files\pandasecuritytb\ToolbarCleaner.exe

FirewallRules: [{54490697-A561-47BB-A5B2-48D8BCA935E3}] => (Allow) C:\Program Files\pandasecuritytb\ToolbarCleaner.exe

 

==================== Faulty Device Manager Devices =============

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (08/28/2015 08:10:47 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/28/2015 02:39:15 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/28/2015 01:16:53 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/28/2015 10:55:10 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/28/2015 09:26:02 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/27/2015 09:36:38 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (08/27/2015 09:36:38 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (08/27/2015 10:32:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (08/27/2015 10:30:51 PM) (Source: ESENT) (EventID: 215) (User: )

Description: WinMail (3456) WindowsMail0: The backup has been stopped because it was halted by the client or the connection with the client failed.

 

Error: (08/28/2015 12:27:11 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

 

System errors:

=============

Error: (08/28/2015 08:12:44 PM) (Source: DCOM) (EventID: 10000) (User: )

Description: C:\Windows\system32\igfxsrvc.exe -Embedding2{078AEF33-C48A-49F7-AFF3-A0EE810BFE7C}

 

Error: (08/28/2015 01:21:19 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {73C9DFA0-750D-11E1-B0C4-0800200C9A66}

 

Error: (08/28/2015 01:18:00 PM) (Source: DCOM) (EventID: 10000) (User: )

Description: C:\Windows\system32\igfxsrvc.exe -Embedding2{078AEF33-C48A-49F7-AFF3-A0EE810BFE7C}

 

Error: (08/28/2015 12:52:27 PM) (Source: DCOM) (EventID: 10000) (User: )

Description: C:\Windows\system32\igfxsrvc.exe -Embedding2{078AEF33-C48A-49F7-AFF3-A0EE810BFE7C}

 

Error: (08/28/2015 10:56:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )

Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the LavasoftTcpService service, but this action failed with the following error: 

%%1056

 

Error: (08/28/2015 10:55:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The LavasoftTcpService service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

 

Error: (08/28/2015 10:35:33 AM) (Source: cdrom) (EventID: 15) (User: )

Description: The device, \Device\CdRom0, is not ready for access yet.

 

Error: (08/27/2015 09:37:25 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {73C9DFA0-750D-11E1-B0C4-0800200C9A66}

 

Error: (08/27/2015 10:31:56 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The Windows Search service hung on starting.

 

Error: (11/16/2012 02:42:32 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {9E175B6D-F52A-11D8-B9A5-505054503030}

 

 

Microsoft Office:

=========================

Error: (08/28/2015 08:10:47 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/28/2015 02:39:15 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/28/2015 01:16:53 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/28/2015 10:55:10 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/28/2015 09:26:02 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (08/27/2015 09:36:38 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: http://www.download....uthrootstl.cabArequired certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

 

Error: (08/27/2015 09:36:38 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: http://www.download....uthrootstl.cabArequired certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

 

Error: (08/27/2015 10:32:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: http://www.download....uthrootstl.cabArequired certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

 

Error: (08/27/2015 10:30:51 PM) (Source: ESENT) (EventID: 215) (User: )

Description: WinMail3456WindowsMail0:

 

Error: (08/28/2015 12:27:11 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™2 Duo CPU T7500 @ 2.20GHz

Percentage of memory in use: 69%

Total physical RAM: 2015.3 MB

Available physical RAM: 623.77 MB

Total Virtual: 4030.61 MB

Available Virtual: 2305.35 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:69.24 GB) (Free:50.94 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 74.5 GB) (Disk ID: 652EEE2F)

Partition 1: (Active) - (Size=5.3 GB) - (Type=27)

Partition 2: (Not Active) - (Size=69.2 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

[Nevan]

Hello again, JustKay.

Do you have a router? I'm asking because it might be a possible source of the popups.

Please answer that question and follow the instructions below. Tell me if it helps with your problem.

Step #1
FRST Fix

• Download attached fixlist.txt file to your desktop.
   fixlist.txt   872bytes   168 downloads
  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
• Right click FRST64.exe on your desktop and click Run as administrator.
• Press the Fix button just once and wait.
  NOTE: It's important that both FRST64.exe and fixlist.txt are in the same location or the fix will not work.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished, FRST will generate a log on the desktop (Fixlog.txt). Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

 
Step #2
Junkware Removal Tool

• Download Junkware Removal Tool to your Desktop
• Close any open windows
• Disable your Antivirus program (click here if you don't know how to do this)
• Double click JRT.exe on your desktop to run it
• Click any button to start the scan
• Wait for Junkware Removal Tool to finish the scan
• When the scan is finished, JRT.txt will be saved to your desktop and it will automatically open
• Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

 
Step #3
AdwCleaner

• Download AdwCleaner to your Desktop.
• Close any open windows
• Double click AdwCleaner.exe on your desktop to run it
• Click the button
• Wait for AdwCleaner to finish the scan
• When the scan is finished, there will be "Pending. Please uncheck elements you don't want to remove" message. Leave everything as it is and click button.
• When the cleaning is finished, the program will ask you to reboot the system. Please do so.
• Once your machine has rebooted, a Notepad window will be opened. If it won't, you can find it in C:\AdwCleaner. The report will be saved as AdwCleaner[C1].txt.
• Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

Remember to enable your Antivirus program once you're done!

 
Things that should appear in your next post:

• Fixlog.txt log content
• JRT.txt log content
• AdwCleaner log content
• Answer to my question about router and your computer's state

[JustKay]

Yes I do have a router, but how could it be the source of my mal-wer issue? viruses cannot come through a router can they? *confused look* 

 

 

Um anyways im confused...that FRSTFIX program i downloaded last night are you saying i download it again? and also when i downloaded the fixlist thing it opened it on notepad and all it was was text on notepad and so im not sure what "fix" button you mean. one last thing i don't like downloading alot of stuff on my laptop and iv already installed and ran spybot on my computer today and ti found nothing; do i REALLY need both junkware cleaner and adwcleaner both? 

[Nevan]

Yes I do have a router, but how could it be the source of my mal-wer issue? viruses cannot come through a router can they? *confused look*

Yes, they can. And it is possible that it has happened in your case.
 

that FRSTFIX program i downloaded last night are you saying i download it again?

No. The first time you've downloaded a file called FRST.exe that looks like this . You have to put the fixlist.txt file in the same folder that FRST.exe is, then run FRST.exe and click the Fix button there.
 

one last thing i don't like downloading alot of stuff on my laptop and iv already installed and ran spybot on my computer today and ti found nothing; do i REALLY need both junkware cleaner and adwcleaner both?

Yes, you have to use all the tools I ask you to. This is a part of removing every visible track of infections from your system. Don't worry, we will delete all of them when we are done. I will tell you when it happens

[JustKay]

Ok i checked and that FRST.EXE file i think my computer deleted it or my anti virus did, so is it ok to disable my anti virus and then reinstall it again before i continue with the next steps?

[Nevan]

Yes, disable your Antivirus if it blocks FRST.exe. Just remember to turn if back on when you're done

[JustKay]

Ok i did all you said but sadly the junk is STILL popping up!  anyway here is the info

****************

 

fixlog.txt

 

 

******

 

 

Fix result of Farbar Recovery Scan Tool (x86) Version:30-08-2015

Ran by moon (2015-08-31 00:32:42) Run:1

Running from C:\Users\moon\Downloads

Loaded Profiles: moon (Available Profiles: moon)

Boot Mode: Normal

 

==============================================

 

fixlist content:

*****************

CloseProcesses:

CreateRestorePoint:

URLSearchHook: [S-1-5-21-3543589704-2342267129-4126857868-1001] ATTENTION => Default URLSearchHook is missing

EmptyTemp:

CMD: bitsadmin /reset /allusers

cmd: netsh advfirewall reset

cmd: netsh advfirewall set allprofiles state off

Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartupApproved" /F

Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartupApproved" /F

Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F

Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F

CMD: netsh advfirewall reset

CMD: netsh advfirewall set allprofiles state ON

CMD: ipconfig /flushdns

CMD: netsh winsock reset catalog

CMD: netsh int ip reset c:\resetlog.txt

CMD: ipconfig /release

CMD: ipconfig /renew

CMD: netsh int ipv4 reset

CMD: netsh int ipv6 reset 

*****************

 

Processes closed successfully.

Restore point was successfully created.

Could not restore Default URLSearchHook.

 

=========  bitsadmin /reset /allusers =========

 

 

BITSADMIN version 3.0 [ 7.5.7601 ]

BITS administration utility.

© Copyright 2000-2006 Microsoft Corp.

 

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.

Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

 

0 out of 0 jobs canceled.

 

========= End of CMD: =========

 

 

=========  netsh advfirewall reset =========

 

Ok.

 

 

========= End of CMD: =========

 

 

=========  netsh advfirewall set allprofiles state off =========

 

Ok.

 

 

========= End of CMD: =========

 

 

========= Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartupApproved" /F =========

 

ERROR: The system was unable to find the specified registry key or value.

 

 

========= End of Reg: =========

 

 

========= Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartupApproved" /F =========

 

The operation completed successfully.

 

 

 

========= End of Reg: =========

 

 

========= Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F =========

 

ERROR: The system was unable to find the specified registry key or value.

 

 

========= End of Reg: =========

 

 

========= Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F =========

 

The operation completed successfully.

 

 

 

========= End of Reg: =========

 

 

=========  netsh advfirewall reset =========

 

Ok.

 

 

========= End of CMD: =========

 

 

=========  netsh advfirewall set allprofiles state ON =========

 

Ok.

 

 

========= End of CMD: =========

 

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

 

=========  netsh winsock reset catalog =========

 

 

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

 

 

========= End of CMD: =========

 

 

=========  netsh int ip reset c:\resetlog.txt =========

 

Reseting Global, OK!

Reseting Interface, OK!

Restart the computer to complete this action.

 

 

========= End of CMD: =========

 

 

=========  ipconfig /release =========

 

 

Windows IP Configuration

 

No operation can be performed on Bluetooth Network Connection while it has its media disconnected.

No operation can be performed on Local Area Connection while it has its media disconnected.

 

Ethernet adapter Bluetooth Network Connection:

 

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . : 

 

Wireless LAN adapter Wireless Network Connection:

 

   Connection-specific DNS Suffix  . : 

   Link-local IPv6 Address . . . . . : fe80::ad59:397e:6b34:5fd4%13

   Default Gateway . . . . . . . . . : 

 

Ethernet adapter Local Area Connection:

 

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . : 

 

========= End of CMD: =========

 

 

=========  ipconfig /renew =========

 

 

Windows IP Configuration

 

No operation can be performed on Bluetooth Network Connection while it has its media disconnected.

No operation can be performed on Local Area Connection while it has its media disconnected.

 

Ethernet adapter Bluetooth Network Connection:

 

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . : 

 

Wireless LAN adapter Wireless Network Connection:

 

   Connection-specific DNS Suffix  . : 

   Link-local IPv6 Address . . . . . : fe80::ad59:397e:6b34:5fd4%13

   IPv4 Address. . . . . . . . . . . : 192.168.0.2

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . : 192.168.0.1

 

Ethernet adapter Local Area Connection:

 

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . : 

 

========= End of CMD: =========

 

 

=========  netsh int ipv4 reset =========

 

Reseting Interface, OK!

Restart the computer to complete this action.

 

 

========= End of CMD: =========

 

 

=========  netsh int ipv6 reset =========

 

There's no user specified settings to be reset.

 

 

========= End of CMD: =========

 

EmptyTemp: => 770.3 MB temporary data Removed.

 

 

The system needed a reboot.

 

 

 

******************

 

 

 

JRT.TXT

 

******

 

 

 

~ Services

 

 

 

~~~ Tasks

 

 

 

~~~ Registry Values

 

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3543589704-2342267129-4126857868-1001\Software\Microsoft\Internet Explorer\Main\\Start Page

 

 

 

~~~ Registry Keys

 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

Successfully deleted: [Folder] C:\Program Files\lavasoft\web companion

Successfully deleted: [Folder] C:\ProgramData\lavasoft\web companion

Successfully deleted: [Folder] C:\Users\moon\AppData\Roaming\lavasoft\web companion

 

 

 

~~~ Chrome

 

 

[C:\Users\moon\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

 

[C:\Users\moon\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

 

[C:\Users\moon\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

 

[C:\Users\moon\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

[]

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 08/31/2015 at  0:47:32.48

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

**************

 

 

 

 

ADWare CLEANER log

 

 

*****

 

 

 

# AdwCleaner v5.004 - Logfile created 31/08/2015 at 00:52:25

# Updated 26/08/2015 by Xplode

# Database : 2015-08-30.1 [Server]

# Operating system : Windows 7 Home Premium Service Pack 1 (x86)

# Username : moon - MOON-PC

# Running from : C:\Users\moon\Downloads\AdwCleaner.exe

# Option : Scan

# Support : http://toolslib.net/forum

 

***** [ Services ] *****

 

 

***** [ Folders ] *****

 

 

***** [ Files ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Scheduled tasks ] *****

 

 

***** [ Registry ] *****

 

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}

 

***** [ Web browsers ] *****

 

[C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : aol.com

[C:\Users\moon\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : ask.com

 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [889 bytes] ##########

 

 

 

[Nevan]

Hello again, JustKay.

As the previous steps didn't resolve the issue, you have to reset your router, as it is the most possible cause of your current problems.

Please reset your router. If you can't do it by yourself, tell me your router's full name and I'll try to help.

Note that once you reset your router you will have to set all settings once again (password, etc.).