Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Koobface and MPC Safe Navigation


  • Please log in to reply

#1
izzykins17

izzykins17

    Member

  • Member
  • PipPip
  • 11 posts

So I recently found out through calling Microsoft that my 2001 Dell PC is infected with the Koobface virus. Sadly, my family doesn't have the money to fix it. Is there anyway to fix it for free? Also I've been researching how to get rid of the MPC Safe Search from Firefox but nothing is working. Please help.


  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,025 posts
  • MVP

That's what we are here for.

 

 
Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer
 
NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.
 
Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).
 
scan-results.jpg
 
Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.
 
The report will be saved in the C:\AdwCleaner folder.
 
 
 
Junkware-Removal-Tool
 
Please download Junkware Removal Tool to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site
  • Pause your anti-virus.  Close all browsers.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
  •  
     
     
    Please download Farbar Recovery Scan Tool and save it to your Desktop. 
     
    Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. 
     
    •  
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer. 
  • Press Scan button. 
  • It will produce a log called FRST.txt in the same directory the tool is run from.  
  • Please copy and paste log back here. 
  • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply. 

    • 0

    #3
    izzykins17

    izzykins17

      Member

    • Topic Starter
    • Member
    • PipPip
    • 11 posts

     

    That's what we are here for.

     

     
    Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer
     
    NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.
     
    Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).
     
    <script pagespeed_no_defer="" type="text/javascript">//=d.offsetWidth&&0>=d.offsetHeight)a=!1;else{c=d.getBoundingClientRect();var f=document.body;a=c.top+("pageYOffset"in window?window.pageYOffset:(document.documentElement||f.parentNode||f).scrollTop);c=c.left+("pageXOffset"in window?window.pageXOffset:(document.documentElement||f.parentNode||f).scrollLeft);f=a.toString()+","+c;b.b.hasOwnProperty(f)?a=!1:(b.b[f]=!0,a=a<=b.e.height&&c<=b.e.width)}a&&(b.a.push(e),b.d[e]=!0)};p.prototype.checkImageForCriticality=function(b){b.getBoundingClientRect&&q(this,b)};h("pagespeed.CriticalImages.checkImageForCriticality",function(b){n.checkImageForCriticality(b)});h("pagespeed.CriticalImages.checkCriticalImages",function(){r(n)});var r=function(b){b.b={};for(var d=["IMG","INPUT"],a=[],c=0;c=a.length+e.length&&(a+=e)}b.g&&(e="&rd="+encodeURIComponent(JSON.stringify(s())),131072>=a.length+e.length&&(a+=e),d=!0);t=a;if(d){c=b.f;b=b.h;var f;if(window.XMLHttpRequest)f=new XMLHttpRequest;else if(window.ActiveXObject)try{f=new ActiveXObject("Msxml2.XMLHTTP")}catch(k){try{f=new ActiveXObject("Microsoft.XMLHTTP")}catch(u){}}f&&(f.open("POST",c+(-1==c.indexOf("?")?"?":"&")+"url="+encodeURIComponent(b)),f.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),f.send(a))}}},s=function(){var b={},d=document.getElementsByTagName("IMG");if(0==d.length)return{};var a=d[0];if(!("naturalWidth"in a&&"naturalHeight"in a))return{};for(var c=0;a=d[c];++c){var e=a.getAttribute("pagespeed_url_hash");e&&(!(e in b)&&0=b[e].k&&a.height>=b[e].j)&&(b[e]={rw:a.width,rh:a.height,ow:a.naturalWidth,oh:a.naturalHeight})}return b},t="";h("pagespeed.CriticalImages.getBeaconData",function(){return t});h("pagespeed.CriticalImages.Run",function(b,d,a,c,e,f){var k=new p(b,d,a,e,f);n=k;c&&m(function(){window.setTimeout(function(){r(k)},0)})});})();pagespeed.CriticalImages.Run('/mod_pagespeed_beacon','http://www.geekstogo.com/forum/index.php?s=b9539564fea596230fa6e2cc5f53e699&app=forums&module=ajax§ion=topics&do=quote&t=361746&p=2566481&md5check=f03bf1ee5ad34e0f7cce49eec3e1a179&isRte=1,zBX8hFeDQI,true,true,vrZypRt_R5Q');//]]></script> scan-results.jpg&&0
     
    Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.
     
    The report will be saved in the C:\AdwCleaner folder.
     
     
     
    Junkware-Removal-Tool
     
    Please download Junkware Removal Tool to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site
    • Pause your anti-virus.  Close all browsers.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
     
     
     
    Please download Farbar Recovery Scan Tool and save it to your Desktop. 
     
    Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
     
    •  
    • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer. 
    • Press Scan button. 
    • It will produce a log called FRST.txt in the same directory the tool is run from.  
    • Please copy and paste log back here. 
    • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply. 
     

    adwcleaner:

    # AdwCleaner v5.200 - Logfile created 18/06/2016 at 09:53:20
    # Updated 14/06/2016 by ToolsLib
    # Database : 2016-06-17.1 [Server]
    # Operating system : Microsoft Windows XP Service Pack 3 (X86)
    # Username : Isabella - DAVID-0A47797B5
    # Running from : C:\Documents and Settings\Isabella\My Documents\Downloads\AdwCleaner.exe
    # Option : Clean
     
    ***** [ Services ] *****
     
    [-] Service Deleted : sbmntr
    [-] Service Deleted : swdumon
    [+] Service Deleted : MPCProtectService
    [+] Service Deleted : MPCKpt
    [+] Service Deleted : MPCBase
    [-] Service Deleted : CloudPrinter
    [-] Service Deleted : backlh
    [-] Service Deleted : DrvAgent32
     
    ***** [ Folders ] *****
     
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\Babylon
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\CloudPrinter
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\WindowsMsg
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\lavasoft\web companion
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\App-verifier
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\Logic Handler
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\ByteFence Anti-Malware
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Documents\Guid
    [-] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Documents\Downloaded Installers
    [#] Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Documents\Downloaded Installers\{86B53F95-3CEB-40F1-B10B-67263619410B}
    [-] Folder Deleted : C:\Program Files\DriverToolkit
    [-] Folder Deleted : C:\Program Files\HiDefMedia
    [-] Folder Deleted : C:\Program Files\MPC AdCleaner
    [#] Folder Deleted : C:\Program Files\MPC Cleaner
    [-] Folder Deleted : C:\Program Files\CleanBrowser
    [-] Folder Deleted : C:\Program Files\WebUpdater
    [-] Folder Deleted : C:\Program Files\PCAPDownloader
    [-] Folder Deleted : C:\Program Files\browseextension
    [-] Folder Deleted : C:\Program Files\Caster
    [-] Folder Deleted : C:\WINDOWS\ms
    [-] Folder Deleted : C:\WINDOWS\Installer\{86B53F95-3CEB-40F1-B10B-67263619410B}
    [-] Folder Deleted : C:\Documents and Settings\Isabella\Application Data\MCorp
     
    ***** [ Files ] *****
     
    [-] File Deleted : C:\appverifier.txt
    [-] File Deleted : C:\Documents and Settings\All Users.WINDOWS\Desktop\MPC Cleaner.lnk
    [-] File Deleted : C:\WINDOWS\Reimage.ini
    [-] File Deleted : C:\WINDOWS\system32\findit.xml
    [-] File Deleted : C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
    [-] File Deleted : C:\WINDOWS\system32\drivers\swdumon.sys
    [#] File Deleted : C:\WINDOWS\system32\drivers\MPCBase.sys
    [#] File Deleted : C:\WINDOWS\system32\drivers\MPCKpt.sys
    [-] File Deleted : C:\WINDOWS\system32\drivers\DrvAgent32.sys
    [-] File Deleted : C:\user.js
     
    ***** [ DLLs ] *****
     
     
    ***** [ WMI ] *****
     
    [-] Key Deleted : \root\subscription\\ActiveScriptEventConsumer [ASEC]
     
    ***** [ Shortcuts ] *****
     
    [-] Shortcut Disinfected : C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
    [-] Shortcut Disinfected : C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Mozilla Firefox.lnk
     
    ***** [ Scheduled tasks ] *****
     
     
    ***** [ Registry ] *****
     
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
    [-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SEARCHSCOPES\IELNKSRCH
    [-] Value Deleted : HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\AppCompatFlags\Custom\chrome.exe [{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]
    [-] Value Deleted : HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\AppCompatFlags\Custom\firefox.exe [{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]
    [-] Value Deleted : HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\AppCompatFlags\Custom\iexplore.exe [{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledsDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}
    [-] Key Deleted : HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}
    [-] Value Deleted : HKCU\Environment [SNF]
    [-] Value Deleted : HKCU\Environment [SNP]
    [-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION [PCAcceleratePro.exe]
    [-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}
    [-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}
    [-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION [PCAcceleratePro.exe]
    [-] Key Deleted : HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\Application Hosting
    [#] Value Deleted : HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\chrome.exe [{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]
    [#] Value Deleted : HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\firefox.exe [{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]
    [#] Value Deleted : HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\iexplore.exe [{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AniGIFCtrl.AniGIF
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AniGIFPpg.AniGIFPpg
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AniGIFPpg.AniGIFPpg.1
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AniGIFPpg2.AniGIFPpg2
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AniGIFPpg2.AniGIFPpg2.1
    [-] Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
    [-] Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
    [-] Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
    [-] Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{49BC4DD1-0E69-4611-9164-0009538C5E46}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{63EDCDD3-8AFC-4358-A90F-F7FB8F5C64FF}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0757C9D8-D8A3-33F5-CEE2-11D09918BA8F}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0214A12B-C5A3-437F-A6F3-068ABCD8C85E}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{96DD9437-5D20-4EFB-BF52-A4A605A4E0AA}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4A11A6BD-7880-49BD-92D4-6F09D0BD3250}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{68DE31F7-43FF-4EE2-B88B-10665016970D}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
    [-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
    [-] Key Deleted : HKCU\Software\AVG Secure Search
    [-] Key Deleted : HKCU\Software\DAILYPCCLEAN
    [-] Key Deleted : HKCU\Software\DriverToolkit
    [-] Key Deleted : HKCU\Software\IM
    [-] Key Deleted : HKCU\Software\Microsoft\Tinstalls
    [-] Key Deleted : HKCU\Software\PRODUCTSETUP
    [-] Key Deleted : HKCU\Software\Reimage
    [-] Key Deleted : HKCU\Software\SecuredDownload
    [-] Key Deleted : HKCU\Software\SlimWare Utilities Inc
    [-] Key Deleted : HKCU\Software\xfin_portal
    [-] Key Deleted : HKCU\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
    [-] Key Deleted : HKCU\Software\MICROSOFT\OTUT
    [-] Key Deleted : HKCU\Software\Wizzlabs
    [-] Key Deleted : HKCU\Software\MICROSOFT\IDSC
    [-] Key Deleted : HKCU\Software\PPC-softwareLanguage
    [-] Key Deleted : HKCU\Software\csastats
    [-] Key Deleted : HKCU\Software\InSTab
    [-] Key Deleted : HKCU\Software\ACPTab
    [-] Key Deleted : HKCU\Software\AppDataLow\Software\DailyWiki
    [-] Key Deleted : HKLM\SOFTWARE\SLIMWARE UTILITIES, INC.
    [-] Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
    [-] Key Deleted : HKLM\SOFTWARE\Babylon
    [-] Key Deleted : HKLM\SOFTWARE\ByteFence
    [-] Key Deleted : HKLM\SOFTWARE\MPC
    [-] Key Deleted : HKLM\SOFTWARE\MPC AdCleaner
    [-] Key Deleted : HKLM\SOFTWARE\SlimWare Utilities Inc
    [-] Key Deleted : HKLM\SOFTWARE\SpaceSoundPro
    [-] Key Deleted : HKLM\SOFTWARE\Lavasoft\Web Companion
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86B53F95-3CEB-40F1-B10B-67263619410B}
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ByteFence
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DriverRestore
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PopupProduct
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinZip Malware Protector_is1
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\xfin_portal
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\yahooprovidedsearch
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\YTDownloader
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{730E03E4-350E-48E5-9D3E-4329903D454D}
    [-] Key Deleted : HKU\.DEFAULT\Software\AVG Secure Search
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4E30E037E0535E84D9E3349209D354D4
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\4E30E037E0535E84D9E3349209D354D4
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\4E30E037E0535E84D9E3349209D354D4
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\50D2BAFD096C90345A82B25A790BDF69
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\50D2BAFD096C90345A82B25A790BDF69
    [-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
    [-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
    [-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [SearchAssistant]
    [-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
    [-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
    [-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
    [-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
    [-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
    [-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
    [-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
    [-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
    [-] Data Restored : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main [Start Page]
    [-] Data Restored : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main [Search Bar]
    [-] Data Restored : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main [Search Page]
    [-] Data Restored : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main [SearchAssistant]
    [-] Data Restored : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
    [-] Data Restored : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchUrl [Default]
    [-] Data Restored : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main [Start Page]
    [-] Data Restored : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main [Search Bar]
    [-] Data Restored : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main [Search Page]
    [-] Data Restored : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main [SearchAssistant]
    [-] Data Restored : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
    [-] Data Restored : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchUrl [Default]
    [-] Data Restored : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\Main [Search Page]
    [-] Data Restored : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\Main [Search Bar]
    [-] Data Restored : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\Main [SearchAssistant]
    [-] Data Restored : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\Main [Start Page]
    [-] Data Restored : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
    [-] Data Restored : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
    [-] Data Restored : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\SearchUrl [Default]
    [-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0644EE93-D778-472f-A0FF-E1416B8B2E3A}
    [-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2f23ab71-4ac6-41f2-a955-ea576e553146}
    [-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2f23ab71-4ac6-41f2-a955-ea576e553146}
    [-] Value Deleted : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Key Deleted : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}
    [-] Data Restored : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Value Deleted : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Key Deleted : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}
    [-] Data Restored : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Value Deleted : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Data Restored : HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
    [-] Data Restored : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs]
    [-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ask.com
    [-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\mmotraffic.com
    [-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [WINCOMHDJ]
     
    ***** [ Web browsers ] *****
     
     
    *************************
     
    :: "Tracing" keys deleted
    :: Winsock settings cleared
     
    *************************
     
    C:\AdwCleaner\AdwCleaner[C1].txt - [17296 bytes] - [18/06/2016 09:53:20]
    C:\AdwCleaner\AdwCleaner[S1].txt - [26568 bytes] - [18/06/2016 09:48:09]
     
    ########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [17444 bytes] ##########
     
    junkware removal tool:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.0.6 (04.25.2016)
    Operating System: Microsoft Windows XP x86 
    Ran by Isabella (Administrator) on Sat 06/18/2016 at  9:57:21.35
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     
     
     
    File System: 39 
     
    Failed to delete: C:\Program Files\google\chrome\application\chrome.bat (File) 
    Failed to delete: C:\Program Files\internet explorer\iexplore.bat (File) 
    Failed to delete: C:\Program Files\mpc cleaner (Folder) 
    Successfully deleted: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\mpc (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Application Data\aspackage (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Application Data\babylon (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Application Data\comcasttb (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Application Data\imvuclient (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\Invalidprefs.js (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Application Data\nico mak computing (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Desktop\mpc adcleaner.lnk (Shortcut) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\4C4C4544-1465909399-3610-8044-C4C04F444231 (Folder)
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\4C4C4544-1465929634-3610-8044-C4C04F444231 (Folder)
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\4C4C4544-1466005679-3610-8044-C4C04F444231 (Folder)
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\babylon (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\drivertoolkit (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_en.softonic.com_0.localstorage-journal (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_en.softonic.com_0.localstorage (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_search.tb.ask.com_0.localstorage-journal (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_search.tb.ask.com_0.localstorage (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage-journal (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage-journal (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_www.lyricsmode.com_0.localstorage-journal (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_www.lyricsmode.com_0.localstorage (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_www.metrolyrics.com_0.localstorage-journal (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_www.metrolyrics.com_0.localstorage (File) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\installer (Folder) 
    Successfully deleted: C:\Documents and Settings\Isabella\Local Settings\Application Data\slimware utilities inc (Folder) 
    Successfully deleted: C:\WINDOWS\System32\ai_recyclebin (Folder) 
    Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0JGLM56L (Temporary Internet Files Folder) 
    Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\9A67LRNO (Temporary Internet Files Folder) 
    Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\E9K3MTSR (Temporary Internet Files Folder) 
    Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MO9OHS7B (Temporary Internet Files Folder) 
    Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0JGLM56L (Temporary Internet Files Folder) 
    Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\9A67LRNO (Temporary Internet Files Folder) 
    Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\E9K3MTSR (Temporary Internet Files Folder) 
    Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\MO9OHS7B (Temporary Internet Files Folder) 
     
    Deleted the following from C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\prefs.js
    user_pref(browser.search.selectedEngine, Trovi);
     
     
     
    Registry: 5 
     
    Failed to delete: HKLM\SYSTEM\CurrentControlSet\services\MPCKpt (Registry Key) 
    Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Main\\SearchAssistant (Registry Value) 
    Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)
    Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{71737519-E297-4569-B786-2BC3FFC70A5B} (Registry Key)
    Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value) 
     
     
     
     
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Sat 06/18/2016 at 10:00:52.53
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
    farbar:
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-06-2016
    Ran by Isabella (administrator) on DAVID-0A47797B5 (18-06-2016 10:01:26)
    Running from C:\Documents and Settings\Isabella\My Documents\Downloads
    Loaded Profiles: Isabella (Available Profiles: Isabella & Gabriella & Sophia & Heather & Guest)
    Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
    Internet Explorer Version 6 (Default browser: "C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe" -- "%1")
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
     
    ==================== Processes (Whitelisted) =================
     
    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
     
    (DotC United Inc) C:\Program Files\MPC Cleaner\MPCProtectService.exe
    (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore.exe
     
     
    ==================== Registry (Whitelisted) ===========================
     
    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
     
    HKLM\...\Run: [igfxhkcmd] => C:\WINDOWS\system32\hkcmd.exe [77824 2006-03-23] (Intel Corporation)
    HKLM\...\Run: [MPC AdCleaner] => "C:\Program Files\MPC AdCleaner\AdCleaner.exe" /autostart
    HKLM\...\RunOnce: [OTUTPRODUCT_9RYBE] => C:\Program Files\mpck\otutnetwork.exe [60928 2016-06-14] (B)
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\ssstars.scr [14336 2008-04-14] (Microsoft Corporation)
    AppInit_DLLs: C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lamzap\BioOvefix.dll => No File
    ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [115440 2013-05-07] (SuperAdBlocker.com)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
    Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\RNX-MiniN1 11n USB Wireless LAN Utility.lnk [2012-04-14]
    ShortcutTarget: RNX-MiniN1 11n USB Wireless LAN Utility.lnk -> C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
    Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\RNX-MiniN1 11n USB Wireless LAN Utility.lnk [2012-04-14]
    ShortcutTarget: RNX-MiniN1 11n USB Wireless LAN Utility.lnk -> C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
    Startup: C:\Documents and Settings\CtShahJ\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\griffid.MARINGENERAL\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\hewittm\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\hillm1\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\jacksoem\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\marksl\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\PetrovBk\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\refreshh\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\sircusc\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\Sophia\Start Menu\Programs\Startup\PowerReg Scheduler.exe [2011-08-27] ()
    Startup: C:\Documents and Settings\TrajanR\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\w2kdeploy\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
     
    ==================== Internet (Whitelisted) ====================
     
    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
     
    ProxyEnable: [.DEFAULT] => Proxy is enabled.
    ProxyServer: [.DEFAULT] => http=127.0.0.1:3492;https=127.0.0.1:3492;
    AutoConfigURL: [.DEFAULT] => http=127.0.0.1:3492;https=127.0.0.1:3492;
    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
    Tcpip\..\Interfaces\{82E1604E-4B41-41E2-92FD-BAA899DD6B25}: [DhcpNameServer] 75.75.75.75 75.75.76.76
     
    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    URLSearchHook: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
    HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "hxxp://www.google.com" <======= ATTENTION
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_popjar_16_24_ssg08&param1=1&param2=f%3D2%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCyCtByDtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyC0B0F0C0A0EtAyDtGtCyEzyyEtG0D0CtB0AtGtBtDtBzytGyBzzyCyCyB0EtC0CyByCtDtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyE%26cr%3D2141437022%26a%3Dwncy_popjar_16_24_ssg08%26os_ver%3D5.1%26os%3DWindows%2BXP" <======= ATTENTION
    SearchScopes: HKLM -> DefaultScope value is missing
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 -> {FDC320A9-B4B2-491E-B140-815C11613CB6} URL = hxxp://search.yahoo.com/search?p={searchTerms}
    Toolbar: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
    DPF: {000F1EA4-5E08-4564-A29B-29076F63A37A} hxxp://launch.soe.com/plugin/web/SOEWebInstaller.cab
    StartMenuInternet: IEXPLORE.EXE - iexplore.exe
     
    FireFox:
    ========
    FF ProfilePath: C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default
    FF NewTab: C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\Lamzaps\\ff.NT
    FF DefaultSearchEngine: Yahoo! Powered
    FF Homepage: C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\Lamzaps\\ff.HP
    FF Keyword.URL: user_pref("keyword.URL", true);
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-16] ()
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
    FF Plugin: @unity3d.com/UnityPlayer -> C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll [2008-07-17] (Unity Technologies ApS)
    FF Plugin HKU\S-1-5-21-1177238915-823518204-1644491937-1004: @unity3d.com/UnityPlayer,version=1.0 -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll [2016-04-11] (Unity Technologies ApS)
    FF SearchPlugin: C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\searchplugins\findit.xml [2016-06-17]
    FF Extension: YouTube Video and Audio Downloader - C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\Extensions\[email protected] [2016-06-02]
    FF Extension: Translate This! - C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\Extensions\[email protected] [2016-04-11]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-01-19] [not signed]
    FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.5.4.24\coFFAddon => not found
     
    Chrome: 
    =======
    CHR HomePage: Default -> hxxp://taplika.com/?f=1&a=tpl_installertech_15_16&cd=2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCtBtDtBtN1L2XzutAtFtCtDtFtBtFtDtN1L1Czu2Z1E1I1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyDtD0CyD0Ezz0C0EtG0B0C0B0FtGtAtB0CyCtGyBtByC0CtGtCtCtCtB0B0D0A0C0AzytByD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtCtA&cr=1768884837&ir=
    CHR StartupUrls: Default -> "hxxp://taplika.com/?f=7&a=tpl_installertech_15_16&cd=2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCtBtDtBtN1L2XzutAtFtCtDtFtBtFtDtN1L1Czu2Z1E1I1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyDtD0CyD0Ezz0C0EtG0B0C0B0FtGtAtB0CyCtGyBtByC0CtGtCtCtCtB0B0D0A0C0AzytByD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtCtA&cr=1768884837&ir=","hxxp://www.google.com/","hxxp://us.4yendex.com/?utm_source=sdks&utm_medium=us01&utm_campaign=cbcab940a9053e847c0ee861c321939e"
    CHR Plugin: (Widevine Content Decryption Module) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => No File
    CHR Plugin: (Shockwave Flash) - C:\PROGRA~1\Google\Chrome\APPLIC~1\49.0.2623.112\PepperFlash\pepflashplayer.dll ()
    CHR Profile: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-19]
    CHR Extension: (Google Drive) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-23]
    CHR Extension: (YouTube) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-23]
    CHR Extension: (Google Search) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-23]
    CHR Extension: (Google Docs Offline) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]
    CHR Extension: (Core) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gkhcgfdghbiidgeccbldhfceleibkkpe [2016-03-26]
    CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
    CHR Extension: (Gmail) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-05]
    CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
    CHR HKU\S-1-5-21-1177238915-823518204-1644491937-1004\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
    StartMenuInternet: Google Chrome - C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
     
    ==================== Services (Whitelisted) ========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [142648 2014-07-22] (SUPERAntiSpyware.com)
    S3 CLPSLauncher; C:\Program Files\Common Files\COMODO\launcher_service.exe [76944 2016-06-03] (Comodo Security Solutions, Inc.)
    S2 cmcore; c:\program files\cmcm\Clean Master\cmcore.exe [315208 2016-04-13] (Kingsoft Corporation)
    S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
    S2 Lamzap; C:\Documents and Settings\All Users.WINDOWS\Application Data\\Lamzap\\Lamzap.exe [957440 2016-06-14] () [File not signed]
    S3 LPDSVC; C:\WINDOWS\system32\tcpsvcs.exe [19456 2008-04-14] (Microsoft Corporation)
    R2 MPCProtectService; C:\Program Files\MPC Cleaner\MPCProtectService.exe [350688 2016-06-14] (DotC United Inc)
     
    ===================== Drivers (Whitelisted) ==========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    R2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [21361 2012-04-14] (Cisco Systems, Inc.) [File not signed]
    S3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [4122368 2008-09-24] (Realtek Semiconductor Corp.) [File not signed]
    S3 EsgScanner; C:\WINDOWS\System32\DRIVERS\EsgScanner.sys [19984 2016-06-14] ()
    R3 ksapi; C:\WINDOWS\system32\drivers\ksapi.sys [81768 2016-04-13] (Kingsoft Corporation)
    S3 Leapfrog-USBLAN; C:\WINDOWS\System32\DRIVERS\btblan.sys [33792 2011-08-23] (Belcarra Technologies) [File not signed]
    R0 MPCBase; C:\WINDOWS\System32\drivers\MPCBase.sys [29032 2016-06-14] (DotC United Inc)
    R1 MPCKpt; C:\WINDOWS\System32\DRIVERS\MPCKpt.sys [53992 2016-06-14] (DotC United Inc)
    R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-14] (Microsoft Corporation)
    R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2008-04-14] (Microsoft Corporation)
    R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2008-04-14] (Microsoft Corporation)
    R3 RTL8192cu; C:\WINDOWS\System32\DRIVERS\RTL8192cu.sys [987904 2011-09-02] (Realtek Semiconductor Corporation                           ) [File not signed]
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    S3 XPTWOPORT; C:\WINDOWS\System32\DRIVERS\XPTWOPORT.SYS [15872 2011-09-02] (Realtek Semiconductor Corporation                           ) [File not signed]
    S0 cerc6; no ImagePath
    S3 cpuz134; \??\C:\DOCUME~1\Isabella\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [X]
    S3 cpuz136; \??\C:\WINDOWS\TEMP\cpuz136\cpuz136_x32.sys [X]
    U5 FontCache3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [46104 2008-07-29] (Microsoft Corporation)
    S4 IntelIde; no ImagePath
    U1 WS2IFSL; no ImagePath
     
    ==================== NetSvcs (Whitelisted) ===================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
     
    ==================== One Month Created files and folders ========
     
    (If an entry is included in the fixlist, the file/folder will be moved.)
     
    2016-06-18 10:01 - 2016-06-18 10:01 - 00006787 _____ C:\Documents and Settings\Isabella\My Documents\JRT.txt
    2016-06-18 10:01 - 2016-06-18 10:01 - 00000000 ____D C:\FRST
    2016-06-18 10:00 - 2016-06-18 10:00 - 00006787 _____ C:\Documents and Settings\Isabella\Desktop\JRT.txt
    2016-06-18 09:55 - 2016-06-18 09:55 - 00001476 _____ C:\Documents and Settings\All Users.WINDOWS\Desktop\MPC Cleaner.lnk
    2016-06-18 09:54 - 2016-06-18 09:54 - 00213672 _____ C:\WINDOWS\system32\FNTCACHE.DAT
    2016-06-18 09:47 - 2016-06-18 09:47 - 00047016 _____ C:\Documents and Settings\Isabella\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2016-06-18 09:45 - 2016-06-18 09:53 - 00000000 ____D C:\AdwCleaner
    2016-06-17 19:39 - 2016-06-14 11:38 - 00001827 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk
    2016-06-17 19:39 - 2016-06-14 11:38 - 00001827 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk
    2016-06-17 14:46 - 2016-06-17 14:46 - 00001203 _____ C:\Documents and Settings\Isabella\Desktop\Shortcut to MikuMikuDance.lnk
    2016-06-16 15:57 - 2016-06-16 20:57 - 00000000 ____D C:\Program Files\Mozilla Firefox
    2016-06-16 09:17 - 2016-06-18 09:54 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000730 _____ C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Mozilla Firefox.lnk
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000730 _____ C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Mozilla Firefox.lnk
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000724 _____ C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
    2016-06-16 08:45 - 2016-06-16 08:46 - 00062186 _____ C:\WINDOWS\ntbtlog.txt
    2016-06-15 14:19 - 2016-06-16 08:30 - 00000000 ____D C:\Documents and Settings\Isabella\Start Menu\Programs\MPC AdCleaner
    2016-06-14 16:46 - 2016-06-14 16:46 - 00019984 _____ C:\WINDOWS\system32\Drivers\EsgScanner.sys
    2016-06-14 13:55 - 2016-06-14 13:55 - 00000908 _____ C:\Documents and Settings\Isabella\Desktop\Tech support.txt
    2016-06-14 13:23 - 2016-06-14 13:23 - 00000000 ____D C:\WINDOWS\pss
    2016-06-14 13:17 - 2016-06-14 13:17 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\LogMeIn Rescue Applet
    2016-06-14 12:30 - 2016-06-14 12:31 - 00000000 ____D C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\WebUpdater
    2016-06-14 12:30 - 2016-06-14 12:31 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WebUpdater
    2016-06-14 12:23 - 2016-06-14 12:26 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzaps
    2016-06-14 12:23 - 2016-06-14 12:26 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzaps
    2016-06-14 12:23 - 2016-06-14 12:23 - 00000000 ____D C:\Program Files\Common Files\Domity
    2016-06-14 12:22 - 2016-06-18 09:55 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzap
    2016-06-14 12:22 - 2016-06-18 09:55 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzap
    2016-06-14 12:22 - 2016-06-14 12:22 - 02279413 _____ C:\Documents and Settings\Isabella\Application Data\Saltjob.bin
    2016-06-14 12:21 - 2016-06-14 12:22 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\DailyWiki
    2016-06-14 12:21 - 2016-06-14 12:21 - 06867968 _____ C:\Documents and Settings\Isabella\Application Data\agent.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 01760384 _____ C:\Documents and Settings\Isabella\Application Data\Siljaytough.tst
    2016-06-14 12:21 - 2016-06-14 12:21 - 00126464 _____ C:\Documents and Settings\Isabella\Application Data\noah.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 00126464 _____ C:\Documents and Settings\Isabella\Application Data\lobby.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 00072704 _____ C:\Documents and Settings\Isabella\Application Data\Med-It.tst
    2016-06-14 12:21 - 2016-06-14 12:21 - 00069072 _____ C:\Documents and Settings\Isabella\Application Data\Config.xml
    2016-06-14 12:21 - 2016-06-14 12:21 - 00054272 _____ C:\Documents and Settings\Isabella\Application Data\ApplicationHosting.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 00018432 _____ C:\Documents and Settings\Isabella\Application Data\Main.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 00005568 _____ C:\Documents and Settings\Isabella\Application Data\md.xml
    2016-06-14 12:21 - 2016-06-14 12:20 - 00053992 ____N (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
    2016-06-14 12:21 - 2016-06-14 12:20 - 00029032 ____N (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCBase.sys
    2016-06-14 12:21 - 2016-06-14 12:18 - 00957440 _____ C:\Documents and Settings\Isabella\Application Data\Siljaytough.exe
    2016-06-14 12:21 - 2016-06-14 12:18 - 00957440 _____ C:\Documents and Settings\Isabella\Application Data\Med-It.exe
    2016-06-14 12:20 - 2016-06-14 12:30 - 00000000 ____D C:\Program Files\MPC Cleaner
    2016-06-14 12:20 - 2016-06-14 12:20 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\tuto_monetize_120160614
    2016-06-14 12:20 - 2016-06-14 12:20 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\SecurityApps
    2016-06-14 12:18 - 2016-06-15 14:18 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\4C4C4544-1465906685-3610-8044-C4C04F444231
    2016-06-14 12:18 - 2016-06-14 12:19 - 00018288 _____ C:\Documents and Settings\Isabella\Application Data\InstallationConfiguration.xml
    2016-06-14 12:18 - 2016-06-14 12:19 - 00000000 ____D C:\Program Files\mpck
    2016-06-14 12:18 - 2016-06-14 12:18 - 00128512 _____ C:\Documents and Settings\Isabella\Application Data\Installer.dat
    2016-06-14 12:18 - 2016-06-14 12:18 - 00000000 _____ C:\WINDOWS\system32\Number of results
    2016-06-14 12:13 - 2016-06-14 12:13 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\IsolatedStorage
    2016-06-14 12:12 - 2016-06-16 08:22 - 00002892 _____ C:\wulog.txt
    2016-06-14 12:12 - 2016-06-15 13:50 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\WebUpdater
    2016-06-14 11:56 - 2016-06-14 11:57 - 00000000 ____D C:\Program Files\OpenSupport
    2016-06-14 11:43 - 2016-06-15 13:46 - 00000000 ____D C:\Program Files\Win32_ComputerSystemProduct-1465929799---
    2016-06-14 11:43 - 2016-06-14 11:39 - 00002116 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Free Download Manager
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Free Download Manager
    2016-06-13 14:57 - 2016-06-13 15:24 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\PasswordBoss
    2016-06-13 14:57 - 2016-06-13 15:24 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\PasswordBoss
    2016-06-13 14:56 - 2016-06-13 15:21 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
    2016-06-13 14:56 - 2016-06-13 15:21 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
    2016-06-13 07:13 - 2016-06-13 07:13 - 00142495 _____ C:\WINDOWS\e7cba6967fb0ecb67001f9d280002e18.exe
    2016-05-30 12:38 - 2016-05-30 12:38 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\PPC-software
    2016-05-30 12:38 - 2016-05-30 12:38 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\updates
    2016-05-30 12:37 - 2016-05-30 12:37 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\ScreenSnapshotTool
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\efo
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Unchecky
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Unchecky
    2016-05-30 12:24 - 2016-05-30 12:24 - 00040404 ____H C:\WINDOWS\system32\mlfcache.dat
    2016-05-29 14:15 - 2016-05-29 14:15 - 00000000 ____D C:\Program Files\RobloxVersions
    2016-05-21 15:16 - 2016-05-21 15:16 - 00000000 __SHD C:\found.001
     
    ==================== One Month Modified files and folders ========
     
    (If an entry is included in the fixlist, the file/folder will be moved.)
     
    2016-06-18 10:01 - 2011-08-27 08:47 - 00000000 ___RD C:\Documents and Settings\Isabella\My Documents
    2016-06-18 10:01 - 2011-08-27 08:47 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Temp
    2016-06-18 09:55 - 2015-07-17 09:18 - 00002422 _____ C:\WINDOWS\system32\wpa.dbl
    2016-06-18 09:55 - 2015-06-19 14:04 - 00000000 _____ C:\WINDOWS\RTacDbg.txt
    2016-06-18 09:55 - 2015-04-17 20:47 - 00000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    2016-06-18 09:55 - 2015-02-08 10:34 - 00000228 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
    2016-06-18 09:55 - 2011-08-26 19:59 - 00032642 _____ C:\WINDOWS\SchedLgU.Txt
    2016-06-18 09:55 - 2011-08-26 19:59 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2016-06-18 09:54 - 2011-08-27 08:47 - 00000178 ___SH C:\Documents and Settings\Isabella\ntuser.ini
    2016-06-18 09:53 - 2016-04-14 07:37 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2016-06-18 09:53 - 2016-04-14 07:37 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2016-06-18 09:16 - 2012-04-06 18:07 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
    2016-06-18 09:10 - 2015-04-17 20:47 - 00000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    2016-06-17 12:20 - 2015-06-18 20:27 - 00001825 ____C C:\Documents and Settings\Guest\Desktop\Google Chrome.lnk
    2016-06-17 12:20 - 2015-06-18 20:27 - 00000815 ____C C:\Documents and Settings\Guest\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2015-04-22 12:03 - 00001825 _____ C:\Documents and Settings\Heather\Desktop\Google Chrome.lnk
    2016-06-17 12:20 - 2015-04-17 18:26 - 00000815 _____ C:\Documents and Settings\Heather\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2011-08-26 20:51 - 00000815 _____ C:\Documents and Settings\Sophia\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2008-08-22 13:06 - 00000779 ____C C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 03:12 - 2015-01-10 21:26 - 00000000 ____D C:\WINDOWS\system32\MRT
    2016-06-17 03:00 - 2011-09-08 23:52 - 139785240 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2016-06-16 16:16 - 2012-04-06 18:07 - 00796352 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
    2016-06-16 16:16 - 2011-09-09 19:04 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
    2016-06-16 09:25 - 2011-08-26 19:58 - 00000178 __SHC C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.ini
    2016-06-16 08:52 - 2011-11-04 21:59 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\ApplicationHistory
    2016-06-16 08:45 - 2008-08-22 13:06 - 00000000 __SHD C:\WINDOWS\CSC
    2016-06-15 14:21 - 2015-04-15 21:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2909212$
    2016-06-15 14:21 - 2015-04-15 21:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2510581$
    2016-06-15 14:21 - 2015-04-15 21:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2964358$
    2016-06-15 14:21 - 2015-04-15 21:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2936068$
    2016-06-15 14:21 - 2015-01-10 21:44 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868626$
    2016-06-15 14:21 - 2015-01-10 21:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2922229$
    2016-06-15 14:21 - 2015-01-10 21:42 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2916036$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2929961$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2900986$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2898715$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2847311$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2930275$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862152$
    2016-06-15 14:21 - 2015-01-10 21:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876331$
    2016-06-15 14:21 - 2015-01-10 21:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
    2016-06-15 14:21 - 2015-01-10 21:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
    2016-06-15 14:21 - 2015-01-10 21:31 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893294$
    2016-06-15 14:21 - 2015-01-10 21:25 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2892075$
    2016-06-15 14:21 - 2015-01-10 21:25 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$
    2016-06-15 14:21 - 2015-01-10 21:16 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$
    2016-06-15 14:21 - 2013-04-14 13:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2820917$
    2016-06-15 14:21 - 2013-04-14 13:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2808735$
    2016-06-15 14:21 - 2013-04-14 13:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2813345$
    2016-06-15 14:21 - 2013-04-14 13:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2813170$
    2016-06-15 14:21 - 2013-03-24 09:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB939683$
    2016-06-15 14:21 - 2013-03-24 09:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB929399$
    2016-06-15 14:21 - 2013-03-24 09:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB954154_WM11$
    2016-06-15 14:21 - 2013-03-17 00:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2807986$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2799494$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2778344$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2758857$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2802968$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2780091$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2779562$
    2016-06-15 14:21 - 2013-03-08 12:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2753842-v2$
    2016-06-15 14:21 - 2013-03-08 12:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2770660$
    2016-06-15 14:21 - 2013-03-08 12:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2757638$
    2016-06-15 14:21 - 2012-11-29 19:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2761226$
    2016-06-15 14:21 - 2012-11-29 19:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2727528$
    2016-06-15 14:21 - 2012-10-12 20:47 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2724197$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2756822$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2749655$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2661254-v2$
    2016-06-15 14:21 - 2012-09-22 09:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2736233$
    2016-06-15 14:21 - 2012-08-18 03:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2731847$
    2016-06-15 14:21 - 2012-08-18 03:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2712808$
    2016-06-15 14:21 - 2012-08-18 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2705219$
    2016-06-15 14:21 - 2012-08-18 03:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2723135$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2719985$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2718523$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2691442$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2655992$
    2016-06-15 14:21 - 2012-07-14 03:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2698365$
    2016-06-15 14:21 - 2012-06-13 20:40 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2707511$
    2016-06-15 14:21 - 2012-06-13 20:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2685939$
    2016-06-15 14:21 - 2012-06-13 20:32 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2709162$
    2016-06-15 14:21 - 2012-06-09 03:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2718704$
    2016-06-15 14:21 - 2012-05-11 14:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2695962$
    2016-06-15 14:21 - 2012-05-11 14:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2676562$
    2016-06-15 14:18 - 2016-04-10 09:26 - 00000000 ____D C:\Documents and Settings\Isabella\Start Menu\ByteFence
    2016-06-15 14:15 - 2011-08-26 20:51 - 00000000 ___RD C:\Documents and Settings\Sophia\My Documents
    2016-06-15 13:46 - 2016-04-14 07:34 - 00000000 ____D C:\SUPERDelete
    2016-06-14 19:50 - 2015-04-20 20:28 - 00000000 ___RD C:\Documents and Settings\Isabella\My Documents\My Pictures
    2016-06-14 18:12 - 2016-04-14 07:25 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2016-06-14 16:48 - 2008-08-22 05:45 - 00000000 ___HD C:\WINDOWS\inf
    2016-06-14 13:17 - 2012-03-10 12:25 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\Deployment
    2016-06-14 12:28 - 2016-04-14 04:01 - 00769698 _____ C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1177238915-823518204-1644491937-1004-0.dat
    2016-06-14 12:28 - 2016-04-14 04:01 - 00207690 _____ C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    2016-06-14 12:17 - 2016-04-03 18:35 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\translate-65e7cca1b27e50ede238fedb48951a63
    2016-06-14 12:17 - 2016-04-03 18:35 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\emoticons-c6fcecc50023c7b811f3454d9d5636c0
    2016-06-14 12:17 - 2016-04-03 18:28 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\instagram-65e4ac1c5edb34c0da5ebbeca821d5af
    2016-06-14 12:10 - 2011-08-26 19:59 - 00000000 __SHD C:\Documents and Settings\LocalService.NT AUTHORITY
    2016-06-14 11:38 - 2016-04-03 18:22 - 00001616 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk
    2016-06-14 11:38 - 2016-04-03 18:22 - 00001616 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk
    2016-06-14 11:38 - 2015-04-17 20:52 - 00001827 ____R C:\Documents and Settings\Isabella\Desktop\Gооglе Сhrоmе.lnk
    2016-06-14 11:38 - 2015-04-16 07:13 - 00001659 ____R C:\Documents and Settings\Isabella\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk
    2016-06-13 15:28 - 2016-04-14 07:22 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
    2016-06-13 15:26 - 2016-04-10 09:26 - 00065536 _____ C:\WINDOWS\system32\config\Reason.evt
    2016-06-13 15:21 - 2011-08-26 12:38 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS
    2016-06-13 15:20 - 2010-03-23 15:00 - 00000000 ____D C:\Program Files\Auslogics
    2016-06-13 14:56 - 2016-04-10 09:16 - 00000344 __RSH C:\Documents and Settings\All Users.WINDOWS\ntuser.pol
    2016-06-13 14:07 - 2016-05-11 20:05 - 00000000 ____D C:\Program Files\Common Files\COMODO
    2016-06-13 11:22 - 2015-04-17 17:54 - 00000000 ____D C:\Documents and Settings\Heather\Local Settings\Temp
    2016-06-13 11:22 - 2011-08-26 19:59 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp
    2016-06-08 15:00 - 2015-02-08 10:34 - 00000222 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
    2016-06-05 16:51 - 2015-11-24 08:34 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\IMVU
    2016-05-30 12:43 - 2016-05-06 20:37 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\RobloxVersions
    2016-05-30 12:28 - 2012-04-07 21:53 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
    2016-05-30 12:28 - 2012-04-07 21:53 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
    2016-05-29 14:15 - 2016-05-06 20:37 - 00000174 _____ C:\Documents and Settings\Isabella\Local Settings\Application Data\rbxcsettings.rbx
    2016-05-29 14:15 - 2016-05-06 20:37 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\RobloxDownloads
    2016-05-23 23:25 - 2016-04-14 07:24 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
    2016-05-23 21:41 - 2011-08-26 20:51 - 00000000 ____D C:\Documents and Settings\Sophia\Local Settings\Temp
     
    ==================== Files in the root of some directories =======
     
    2010-11-02 08:53 - 2010-11-02 08:53 - 0001470 ____C () C:\Program Files\Common Files\AllscriptsEHR Gateway.rdp
    2010-06-24 11:32 - 2010-06-24 11:32 - 0022486 ____C () C:\Program Files\Common Files\DataArk.ico
    2010-06-24 11:33 - 2010-06-24 11:33 - 0000091 ____C () C:\Program Files\Common Files\DataArk.url
    2010-08-10 15:15 - 2010-08-10 15:15 - 0278135 ____C () C:\Program Files\Common Files\ManageAllScriptsRDP.exe
    2010-06-24 13:44 - 2010-06-24 13:44 - 0078782 ____C () C:\Program Files\Common Files\MGH-logo-color.ico
    2010-06-24 12:46 - 2010-06-24 12:46 - 0004286 ____C () C:\Program Files\Common Files\MGHNET-32x.ico
    2010-06-28 08:50 - 2010-06-28 08:50 - 0000083 ____C () C:\Program Files\Common Files\MGHNet.url
    2010-06-22 09:17 - 2011-08-03 12:38 - 0000327 ____C () C:\Program Files\Common Files\Paragon.url
    2010-10-28 14:53 - 2010-10-28 14:53 - 0000161 ____C () C:\Program Files\Common Files\Physicians WebStation (WSP 9.4).url
    2009-11-23 13:40 - 2009-11-23 13:40 - 0291079 ____C () C:\Program Files\Common Files\Uninstall_MSjava.exe
    2010-06-24 13:46 - 2010-06-24 13:46 - 0004286 ____C () C:\Program Files\Common Files\WSP-32x.ico
    2016-06-14 12:21 - 2016-06-14 12:21 - 6867968 _____ () C:\Documents and Settings\Isabella\Application Data\agent.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0054272 _____ () C:\Documents and Settings\Isabella\Application Data\ApplicationHosting.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0069072 _____ () C:\Documents and Settings\Isabella\Application Data\Config.xml
    2016-06-14 12:18 - 2016-06-14 12:19 - 0018288 _____ () C:\Documents and Settings\Isabella\Application Data\InstallationConfiguration.xml
    2016-06-14 12:18 - 2016-06-14 12:18 - 0128512 _____ () C:\Documents and Settings\Isabella\Application Data\Installer.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0126464 _____ () C:\Documents and Settings\Isabella\Application Data\lobby.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0018432 _____ () C:\Documents and Settings\Isabella\Application Data\Main.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0005568 _____ () C:\Documents and Settings\Isabella\Application Data\md.xml
    2016-06-14 12:21 - 2016-06-14 12:18 - 0957440 _____ () C:\Documents and Settings\Isabella\Application Data\Med-It.exe
    2016-06-14 12:21 - 2016-06-14 12:21 - 0072704 _____ () C:\Documents and Settings\Isabella\Application Data\Med-It.tst
    2016-06-14 12:21 - 2016-06-14 12:21 - 0126464 _____ () C:\Documents and Settings\Isabella\Application Data\noah.dat
    2016-06-14 12:22 - 2016-06-14 12:22 - 2279413 _____ () C:\Documents and Settings\Isabella\Application Data\Saltjob.bin
    2016-06-14 12:21 - 2016-06-14 12:18 - 0957440 _____ () C:\Documents and Settings\Isabella\Application Data\Siljaytough.exe
    2016-06-14 12:21 - 2016-06-14 12:21 - 1760384 _____ () C:\Documents and Settings\Isabella\Application Data\Siljaytough.tst
    2016-06-14 12:23 - 2016-06-14 12:23 - 0032038 _____ () C:\Documents and Settings\Isabella\Application Data\uninstall_temp.ico
    2015-04-18 17:28 - 2015-04-23 16:45 - 0000103 ____C () C:\Documents and Settings\Isabella\Application Data\WB.CFG
    2016-04-13 17:28 - 2016-04-13 17:49 - 0005632 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-04-20 16:54 - 2015-04-20 16:54 - 0274045 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\dsi1.dat
    2015-04-20 16:54 - 2015-04-20 16:54 - 0161916 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\dsi2.dat
    2012-12-05 15:44 - 2012-12-05 15:44 - 0027520 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\dt.dat
    2016-05-06 20:37 - 2016-05-29 14:15 - 0000174 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\rbxcsettings.rbx
    2015-11-23 18:27 - 2015-11-23 18:27 - 0000000 ____C () C:\Documents and Settings\Isabella\Local Settings\Application Data\{4A471A52-863D-4FCB-AC3B-EACBCD51A55A}
    2016-04-14 08:00 - 2016-04-21 21:56 - 0000193 _____ () C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft.SqlServer.Compact.351.32.bc
     
    Files to move or delete:
    ====================
    C:\Documents and Settings\Isabella\TempWmicBatchFile.bat
     
     
    Some files in TEMP:
    ====================
    C:\Documents and Settings\Isabella\Local Settings\Temp\libeay32.dll
    C:\Documents and Settings\Isabella\Local Settings\Temp\msvcr120.dll
    C:\Documents and Settings\Isabella\Local Settings\Temp\sqlite3.dll
     
     
    ==================== Bamital & volsnap =================
     
    (There is no automatic fix for files that do not pass verification.)
     
    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
     
    ==================== End of FRST.txt ============================
     
    addition:
    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-06-2016
    Ran by Isabella (2016-06-18 10:02:33)
    Running from C:\Documents and Settings\Isabella\My Documents\Downloads
    Microsoft Windows XP Professional Service Pack 3 (X86) (2011-08-27 14:52:56)
    Boot Mode: Normal
    ==========================================================
     
     
    ==================== Accounts: =============================
     
    Administrator (S-1-5-21-1177238915-823518204-1644491937-500 - Administrator - Enabled)
    ASPNET (S-1-5-21-1177238915-823518204-1644491937-1007 - Limited - Enabled)
    Gabriella (S-1-5-21-1177238915-823518204-1644491937-1005 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Gabriella
    Guest (S-1-5-21-1177238915-823518204-1644491937-501 - Limited - Disabled) => %SystemDrive%\Documents and Settings\Guest
    Heather (S-1-5-21-1177238915-823518204-1644491937-1009 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Heather
    HelpAssistant (S-1-5-21-1177238915-823518204-1644491937-1000 - Limited - Disabled)
    Isabella (S-1-5-21-1177238915-823518204-1644491937-1004 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Isabella
    Sophia (S-1-5-21-1177238915-823518204-1644491937-1006 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Sophia
    SUPPORT_388945a0 (S-1-5-21-1177238915-823518204-1644491937-1002 - Limited - Disabled)
     
    ==================== Security Center ========================
     
    (If an entry is included in the fixlist, it will be removed.)
     
    AV: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
     
    ==================== Installed Programs ======================
     
    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
     
    Adobe Flash Player 22 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)
    Adobe Flash Player 22 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
    Clean Master (HKLM\...\Clean Master) (Version: 1.0 - Cheetah Mobile)
    Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.2.6793.01 - Dell)
    Dell System Detect (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\58d94f3ce2c27db0) (Version: 7.3.0.6 - Dell)
    Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
    Google Update Helper (Version: 1.3.21.169 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.30.3 - Google Inc.) Hidden
    IMVU Avatar Chat Software (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\IMVU Avatar chat client software BETA) (Version:  - )
    Intel® Graphics Media Accelerator Driver (HKLM\...\{8A708DD8-A5E6-11D4-A706-000629E95E20}) (Version: 6.14.10.4543 - )
    JSWPFCom (Version: 1.07.0000 - JumpStart World) Hidden
    JSWPFGrade1 (Version: 1.07.0000 - JumpStart World) Hidden
    Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
    Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
    Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
    Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
    Microsoft Office Professional Edition 2003 (HKLM\...\{91E30409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
    Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version:  - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
    Microsoft WinUsb 2.0 (HKLM\...\winusb0200) (Version:  - Microsoft Corporation)
    Mozilla Firefox 47.0 (x86 en-US) (HKLM\...\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 47.0.0.5999 - Mozilla)
    mpck version 1.1 (HKLM\...\mobilepcstarterkit_is1) (Version: 1.1 - mobilepcstarterkit)
    Realtek AC'97 Audio (HKLM\...\{FB08F381-6533-4108-B7DD-039E11FBC27E}) (Version: 5.33 - Realtek Semiconductor Corp.)
    RNX-MiniN1 Wireless LAN Driver and Utility (HKLM\...\{9C049499-055C-4a0c-A916-1D12314F45EB}) (Version: 1.00.0179 - Rosewill Inc)
    SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 5.12.01.5246 - Analog Devices)
    SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1216 - SUPERAntiSpyware.com)
    Translate (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\translate-65e7cca1b27e50ede238fedb48951a63) (Version: 1.2.2 - Dzexon)
    Unity Web Player (HKLM\...\UnityWebPlayer) (Version: 2.1.0f5_16147 - Unity Technologies ApS)
    WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
    Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version:  - )
    Windows Media Player 11 (HKLM\...\Windows Media Player) (Version:  - )
     
    ==================== Custom CLSID (Whitelisted): ==========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    CustomCLSID: HKU\S-1-5-21-1177238915-823518204-1644491937-1004_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
     
    ==================== Scheduled Tasks (Whitelisted) =============
     
    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
     
    Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe
     
    ==================== Shortcuts =============================
     
    (The entries could be listed to be restored or removed.)
     
    Shortcut: C:\Documents and Settings\Isabella\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk -> C:\Program Files\Internet Explorer\iexplore.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Desktop\Gооglе Сhrоmе.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Gооglе Сhrоmе.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\Program Files\Internet Explorer\iexplore.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Моzillа Firеfох.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat ()
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat ()
     
    ShortcutWithArgument: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://navigation.iwatchavi.com/
     
    ==================== Loaded Modules (Whitelisted) ==============
     
     
    ==================== Alternate Data Streams (Whitelisted) =========
     
    (If an entry is included in the fixlist, only the ADS will be removed.)
     
    AlternateDataStreams: C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0B4227B4 [268]
    AlternateDataStreams: C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0B4227B4 [268]
     
    ==================== Safe Mode (Whitelisted) ===================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
     
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
     
    ==================== Association (Whitelisted) ===============
     
    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)
     
     
    ==================== Internet Explorer trusted/restricted ===============
     
    (If an entry is included in the fixlist, it will be removed from the registry.)
     
    IE trusted site: HKU\S-1-5-19\...\clonewarsadventures.com -> clonewarsadventures.com
    IE trusted site: HKU\S-1-5-19\...\freerealms.com -> freerealms.com
    IE trusted site: HKU\S-1-5-19\...\soe.com -> soe.com
    IE trusted site: HKU\S-1-5-19\...\sony.com -> sony.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\dell.com -> dell.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\driversupport.com -> hxxp://apps.driversupport.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\driversupport.com -> hxxps://apps.driversupport.com
     
    ==================== Hosts content: ==========================
     
    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)
     
    2008-04-14 00:00 - 2016-06-15 14:08 - 00000914 ____N C:\WINDOWS\system32\Drivers\etc\hosts
     
    127.0.0.1       localhost
    127.0.0.1       down.baidu2016.com
    127.0.0.1       123.sogou.com
    127.0.0.1       www.czzsyzgm.com
    127.0.0.1       www.czzsyzxl.com
    127.0.0.1       union.baidu2019.com
     
    ==================== Other Areas ============================
     
    (Currently there is no automatic fix for this section.)
     
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    DNS Servers: 75.75.75.75 - 75.75.76.76
    Windows Firewall is enabled.
     
    ==================== MSCONFIG/TASK MANAGER disabled items ==
     
    (Currently there is no automatic fix for this section.)
     
     
    ==================== FirewallRules (Whitelisted) ===============
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    StandardProfile\AuthorizedApplications: [C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe] => Enabled:RtWlan
    StandardProfile\AuthorizedApplications: [C:\Program Files\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Local Settings\Application Data\Akamai\netsession_win.exe] => Enabled:Akamai NetSession Client
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe] => Enabled:EBook Codec Downloader
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FormatFactory.exe] => Enabled:Format Factory
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FFModules\Package\PTInstOnline.exe] => Enabled:Picosmos Tools Downloader
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\My Documents\Downloads\solutoinstaller.exe] => Enabled:SolutoInstaller
    StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Program Files\Mozilla Firefox)
    StandardProfile\GloballyOpenPorts: [1542:UDP] => Enabled:Realtek WPS UDP Prot
    StandardProfile\GloballyOpenPorts: [53:UDP] => Enabled:Realtek AP UDP Prot
    StandardProfile\GloballyOpenPorts: [135:TCP] => Enabled:TCP Port 135
    StandardProfile\GloballyOpenPorts: [5000:TCP] => Enabled:TCP Port 5000
    StandardProfile\GloballyOpenPorts: [5001:TCP] => Enabled:TCP Port 5001
    StandardProfile\GloballyOpenPorts: [5002:TCP] => Enabled:TCP Port 5002
    StandardProfile\GloballyOpenPorts: [5003:TCP] => Enabled:TCP Port 5003
    StandardProfile\GloballyOpenPorts: [5004:TCP] => Enabled:TCP Port 5004
    StandardProfile\GloballyOpenPorts: [5005:TCP] => Enabled:TCP Port 5005
    StandardProfile\GloballyOpenPorts: [5006:TCP] => Enabled:TCP Port 5006
    StandardProfile\GloballyOpenPorts: [5007:TCP] => Enabled:TCP Port 5007
    StandardProfile\GloballyOpenPorts: [5008:TCP] => Enabled:TCP Port 5008
    StandardProfile\GloballyOpenPorts: [5009:TCP] => Enabled:TCP Port 5009
    StandardProfile\GloballyOpenPorts: [5010:TCP] => Enabled:TCP Port 5010
    StandardProfile\GloballyOpenPorts: [5011:TCP] => Enabled:TCP Port 5011
    StandardProfile\GloballyOpenPorts: [5012:TCP] => Enabled:TCP Port 5012
    StandardProfile\GloballyOpenPorts: [5013:TCP] => Enabled:TCP Port 5013
    StandardProfile\GloballyOpenPorts: [5014:TCP] => Enabled:TCP Port 5014
    StandardProfile\GloballyOpenPorts: [5015:TCP] => Enabled:TCP Port 5015
    StandardProfile\GloballyOpenPorts: [5016:TCP] => Enabled:TCP Port 5016
    StandardProfile\GloballyOpenPorts: [5017:TCP] => Enabled:TCP Port 5017
    StandardProfile\GloballyOpenPorts: [5018:TCP] => Enabled:TCP Port 5018
    StandardProfile\GloballyOpenPorts: [5019:TCP] => Enabled:TCP Port 5019
    StandardProfile\GloballyOpenPorts: [5020:TCP] => Enabled:TCP Port 5020
    StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22007
    StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [80:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [443:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [20010:UDP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [3478:UDP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7850:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7852:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7853:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [27022:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [6881:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [33333:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [20443:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [8090:TCP] => Enabled:War Thunder
     
    ==================== Restore Points =========================
     
    18-06-2016 09:57:26 JRT Pre-Junkware Removal
     
    ==================== Faulty Device Manager Devices =============
     
     
    ==================== Event log errors: =========================
     
    Application errors:
    ==================
    Error: (06/18/2016 09:55:06 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 09:55:06 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 09:27:09 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 09:27:09 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 08:12:17 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 08:12:17 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 07:33:09 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 07:33:09 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 06:28:17 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/18/2016 06:28:17 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
     
    System errors:
    =============
    Error: (06/18/2016 09:57:29 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Lamzap service terminated unexpectedly.  It has done this 1 time(s).
     
    Error: (06/18/2016 09:57:29 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The SAS Core Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service.
     
    Error: (06/18/2016 09:57:28 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Clean Master Core Service service terminated unexpectedly.  It has done this 1 time(s).
     
    Error: (06/18/2016 09:53:27 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/18/2016 09:53:27 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/18/2016 09:53:27 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/18/2016 09:53:27 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/18/2016 09:53:27 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/18/2016 09:53:27 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/18/2016 09:53:27 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
     
    ==================== Memory info =========================== 
     
    Processor:  Intel® Pentium® 4 CPU 3.00GHz
    Percentage of memory in use: 17%
    Total physical RAM: 2038.07 MB
    Available physical RAM: 1671.49 MB
    Total Virtual: 3412.69 MB
    Available Virtual: 3236.39 MB
     
    ==================== Drives ================================
     
    Drive c: () (Fixed) (Total:74.5 GB) (Free:30.26 GB) NTFS ==>[drive with boot components (Windows XP)]
     
    ==================== MBR & Partition Table ==================
     
    ========================================================
    Disk: 0 (MBR Code: Windows XP) (Size: 74.5 GB) (Disk ID: B174B174)
    Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
     
    ==================== End of Addition.txt ============================

    • 0

    #4
    RKinner

    RKinner

      Malware Expert

    • Expert
    • 20,025 posts
    • MVP
     
    Download the attached fixlist.txt to the same location as FRST
     
    Attached File  fixlist.txt   14.68KB   85 downloads
     
    Run FRST and press Fix
    A fix log will be generated please post that 
     
     
    Run FRST again as before.  Make sure Addition.txt is checked and hit Scan.  Post both logs.
     
     
     
    Use IE and go to http://eset.com/onlinescan and click on ESET online Scanner.  Accept the terms then press Start (If you get a warning from your browser tell it you want to run it).  
     
    # Check Scan Archives
    # Push the Start button.
    # ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    # When the scan completes, push LIST OF THREATS FOUND
    # Push EXPORT TO TEXT FILE , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    # Push the BACK button.
    # Push Finish
    # Once the scan is completed, you may close the window.
    # Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
    # Copy and paste that log as a reply.
     

     


    • 0

    #5
    izzykins17

    izzykins17

      Member

    • Topic Starter
    • Member
    • PipPip
    • 11 posts

    the last thing u asked me to download and run didnt work. it would scan it but before it was even half way done scanning it would go blank. its like that every time. but here are the other logs. 

    Fix result of Farbar Recovery Scan Tool (x86) Version: 20-06-2016 01
    Ran by Isabella (2016-06-22 11:59:01) Run:3
    Running from C:\Documents and Settings\Isabella\My Documents\Downloads\New Folder
    Loaded Profiles: Isabella (Available Profiles: Isabella & Gabriella & Sophia & Heather & Guest)
    Boot Mode: Normal
     
    ==============================================
     
    fixlist content:
    *****************
    HKLM\...\Run: [MPC AdCleaner] => "C:\Program Files\MPC AdCleaner\AdCleaner.exe" /autostart
    HKLM\...\RunOnce: [OTUTPRODUCT_9RYBE] => C:\Program Files\mpck\otutnetwork.exe [60928 2016-06-14] (B)
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
    AppInit_DLLs: C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lamzap\BioOvefix.dll => No File
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
    Startup: C:\Documents and Settings\CtShahJ\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\griffid.MARINGENERAL\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\hewittm\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\hillm1\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\jacksoem\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\marksl\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\PetrovBk\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\refreshh\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\sircusc\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\Sophia\Start Menu\Programs\Startup\PowerReg Scheduler.exe [2011-08-27] ()
    Startup: C:\Documents and Settings\TrajanR\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    Startup: C:\Documents and Settings\w2kdeploy\Start Menu\Programs\Startup\DeleteASHKCU.exe [2010-01-12] ()
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
    ProxyEnable: [.DEFAULT] => Proxy is enabled.
    ProxyServer: [.DEFAULT] => http=127.0.0.1:3492;https=127.0.0.1:3492;
    AutoConfigURL: [.DEFAULT] => http=127.0.0.1:3492;https=127.0.0.1:3492;
    HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "hxxp://www.google.com" <======= ATTENTION
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_popjar_16_24_ssg08&param1=1&param2=f%3D2%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCyCtByDtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyC0B0F0C0A0EtAyDtGtCyEzyyEtG0D0CtB0AtGtBtDtBzytGyBzzyCyCyB0EtC0CyByCtDtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyE%26cr%3D2141437022%26a%3Dwncy_popjar_16_24_ssg08%26os_ver%3D5.1%26os%3DWindows%2BXP" <======= ATTENTION
    SearchScopes: HKLM -> DefaultScope value is missing
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    Toolbar: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
    DPF: {000F1EA4-5E08-4564-A29B-29076F63A37A} hxxp://launch.soe.com/plugin/web/SOEWebInstaller.cab
    FF NewTab: C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\Lamzaps\\ff.NT
    FF Homepage: C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\Lamzaps\\ff.HP
    FF Extension: YouTube Video and Audio Downloader - C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\Extensions\[email protected] [2016-06-02]
    FF Extension: Translate This! - C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\Extensions\[email protected] [2016-04-11]
    FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.5.4.24\coFFAddon => not found
    CHR HomePage: Default -> hxxp://taplika.com/?f=1&a=tpl_installertech_15_16&cd=2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCtBtDtBtN1L2XzutAtFtCtDtFtBtFtDtN1L1Czu2Z1E1I1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyDtD0CyD0Ezz0C0EtG0B0C0B0FtGtAtB0CyCtGyBtByC0CtGtCtCtCtB0B0D0A0C0AzytByD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtCtA&cr=1768884837&ir=
    CHR StartupUrls: Default -> "hxxp://taplika.com/?f=7&a=tpl_installertech_15_16&cd=2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCtBtDtBtN1L2XzutAtFtCtDtFtBtFtDtN1L1Czu2Z1E1I1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyDtD0CyD0Ezz0C0EtG0B0C0B0FtGtAtB0CyCtGyBtByC0CtGtCtCtCtB0B0D0A0C0AzytByD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtCtA&cr=1768884837&ir=","hxxp://www.google.com/","hxxp://us.4yendex.com/?utm_source=sdks&utm_medium=us01&utm_campaign=cbcab940a9053e847c0ee861c321939e"
    CHR Plugin: (Widevine Content Decryption Module) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => No File
    S3 CLPSLauncher; C:\Program Files\Common Files\COMODO\launcher_service.exe [76944 2016-06-03] (Comodo Security Solutions, Inc.)
    S2 Lamzap; C:\Documents and Settings\All Users.WINDOWS\Application Data\\Lamzap\\Lamzap.exe [957440 2016-06-14] () [File not signed]
    R2 MPCProtectService; C:\Program Files\MPC Cleaner\MPCProtectService.exe [350688 2016-06-14] (DotC United Inc)
    S3 EsgScanner; C:\WINDOWS\System32\DRIVERS\EsgScanner.sys [19984 2016-06-14] ()
    R0 MPCBase; C:\WINDOWS\System32\drivers\MPCBase.sys [29032 2016-06-14] (DotC United Inc)
    R1 MPCKpt; C:\WINDOWS\System32\DRIVERS\MPCKpt.sys [53992 2016-06-14] (DotC United Inc)
    S0 cerc6; no ImagePath
    S3 cpuz134; \??\C:\DOCUME~1\Isabella\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [X]
    S3 cpuz136; \??\C:\WINDOWS\TEMP\cpuz136\cpuz136_x32.sys [X]
    S4 IntelIde; no ImagePath
    U1 WS2IFSL; no ImagePath
    2016-06-15 14:19 - 2016-06-16 08:30 - 00000000 ____D C:\Documents and Settings\Isabella\Start Menu\Programs\MPC AdCleaner
    2016-06-14 16:46 - 2016-06-14 16:46 - 00019984 _____ C:\WINDOWS\system32\Drivers\EsgScanner.sys
    2016-06-14 12:30 - 2016-06-14 12:31 - 00000000 ____D C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\WebUpdater
    2016-06-14 12:30 - 2016-06-14 12:31 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WebUpdater
    2016-06-14 12:23 - 2016-06-14 12:26 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzaps
    2016-06-14 12:23 - 2016-06-14 12:26 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzaps
    2016-06-14 12:23 - 2016-06-14 12:23 - 00000000 ____D C:\Program Files\Common Files\Domity
    2016-06-14 12:22 - 2016-06-18 09:55 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzap
    2016-06-14 12:22 - 2016-06-18 09:55 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzap
    2016-06-14 12:22 - 2016-06-14 12:22 - 02279413 _____ C:\Documents and Settings\Isabella\Application Data\Saltjob.bin
    2016-06-14 12:21 - 2016-06-14 12:22 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\DailyWiki
    2016-06-14 12:21 - 2016-06-14 12:21 - 06867968 _____ C:\Documents and Settings\Isabella\Application Data\agent.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 01760384 _____ C:\Documents and Settings\Isabella\Application Data\Siljaytough.tst
    2016-06-14 12:21 - 2016-06-14 12:21 - 00126464 _____ C:\Documents and Settings\Isabella\Application Data\noah.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 00126464 _____ C:\Documents and Settings\Isabella\Application Data\lobby.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 00072704 _____ C:\Documents and Settings\Isabella\Application Data\Med-It.tst
    2016-06-14 12:21 - 2016-06-14 12:21 - 00069072 _____ C:\Documents and Settings\Isabella\Application Data\Config.xml
    2016-06-14 12:21 - 2016-06-14 12:21 - 00054272 _____ C:\Documents and Settings\Isabella\Application Data\ApplicationHosting.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 00018432 _____ C:\Documents and Settings\Isabella\Application Data\Main.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 00005568 _____ C:\Documents and Settings\Isabella\Application Data\md.xml
    2016-06-14 12:21 - 2016-06-14 12:20 - 00053992 ____N (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
    2016-06-14 12:21 - 2016-06-14 12:20 - 00029032 ____N (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCBase.sys
    2016-06-14 12:21 - 2016-06-14 12:18 - 00957440 _____ C:\Documents and Settings\Isabella\Application Data\Siljaytough.exe
    2016-06-14 12:21 - 2016-06-14 12:18 - 00957440 _____ C:\Documents and Settings\Isabella\Application Data\Med-It.exe
    2016-06-14 12:20 - 2016-06-14 12:30 - 00000000 ____D C:\Program Files\MPC Cleaner
    2016-06-14 12:20 - 2016-06-14 12:20 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\tuto_monetize_120160614
    2016-06-14 12:20 - 2016-06-14 12:20 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\SecurityApps
    2016-06-14 12:18 - 2016-06-15 14:18 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\4C4C4544-1465906685-3610-8044-C4C04F444231
    2016-06-14 12:18 - 2016-06-14 12:19 - 00018288 _____ C:\Documents and Settings\Isabella\Application Data\InstallationConfiguration.xml
    2016-06-14 12:18 - 2016-06-14 12:19 - 00000000 ____D C:\Program Files\mpck
    2016-06-14 12:18 - 2016-06-14 12:18 - 00128512 _____ C:\Documents and Settings\Isabella\Application Data\Installer.dat
    2016-06-14 12:18 - 2016-06-14 12:18 - 00000000 _____ C:\WINDOWS\system32\Number of results
    2016-06-14 12:13 - 2016-06-14 12:13 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\IsolatedStorage
    2016-06-14 12:12 - 2016-06-16 08:22 - 00002892 _____ C:\wulog.txt
    2016-06-14 12:12 - 2016-06-15 13:50 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\WebUpdater
    2016-06-13 07:13 - 2016-06-13 07:13 - 00142495 _____ C:\WINDOWS\e7cba6967fb0ecb67001f9d280002e18.exe
    2010-11-02 08:53 - 2010-11-02 08:53 - 0001470 ____C () C:\Program Files\Common Files\AllscriptsEHR Gateway.rdp
    2010-06-24 11:32 - 2010-06-24 11:32 - 0022486 ____C () C:\Program Files\Common Files\DataArk.ico
    2010-06-24 11:33 - 2010-06-24 11:33 - 0000091 ____C () C:\Program Files\Common Files\DataArk.url
    2010-08-10 15:15 - 2010-08-10 15:15 - 0278135 ____C () C:\Program Files\Common Files\ManageAllScriptsRDP.exe
    2010-06-24 13:44 - 2010-06-24 13:44 - 0078782 ____C () C:\Program Files\Common Files\MGH-logo-color.ico
    2010-06-24 12:46 - 2010-06-24 12:46 - 0004286 ____C () C:\Program Files\Common Files\MGHNET-32x.ico
    2010-06-28 08:50 - 2010-06-28 08:50 - 0000083 ____C () C:\Program Files\Common Files\MGHNet.url
    2010-06-22 09:17 - 2011-08-03 12:38 - 0000327 ____C () C:\Program Files\Common Files\Paragon.url
    2010-10-28 14:53 - 2010-10-28 14:53 - 0000161 ____C () C:\Program Files\Common Files\Physicians WebStation (WSP 9.4).url
    2009-11-23 13:40 - 2009-11-23 13:40 - 0291079 ____C () C:\Program Files\Common Files\Uninstall_MSjava.exe
    2010-06-24 13:46 - 2010-06-24 13:46 - 0004286 ____C () C:\Program Files\Common Files\WSP-32x.ico
    2016-06-14 12:21 - 2016-06-14 12:21 - 6867968 _____ () C:\Documents and Settings\Isabella\Application Data\agent.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0054272 _____ () C:\Documents and Settings\Isabella\Application Data\ApplicationHosting.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0069072 _____ () C:\Documents and Settings\Isabella\Application Data\Config.xml
    2016-06-14 12:18 - 2016-06-14 12:19 - 0018288 _____ () C:\Documents and Settings\Isabella\Application Data\InstallationConfiguration.xml
    2016-06-14 12:18 - 2016-06-14 12:18 - 0128512 _____ () C:\Documents and Settings\Isabella\Application Data\Installer.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0126464 _____ () C:\Documents and Settings\Isabella\Application Data\lobby.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0018432 _____ () C:\Documents and Settings\Isabella\Application Data\Main.dat
    2016-06-14 12:21 - 2016-06-14 12:21 - 0005568 _____ () C:\Documents and Settings\Isabella\Application Data\md.xml
    2016-06-14 12:21 - 2016-06-14 12:18 - 0957440 _____ () C:\Documents and Settings\Isabella\Application Data\Med-It.exe
    2016-06-14 12:21 - 2016-06-14 12:21 - 0072704 _____ () C:\Documents and Settings\Isabella\Application Data\Med-It.tst
    2016-06-14 12:21 - 2016-06-14 12:21 - 0126464 _____ () C:\Documents and Settings\Isabella\Application Data\noah.dat
    2016-06-14 12:22 - 2016-06-14 12:22 - 2279413 _____ () C:\Documents and Settings\Isabella\Application Data\Saltjob.bin
    2016-06-14 12:21 - 2016-06-14 12:18 - 0957440 _____ () C:\Documents and Settings\Isabella\Application Data\Siljaytough.exe
    2016-06-14 12:21 - 2016-06-14 12:21 - 1760384 _____ () C:\Documents and Settings\Isabella\Application Data\Siljaytough.tst
    2016-06-14 12:23 - 2016-06-14 12:23 - 0032038 _____ () C:\Documents and Settings\Isabella\Application Data\uninstall_temp.ico
    2015-04-18 17:28 - 2015-04-23 16:45 - 0000103 ____C () C:\Documents and Settings\Isabella\Application Data\WB.CFG
    2016-04-13 17:28 - 2016-04-13 17:49 - 0005632 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-04-20 16:54 - 2015-04-20 16:54 - 0274045 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\dsi1.dat
    2015-04-20 16:54 - 2015-04-20 16:54 - 0161916 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\dsi2.dat
    2012-12-05 15:44 - 2012-12-05 15:44 - 0027520 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\dt.dat
    2016-05-06 20:37 - 2016-05-29 14:15 - 0000174 _____ () C:\Documents and Settings\Isabella\Local Settings\Application Data\rbxcsettings.rbx
    2015-11-23 18:27 - 2015-11-23 18:27 - 0000000 ____C () C:\Documents and Settings\Isabella\Local Settings\Application Data\{4A471A52-863D-4FCB-AC3B-EACBCD51A55A}
    2016-04-14 08:00 - 2016-04-21 21:56 - 0000193 _____ () C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft.SqlServer.Compact.351.32.bc
    C:\Documents and Settings\Isabella\TempWmicBatchFile.bat 
    C:\Program Files\MPC AdCleaner
    C:\Program Files\mpck
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe
    EmptyTemp:
     
     
     
     
    *****************
     
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MPC AdCleaner => value not found.
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\OTUTPRODUCT_9RYBE => value not found.
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoLowDiskSpaceChecks => value not found.
    "C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lamzap\BioOvefix.dll" => Value data not found.
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast => key not found. 
    HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. 
    C:\Documents and Settings\CtShahJ\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\griffid.MARINGENERAL\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\hewittm\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\hillm1\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\jacksoem\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\marksl\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\PetrovBk\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\refreshh\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\sircusc\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\Sophia\Start Menu\Programs\Startup\PowerReg Scheduler.exe => not found.
    C:\Documents and Settings\TrajanR\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    C:\Documents and Settings\w2kdeploy\Start Menu\Programs\Startup\DeleteASHKCU.exe => not found.
    HKLM\SOFTWARE\Policies\Google => key not found. 
    HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value not found.
    HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value not found.
    HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\AutoConfigURL => value not found.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => value restored successfully
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => value not found.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value not found.
    HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value not found.
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value not found.
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value not found.
    HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found. 
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{000F1EA4-5E08-4564-A29B-29076F63A37A} => key not found. 
    HKCR\CLSID\{000F1EA4-5E08-4564-A29B-29076F63A37A} => key not found. 
    FF NewTab: C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\Lamzaps\\ff.NT => not found
    Firefox "homepage" removed successfully.
    C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\Extensions\[email protected] => not found.
    C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\Extensions\[email protected] => not found.
    HKLM\Software\Mozilla\Firefox\Extensions\\{C1A2A613-35F1-4FCF-B27F-2840527B6556} => value not found.
    Chrome HomePage => removed successfully.
    Chrome StartupUrls => removed successfully.
    C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => not found.
    CLPSLauncher => service not found.
    Lamzap => service not found.
    MPCProtectService => Unable to stop service.
    MPCProtectService => service could not remove
    EsgScanner => service not found.
    MPCBase => Unable to stop service.
    MPCBase => service could not remove
    MPCKpt => Unable to stop service.
    MPCKpt => service could not remove
    cerc6 => service not found.
    cpuz134 => service not found.
    cpuz136 => service not found.
    IntelIde => service not found.
    WS2IFSL => service not found.
    "C:\Documents and Settings\Isabella\Start Menu\Programs\MPC AdCleaner" => not found.
    "C:\WINDOWS\system32\Drivers\EsgScanner.sys" => not found.
    "C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\WebUpdater" => not found.
    "C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WebUpdater" => not found.
    "C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzaps" => not found.
    "C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzaps" => not found.
    "C:\Program Files\Common Files\Domity" => not found.
    "C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzap" => not found.
    "C:\Documents and Settings\All Users.WINDOWS\Application Data\Lamzap" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Saltjob.bin" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\DailyWiki" => not found.
    "C:\Documents and Settings\Isabella\Application Data\agent.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Siljaytough.tst" => not found.
    "C:\Documents and Settings\Isabella\Application Data\noah.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\lobby.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Med-It.tst" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Config.xml" => not found.
    "C:\Documents and Settings\Isabella\Application Data\ApplicationHosting.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Main.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\md.xml" => not found.
    Could not move "C:\WINDOWS\system32\Drivers\MPCKpt.sys" => Scheduled to move on reboot.
    Could not move "C:\WINDOWS\system32\Drivers\MPCBase.sys" => Scheduled to move on reboot.
    "C:\Documents and Settings\Isabella\Application Data\Siljaytough.exe" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Med-It.exe" => not found.
     
    "C:\Program Files\MPC Cleaner" folder move:
     
    Could not move "C:\Program Files\MPC Cleaner" => Scheduled to move on reboot.
     
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\tuto_monetize_120160614" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\SecurityApps" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\4C4C4544-1465906685-3610-8044-C4C04F444231" => not found.
    "C:\Documents and Settings\Isabella\Application Data\InstallationConfiguration.xml" => not found.
    "C:\Program Files\mpck" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Installer.dat" => not found.
    "C:\WINDOWS\system32\Number of results" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\IsolatedStorage" => not found.
    "C:\wulog.txt" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\WebUpdater" => not found.
    "C:\WINDOWS\e7cba6967fb0ecb67001f9d280002e18.exe" => not found.
    "C:\Program Files\Common Files\AllscriptsEHR Gateway.rdp" => not found.
    "C:\Program Files\Common Files\DataArk.ico" => not found.
    "C:\Program Files\Common Files\DataArk.url" => not found.
    "C:\Program Files\Common Files\ManageAllScriptsRDP.exe" => not found.
    "C:\Program Files\Common Files\MGH-logo-color.ico" => not found.
    "C:\Program Files\Common Files\MGHNET-32x.ico" => not found.
    "C:\Program Files\Common Files\MGHNet.url" => not found.
    "C:\Program Files\Common Files\Paragon.url" => not found.
    "C:\Program Files\Common Files\Physicians WebStation (WSP 9.4).url" => not found.
    "C:\Program Files\Common Files\Uninstall_MSjava.exe" => not found.
    "C:\Program Files\Common Files\WSP-32x.ico" => not found.
    "C:\Documents and Settings\Isabella\Application Data\agent.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\ApplicationHosting.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Config.xml" => not found.
    "C:\Documents and Settings\Isabella\Application Data\InstallationConfiguration.xml" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Installer.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\lobby.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Main.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\md.xml" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Med-It.exe" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Med-It.tst" => not found.
    "C:\Documents and Settings\Isabella\Application Data\noah.dat" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Saltjob.bin" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Siljaytough.exe" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Siljaytough.tst" => not found.
    "C:\Documents and Settings\Isabella\Application Data\uninstall_temp.ico" => not found.
    "C:\Documents and Settings\Isabella\Application Data\WB.CFG" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\dsi1.dat" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\dsi2.dat" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\dt.dat" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\rbxcsettings.rbx" => not found.
    "C:\Documents and Settings\Isabella\Local Settings\Application Data\{4A471A52-863D-4FCB-AC3B-EACBCD51A55A}" => not found.
    "C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft.SqlServer.Compact.351.32.bc" => not found.
    "C:\Documents and Settings\Isabella\TempWmicBatchFile.bat" => not found.
    "C:\Program Files\MPC AdCleaner" => not found.
    "C:\Program Files\mpck" => not found.
    C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => not found.
    C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => not found.
     
    =========== EmptyTemp: ==========
     
    BITS transfer queue => 0 B
    DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache => 10089 B
    Java, Flash, Steam htmlcache => 32193 B
    Windows/system/dllcache/drivers => 16867 B
    Edge => 0 B
    Chrome => 481956605 B
    Firefox => 377308388 B
    Opera => 0 B
     
    Temp, IE cache, history, cookies, recent:
    Default User.WINDOWS => 0 B
    All Users.WINDOWS => 0 B
    systemprofile => 0 B
    LocalService.NT AUTHORITY => 0 B
    NetworkService.NT AUTHORITY => 0 B
    Isabella => 108648326 B
    Gabriella => 0 B
    Sophia => 0 B
    Heather => 0 B
    Guest => 0 B
     
    RecycleBin => 783897622 B
    EmptyTemp: => 1.6 GB temporary data Removed.
     
    ================================
     
    Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-06-22 12:02:35)
     
    "C:\WINDOWS\system32\Drivers\MPCKpt.sys" => Could not move
    "C:\WINDOWS\system32\Drivers\MPCBase.sys" => Could not move
    "C:\Program Files\MPC Cleaner" => Could not move
     
    ==== End of Fixlog 12:02:35 ====
     
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-06-2016 01
    Ran by Isabella (administrator) on DAVID-0A47797B5 (22-06-2016 12:07:11)
    Running from C:\Documents and Settings\Isabella\My Documents\Downloads\New Folder
    Loaded Profiles: Isabella (Available Profiles: Isabella & Gabriella & Sophia & Heather & Guest)
    Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
    Internet Explorer Version 6 (Default browser: "C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe" -- "%1")
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
     
    ==================== Processes (Whitelisted) =================
     
    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
     
    (Kingsoft Corporation) C:\Program Files\cmcm\Clean Master\cmcore.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore.exe
    (DotC United Inc) C:\Program Files\MPC Cleaner\MPCProtectService.exe
    (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
    (Realtek Semiconductor Corp.) C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe
    (Google Inc.) C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
    (Google Inc.) C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
    (Google Inc.) C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
    (Google Inc.) C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
    (ESET spol. s r.o.) C:\Documents and Settings\Isabella\My Documents\Downloads\esetonlinescanner_enu (1).exe
     
     
    ==================== Registry (Whitelisted) ===========================
     
    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
     
    HKLM\...\Run: [igfxhkcmd] => C:\WINDOWS\system32\hkcmd.exe [77824 2006-03-23] (Intel Corporation)
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\ssstars.scr [14336 2008-04-14] (Microsoft Corporation)
    ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [115440 2013-05-07] (SuperAdBlocker.com)
    Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\RNX-MiniN1 11n USB Wireless LAN Utility.lnk [2012-04-14]
    ShortcutTarget: RNX-MiniN1 11n USB Wireless LAN Utility.lnk -> C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
    Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\RNX-MiniN1 11n USB Wireless LAN Utility.lnk [2012-04-14]
    ShortcutTarget: RNX-MiniN1 11n USB Wireless LAN Utility.lnk -> C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
     
    ==================== Internet (Whitelisted) ====================
     
    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
     
    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
    Tcpip\..\Interfaces\{82E1604E-4B41-41E2-92FD-BAA899DD6B25}: [DhcpNameServer] 75.75.75.75 75.75.76.76
     
    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    URLSearchHook: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 -> {FDC320A9-B4B2-491E-B140-815C11613CB6} URL = hxxp://search.yahoo.com/search?p={searchTerms}
    StartMenuInternet: IEXPLORE.EXE - iexplore.exe
     
    FireFox:
    ========
    FF ProfilePath: C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default
    FF DefaultSearchEngine: Yahoo! Powered
    FF Keyword.URL: user_pref("keyword.URL", true);
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-16] ()
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
    FF Plugin: @unity3d.com/UnityPlayer -> C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll [2008-07-17] (Unity Technologies ApS)
    FF Plugin HKU\S-1-5-21-1177238915-823518204-1644491937-1004: @unity3d.com/UnityPlayer,version=1.0 -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll [2016-04-11] (Unity Technologies ApS)
    FF SearchPlugin: C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\searchplugins\findit.xml [2016-06-17]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-01-19] [not signed]
     
    Chrome: 
    =======
    CHR HomePage: Default -> hxxp://taplika.com/?f=1&a=tpl_installertech_15_16&cd=2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCtBtDtBtN1L2XzutAtFtCtDtFtBtFtDtN1L1Czu2Z1E1I1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyDtD0CyD0Ezz0C0EtG0B0C0B0FtGtAtB0CyCtGyBtByC0CtGtCtCtCtB0B0D0A0C0AzytByD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtCtA&cr=1768884837&ir=
    CHR StartupUrls: Default -> "hxxp://www.google.com/"
    CHR Plugin: (Widevine Content Decryption Module) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => No File
    CHR Plugin: (Shockwave Flash) - C:\PROGRA~1\Google\Chrome\APPLIC~1\49.0.2623.112\PepperFlash\pepflashplayer.dll ()
    CHR Profile: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-19]
    CHR Extension: (Google Drive) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-23]
    CHR Extension: (YouTube) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-23]
    CHR Extension: (Google Search) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-23]
    CHR Extension: (Google Docs Offline) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]
    CHR Extension: (Core) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gkhcgfdghbiidgeccbldhfceleibkkpe [2016-03-26]
    CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
    CHR Extension: (Gmail) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-05]
    CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
    CHR HKU\S-1-5-21-1177238915-823518204-1644491937-1004\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
    StartMenuInternet: Google Chrome - C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
     
    ==================== Services (Whitelisted) ========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [142648 2014-07-22] (SUPERAntiSpyware.com)
    R2 cmcore; c:\program files\cmcm\Clean Master\cmcore.exe [315208 2016-04-13] (Kingsoft Corporation)
    S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
    S3 LPDSVC; C:\WINDOWS\system32\tcpsvcs.exe [19456 2008-04-14] (Microsoft Corporation)
    R2 MPCProtectService; C:\Program Files\MPC Cleaner\MPCProtectService.exe [350688 2016-06-14] (DotC United Inc)
     
    ===================== Drivers (Whitelisted) ==========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    R2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [21361 2012-04-14] (Cisco Systems, Inc.) [File not signed]
    S3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [4122368 2008-09-24] (Realtek Semiconductor Corp.) [File not signed]
    U4 eapihdrv; C:\Documents and Settings\Isabella\Local Settings\Temp\ehdrv.sys [135760 2016-06-22] (ESET)
    R3 ksapi; C:\WINDOWS\system32\drivers\ksapi.sys [81768 2016-04-13] (Kingsoft Corporation)
    S3 Leapfrog-USBLAN; C:\WINDOWS\System32\DRIVERS\btblan.sys [33792 2011-08-23] (Belcarra Technologies) [File not signed]
    R0 MPCBase; C:\WINDOWS\System32\drivers\MPCBase.sys [29032 2016-06-14] (DotC United Inc)
    R1 MPCKpt; C:\WINDOWS\System32\DRIVERS\MPCKpt.sys [53992 2016-06-14] (DotC United Inc)
    R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-14] (Microsoft Corporation)
    R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2008-04-14] (Microsoft Corporation)
    R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2008-04-14] (Microsoft Corporation)
    R3 RTL8192cu; C:\WINDOWS\System32\DRIVERS\RTL8192cu.sys [987904 2011-09-02] (Realtek Semiconductor Corporation                           ) [File not signed]
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    S3 XPTWOPORT; C:\WINDOWS\System32\DRIVERS\XPTWOPORT.SYS [15872 2011-09-02] (Realtek Semiconductor Corporation                           ) [File not signed]
    U5 FontCache3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [46104 2008-07-29] (Microsoft Corporation)
     
    ==================== NetSvcs (Whitelisted) ===================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
     
    ==================== One Month Created files and folders ========
     
    (If an entry is included in the fixlist, the file/folder will be moved.)
     
    2016-06-22 12:01 - 2016-06-22 12:01 - 00001476 _____ C:\Documents and Settings\All Users.WINDOWS\Desktop\MPC Cleaner.lnk
    2016-06-22 12:01 - 2016-06-22 12:01 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC
    2016-06-22 12:01 - 2016-06-22 12:01 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC
    2016-06-22 11:32 - 2016-06-22 11:32 - 00213672 _____ C:\WINDOWS\system32\FNTCACHE.DAT
    2016-06-20 11:14 - 2016-06-20 11:15 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\IMVUClient
    2016-06-18 11:31 - 2016-06-18 11:31 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\ESET
    2016-06-18 10:01 - 2016-06-22 12:07 - 00000000 ____D C:\FRST
    2016-06-18 10:01 - 2016-06-18 10:01 - 00006787 _____ C:\Documents and Settings\Isabella\My Documents\JRT.txt
    2016-06-18 10:00 - 2016-06-18 10:00 - 00006787 _____ C:\Documents and Settings\Isabella\Desktop\JRT.txt
    2016-06-18 09:45 - 2016-06-22 11:31 - 00000000 ____D C:\AdwCleaner
    2016-06-17 19:39 - 2016-06-14 11:38 - 00001827 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk
    2016-06-17 19:39 - 2016-06-14 11:38 - 00001827 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk
    2016-06-17 14:46 - 2016-06-17 14:46 - 00001203 _____ C:\Documents and Settings\Isabella\Desktop\Shortcut to MikuMikuDance.lnk
    2016-06-16 15:57 - 2016-06-16 20:57 - 00000000 ____D C:\Program Files\Mozilla Firefox
    2016-06-16 09:17 - 2016-06-18 09:54 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000730 _____ C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Mozilla Firefox.lnk
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000730 _____ C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Mozilla Firefox.lnk
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000724 _____ C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
    2016-06-16 08:45 - 2016-06-16 08:46 - 00062186 _____ C:\WINDOWS\ntbtlog.txt
    2016-06-14 13:55 - 2016-06-14 13:55 - 00000908 _____ C:\Documents and Settings\Isabella\Desktop\Tech support.txt
    2016-06-14 13:23 - 2016-06-14 13:23 - 00000000 ____D C:\WINDOWS\pss
    2016-06-14 13:17 - 2016-06-14 13:17 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\LogMeIn Rescue Applet
    2016-06-14 12:21 - 2016-06-14 12:20 - 00053992 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
    2016-06-14 12:21 - 2016-06-14 12:20 - 00029032 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCBase.sys
    2016-06-14 12:20 - 2016-06-14 12:30 - 00000000 ____D C:\Program Files\MPC Cleaner
    2016-06-14 11:56 - 2016-06-14 11:57 - 00000000 ____D C:\Program Files\OpenSupport
    2016-06-14 11:43 - 2016-06-15 13:46 - 00000000 ____D C:\Program Files\Win32_ComputerSystemProduct-1465929799---
    2016-06-14 11:43 - 2016-06-14 11:39 - 00002116 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Free Download Manager
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Free Download Manager
    2016-06-13 14:57 - 2016-06-13 15:24 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\PasswordBoss
    2016-06-13 14:57 - 2016-06-13 15:24 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\PasswordBoss
    2016-06-13 14:56 - 2016-06-13 15:21 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
    2016-06-13 14:56 - 2016-06-13 15:21 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
    2016-05-30 12:38 - 2016-05-30 12:38 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\PPC-software
    2016-05-30 12:38 - 2016-05-30 12:38 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\updates
    2016-05-30 12:37 - 2016-05-30 12:37 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\ScreenSnapshotTool
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\efo
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Unchecky
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Unchecky
    2016-05-30 12:24 - 2016-05-30 12:24 - 00040404 ____H C:\WINDOWS\system32\mlfcache.dat
    2016-05-29 14:15 - 2016-05-29 14:15 - 00000000 ____D C:\Program Files\RobloxVersions
     
    ==================== One Month Modified files and folders ========
     
    (If an entry is included in the fixlist, the file/folder will be moved.)
     
    2016-06-22 12:07 - 2011-08-27 08:47 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Temp
    2016-06-22 12:02 - 2015-07-17 09:18 - 00002422 _____ C:\WINDOWS\system32\wpa.dbl
    2016-06-22 12:02 - 2015-06-19 14:04 - 00000000 _____ C:\WINDOWS\RTacDbg.txt
    2016-06-22 12:01 - 2015-04-17 20:47 - 00000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    2016-06-22 12:01 - 2011-08-27 08:47 - 00000178 ___SH C:\Documents and Settings\Isabella\ntuser.ini
    2016-06-22 12:01 - 2011-08-26 19:59 - 00032596 _____ C:\WINDOWS\SchedLgU.Txt
    2016-06-22 12:01 - 2011-08-26 19:59 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2016-06-22 11:52 - 2011-08-27 08:47 - 00000000 ___RD C:\Documents and Settings\Isabella\My Documents
    2016-06-22 11:16 - 2012-04-06 18:07 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
    2016-06-22 11:10 - 2015-04-17 20:47 - 00000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    2016-06-20 17:13 - 2015-04-08 16:16 - 00000306 ____C C:\WINDOWS\QTW.INI
    2016-06-20 13:06 - 2015-11-24 08:34 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\IMVU
    2016-06-20 11:15 - 2015-11-28 10:32 - 00001949 _____ C:\Documents and Settings\Isabella\Desktop\IMVU.lnk
    2016-06-18 11:09 - 2011-08-26 20:51 - 00000000 ____D C:\Documents and Settings\Sophia\Local Settings\Temp
    2016-06-18 11:09 - 2011-08-26 19:59 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp
    2016-06-18 11:07 - 2011-08-27 08:47 - 00000000 ____D C:\Documents and Settings\Isabella
    2016-06-18 09:53 - 2016-04-14 07:37 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2016-06-18 09:53 - 2016-04-14 07:37 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2016-06-17 12:20 - 2015-06-18 20:27 - 00001825 ____C C:\Documents and Settings\Guest\Desktop\Google Chrome.lnk
    2016-06-17 12:20 - 2015-06-18 20:27 - 00000815 ____C C:\Documents and Settings\Guest\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2015-04-22 12:03 - 00001825 _____ C:\Documents and Settings\Heather\Desktop\Google Chrome.lnk
    2016-06-17 12:20 - 2015-04-17 18:26 - 00000815 _____ C:\Documents and Settings\Heather\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2011-08-26 20:51 - 00000815 _____ C:\Documents and Settings\Sophia\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2008-08-22 13:06 - 00000779 ____C C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 03:12 - 2015-01-10 21:26 - 00000000 ____D C:\WINDOWS\system32\MRT
    2016-06-17 03:00 - 2011-09-08 23:52 - 139785240 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2016-06-16 16:16 - 2012-04-06 18:07 - 00796352 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
    2016-06-16 16:16 - 2011-09-09 19:04 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
    2016-06-16 09:25 - 2011-08-26 19:58 - 00000178 __SHC C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.ini
    2016-06-16 08:52 - 2011-11-04 21:59 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\ApplicationHistory
    2016-06-16 08:45 - 2008-08-22 13:06 - 00000000 __SHD C:\WINDOWS\CSC
    2016-06-15 14:21 - 2015-04-15 21:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2909212$
    2016-06-15 14:21 - 2015-04-15 21:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2510581$
    2016-06-15 14:21 - 2015-04-15 21:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2964358$
    2016-06-15 14:21 - 2015-04-15 21:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2936068$
    2016-06-15 14:21 - 2015-01-10 21:44 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868626$
    2016-06-15 14:21 - 2015-01-10 21:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2922229$
    2016-06-15 14:21 - 2015-01-10 21:42 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2916036$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2929961$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2900986$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2898715$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2847311$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2930275$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862152$
    2016-06-15 14:21 - 2015-01-10 21:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876331$
    2016-06-15 14:21 - 2015-01-10 21:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
    2016-06-15 14:21 - 2015-01-10 21:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
    2016-06-15 14:21 - 2015-01-10 21:31 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893294$
    2016-06-15 14:21 - 2015-01-10 21:25 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2892075$
    2016-06-15 14:21 - 2015-01-10 21:25 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$
    2016-06-15 14:21 - 2015-01-10 21:16 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$
    2016-06-15 14:21 - 2013-04-14 13:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2820917$
    2016-06-15 14:21 - 2013-04-14 13:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2808735$
    2016-06-15 14:21 - 2013-04-14 13:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2813345$
    2016-06-15 14:21 - 2013-04-14 13:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2813170$
    2016-06-15 14:21 - 2013-03-24 09:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB939683$
    2016-06-15 14:21 - 2013-03-24 09:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB929399$
    2016-06-15 14:21 - 2013-03-24 09:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB954154_WM11$
    2016-06-15 14:21 - 2013-03-17 00:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2807986$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2799494$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2778344$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2758857$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2802968$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2780091$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2779562$
    2016-06-15 14:21 - 2013-03-08 12:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2753842-v2$
    2016-06-15 14:21 - 2013-03-08 12:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2770660$
    2016-06-15 14:21 - 2013-03-08 12:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2757638$
    2016-06-15 14:21 - 2012-11-29 19:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2761226$
    2016-06-15 14:21 - 2012-11-29 19:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2727528$
    2016-06-15 14:21 - 2012-10-12 20:47 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2724197$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2756822$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2749655$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2661254-v2$
    2016-06-15 14:21 - 2012-09-22 09:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2736233$
    2016-06-15 14:21 - 2012-08-18 03:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2731847$
    2016-06-15 14:21 - 2012-08-18 03:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2712808$
    2016-06-15 14:21 - 2012-08-18 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2705219$
    2016-06-15 14:21 - 2012-08-18 03:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2723135$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2719985$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2718523$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2691442$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2655992$
    2016-06-15 14:21 - 2012-07-14 03:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2698365$
    2016-06-15 14:21 - 2012-06-13 20:40 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2707511$
    2016-06-15 14:21 - 2012-06-13 20:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2685939$
    2016-06-15 14:21 - 2012-06-13 20:32 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2709162$
    2016-06-15 14:21 - 2012-06-09 03:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2718704$
    2016-06-15 14:21 - 2012-05-11 14:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2695962$
    2016-06-15 14:21 - 2012-05-11 14:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2676562$
    2016-06-15 14:18 - 2016-04-10 09:26 - 00000000 ____D C:\Documents and Settings\Isabella\Start Menu\ByteFence
    2016-06-15 14:15 - 2011-08-26 20:51 - 00000000 ___RD C:\Documents and Settings\Sophia\My Documents
    2016-06-15 13:46 - 2016-04-14 07:34 - 00000000 ____D C:\SUPERDelete
    2016-06-14 18:12 - 2016-04-14 07:25 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2016-06-14 16:48 - 2008-08-22 05:45 - 00000000 ___HD C:\WINDOWS\inf
    2016-06-14 13:17 - 2012-03-10 12:25 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\Deployment
    2016-06-14 12:28 - 2016-04-14 04:01 - 00769698 _____ C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1177238915-823518204-1644491937-1004-0.dat
    2016-06-14 12:28 - 2016-04-14 04:01 - 00207690 _____ C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    2016-06-14 12:17 - 2016-04-03 18:35 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\translate-65e7cca1b27e50ede238fedb48951a63
    2016-06-14 12:17 - 2016-04-03 18:35 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\emoticons-c6fcecc50023c7b811f3454d9d5636c0
    2016-06-14 12:17 - 2016-04-03 18:28 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\instagram-65e4ac1c5edb34c0da5ebbeca821d5af
    2016-06-14 12:10 - 2011-08-26 19:59 - 00000000 __SHD C:\Documents and Settings\LocalService.NT AUTHORITY
    2016-06-14 11:38 - 2016-04-03 18:22 - 00001616 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk
    2016-06-14 11:38 - 2016-04-03 18:22 - 00001616 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk
    2016-06-14 11:38 - 2015-04-17 20:52 - 00001827 ____R C:\Documents and Settings\Isabella\Desktop\Gооglе Сhrоmе.lnk
    2016-06-14 11:38 - 2015-04-16 07:13 - 00001659 ____R C:\Documents and Settings\Isabella\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk
    2016-06-13 15:28 - 2016-04-14 07:22 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
    2016-06-13 15:26 - 2016-04-10 09:26 - 00065536 _____ C:\WINDOWS\system32\config\Reason.evt
    2016-06-13 15:21 - 2011-08-26 12:38 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS
    2016-06-13 15:20 - 2010-03-23 15:00 - 00000000 ____D C:\Program Files\Auslogics
    2016-06-13 14:56 - 2016-04-10 09:16 - 00000344 __RSH C:\Documents and Settings\All Users.WINDOWS\ntuser.pol
    2016-06-13 14:07 - 2016-05-11 20:05 - 00000000 ____D C:\Program Files\Common Files\COMODO
    2016-06-13 11:22 - 2015-04-17 17:54 - 00000000 ____D C:\Documents and Settings\Heather\Local Settings\Temp
    2016-05-30 12:43 - 2016-05-06 20:37 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\RobloxVersions
    2016-05-30 12:28 - 2012-04-07 21:53 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
    2016-05-30 12:28 - 2012-04-07 21:53 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
    2016-05-29 14:15 - 2016-05-06 20:37 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\RobloxDownloads
    2016-05-23 23:25 - 2016-04-14 07:24 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
     
    ==================== Bamital & volsnap =================
     
    (There is no automatic fix for files that do not pass verification.)
     
    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
     
    ==================== End of FRST.txt ============================
     
    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-06-2016 01
    Ran by Isabella (2016-06-22 12:08:20)
    Running from C:\Documents and Settings\Isabella\My Documents\Downloads\New Folder
    Microsoft Windows XP Professional Service Pack 3 (X86) (2011-08-27 14:52:56)
    Boot Mode: Normal
    ==========================================================
     
     
    ==================== Accounts: =============================
     
    Administrator (S-1-5-21-1177238915-823518204-1644491937-500 - Administrator - Enabled)
    ASPNET (S-1-5-21-1177238915-823518204-1644491937-1007 - Limited - Enabled)
    Gabriella (S-1-5-21-1177238915-823518204-1644491937-1005 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Gabriella
    Guest (S-1-5-21-1177238915-823518204-1644491937-501 - Limited - Disabled) => %SystemDrive%\Documents and Settings\Guest
    Heather (S-1-5-21-1177238915-823518204-1644491937-1009 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Heather
    HelpAssistant (S-1-5-21-1177238915-823518204-1644491937-1000 - Limited - Disabled)
    Isabella (S-1-5-21-1177238915-823518204-1644491937-1004 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Isabella
    Sophia (S-1-5-21-1177238915-823518204-1644491937-1006 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Sophia
    SUPPORT_388945a0 (S-1-5-21-1177238915-823518204-1644491937-1002 - Limited - Disabled)
     
    ==================== Security Center ========================
     
    (If an entry is included in the fixlist, it will be removed.)
     
    AV: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
     
    ==================== Installed Programs ======================
     
    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
     
    Adobe Flash Player 22 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)
    Adobe Flash Player 22 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
    Clean Master (HKLM\...\Clean Master) (Version: 1.0 - Cheetah Mobile)
    Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.2.6793.01 - Dell)
    Dell System Detect (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\58d94f3ce2c27db0) (Version: 7.3.0.6 - Dell)
    Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
    Google Update Helper (Version: 1.3.21.169 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.30.3 - Google Inc.) Hidden
    IMVU Avatar Chat Software (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\IMVU Avatar chat client software BETA) (Version:  - )
    Intel® Graphics Media Accelerator Driver (HKLM\...\{8A708DD8-A5E6-11D4-A706-000629E95E20}) (Version: 6.14.10.4543 - )
    JSWPFCom (Version: 1.07.0000 - JumpStart World) Hidden
    JSWPFGrade1 (Version: 1.07.0000 - JumpStart World) Hidden
    Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
    Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
    Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
    Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
    Microsoft Office Professional Edition 2003 (HKLM\...\{91E30409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
    Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version:  - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
    Microsoft WinUsb 2.0 (HKLM\...\winusb0200) (Version:  - Microsoft Corporation)
    Mozilla Firefox 47.0 (x86 en-US) (HKLM\...\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 47.0.0.5999 - Mozilla)
    Realtek AC'97 Audio (HKLM\...\{FB08F381-6533-4108-B7DD-039E11FBC27E}) (Version: 5.33 - Realtek Semiconductor Corp.)
    RNX-MiniN1 Wireless LAN Driver and Utility (HKLM\...\{9C049499-055C-4a0c-A916-1D12314F45EB}) (Version: 1.00.0179 - Rosewill Inc)
    SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 5.12.01.5246 - Analog Devices)
    SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1216 - SUPERAntiSpyware.com)
    Translate (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\translate-65e7cca1b27e50ede238fedb48951a63) (Version: 1.2.2 - Dzexon)
    Unity Web Player (HKLM\...\UnityWebPlayer) (Version: 2.1.0f5_16147 - Unity Technologies ApS)
    WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
    Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version:  - )
    Windows Media Player 11 (HKLM\...\Windows Media Player) (Version:  - )
     
    ==================== Custom CLSID (Whitelisted): ==========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    CustomCLSID: HKU\S-1-5-21-1177238915-823518204-1644491937-1004_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
     
    ==================== Scheduled Tasks (Whitelisted) =============
     
    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
     
    Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
     
    ==================== Shortcuts =============================
     
    (The entries could be listed to be restored or removed.)
     
    Shortcut: C:\Documents and Settings\Isabella\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk -> C:\Program Files\Internet Explorer\iexplore.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Desktop\Gооglе Сhrоmе.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Gооglе Сhrоmе.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\Program Files\Internet Explorer\iexplore.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Моzillа Firеfох.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat ()
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat ()
     
    ShortcutWithArgument: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://navigation.iwatchavi.com/
     
    ==================== Loaded Modules (Whitelisted) ==============
     
    2012-04-14 16:53 - 2009-12-09 21:20 - 00126976 _____ () C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\EnumDevLib.dll
    2012-04-14 16:53 - 2007-07-12 11:11 - 01163264 _____ () C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\acAuth.dll
     
    ==================== Alternate Data Streams (Whitelisted) =========
     
    (If an entry is included in the fixlist, only the ADS will be removed.)
     
    AlternateDataStreams: C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0B4227B4 [268]
    AlternateDataStreams: C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0B4227B4 [268]
     
    ==================== Safe Mode (Whitelisted) ===================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
     
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
     
    ==================== Association (Whitelisted) ===============
     
    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)
     
     
    ==================== Internet Explorer trusted/restricted ===============
     
    (If an entry is included in the fixlist, it will be removed from the registry.)
     
    IE trusted site: HKU\S-1-5-19\...\clonewarsadventures.com -> clonewarsadventures.com
    IE trusted site: HKU\S-1-5-19\...\freerealms.com -> freerealms.com
    IE trusted site: HKU\S-1-5-19\...\soe.com -> soe.com
    IE trusted site: HKU\S-1-5-19\...\sony.com -> sony.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\dell.com -> dell.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\driversupport.com -> hxxp://apps.driversupport.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\driversupport.com -> hxxps://apps.driversupport.com
     
    ==================== Hosts content: ==========================
     
    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)
     
    2008-04-14 00:00 - 2016-06-15 14:08 - 00000914 ____N C:\WINDOWS\system32\Drivers\etc\hosts
     
    127.0.0.1       localhost
    127.0.0.1       down.baidu2016.com
    127.0.0.1       123.sogou.com
    127.0.0.1       www.czzsyzgm.com
    127.0.0.1       www.czzsyzxl.com
    127.0.0.1       union.baidu2019.com
     
    ==================== Other Areas ============================
     
    (Currently there is no automatic fix for this section.)
     
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    DNS Servers: 75.75.75.75 - 75.75.76.76
    Windows Firewall is enabled.
     
    ==================== MSCONFIG/TASK MANAGER disabled items ==
     
    (Currently there is no automatic fix for this section.)
     
     
    ==================== FirewallRules (Whitelisted) ===============
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    StandardProfile\AuthorizedApplications: [C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe] => Enabled:RtWlan
    StandardProfile\AuthorizedApplications: [C:\Program Files\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Local Settings\Application Data\Akamai\netsession_win.exe] => Enabled:Akamai NetSession Client
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe] => Enabled:EBook Codec Downloader
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FormatFactory.exe] => Enabled:Format Factory
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FFModules\Package\PTInstOnline.exe] => Enabled:Picosmos Tools Downloader
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\My Documents\Downloads\solutoinstaller.exe] => Enabled:SolutoInstaller
    StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Program Files\Mozilla Firefox)
    StandardProfile\GloballyOpenPorts: [1542:UDP] => Enabled:Realtek WPS UDP Prot
    StandardProfile\GloballyOpenPorts: [53:UDP] => Enabled:Realtek AP UDP Prot
    StandardProfile\GloballyOpenPorts: [135:TCP] => Enabled:TCP Port 135
    StandardProfile\GloballyOpenPorts: [5000:TCP] => Enabled:TCP Port 5000
    StandardProfile\GloballyOpenPorts: [5001:TCP] => Enabled:TCP Port 5001
    StandardProfile\GloballyOpenPorts: [5002:TCP] => Enabled:TCP Port 5002
    StandardProfile\GloballyOpenPorts: [5003:TCP] => Enabled:TCP Port 5003
    StandardProfile\GloballyOpenPorts: [5004:TCP] => Enabled:TCP Port 5004
    StandardProfile\GloballyOpenPorts: [5005:TCP] => Enabled:TCP Port 5005
    StandardProfile\GloballyOpenPorts: [5006:TCP] => Enabled:TCP Port 5006
    StandardProfile\GloballyOpenPorts: [5007:TCP] => Enabled:TCP Port 5007
    StandardProfile\GloballyOpenPorts: [5008:TCP] => Enabled:TCP Port 5008
    StandardProfile\GloballyOpenPorts: [5009:TCP] => Enabled:TCP Port 5009
    StandardProfile\GloballyOpenPorts: [5010:TCP] => Enabled:TCP Port 5010
    StandardProfile\GloballyOpenPorts: [5011:TCP] => Enabled:TCP Port 5011
    StandardProfile\GloballyOpenPorts: [5012:TCP] => Enabled:TCP Port 5012
    StandardProfile\GloballyOpenPorts: [5013:TCP] => Enabled:TCP Port 5013
    StandardProfile\GloballyOpenPorts: [5014:TCP] => Enabled:TCP Port 5014
    StandardProfile\GloballyOpenPorts: [5015:TCP] => Enabled:TCP Port 5015
    StandardProfile\GloballyOpenPorts: [5016:TCP] => Enabled:TCP Port 5016
    StandardProfile\GloballyOpenPorts: [5017:TCP] => Enabled:TCP Port 5017
    StandardProfile\GloballyOpenPorts: [5018:TCP] => Enabled:TCP Port 5018
    StandardProfile\GloballyOpenPorts: [5019:TCP] => Enabled:TCP Port 5019
    StandardProfile\GloballyOpenPorts: [5020:TCP] => Enabled:TCP Port 5020
    StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22007
    StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [80:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [443:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [20010:UDP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [3478:UDP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7850:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7852:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7853:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [27022:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [6881:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [33333:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [20443:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [8090:TCP] => Enabled:War Thunder
     
    ==================== Restore Points =========================
     
    19-06-2016 21:36:50 System Checkpoint
    21-06-2016 21:15:13 System Checkpoint
     
    ==================== Faulty Device Manager Devices =============
     
     
    ==================== Event log errors: =========================
     
    Application errors:
    ==================
    Error: (06/22/2016 12:01:53 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 12:01:53 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 12:01:31 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 12:01:31 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 11:33:14 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 11:33:14 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 11:33:06 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 11:33:06 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 10:09:28 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 10:09:28 AM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
     
    System errors:
    =============
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
     
    ==================== Memory info =========================== 
     
    Processor:  Intel® Pentium® 4 CPU 3.00GHz
    Percentage of memory in use: 46%
    Total physical RAM: 2038.07 MB
    Available physical RAM: 1099.64 MB
    Total Virtual: 3412.69 MB
    Available Virtual: 2634.85 MB
     
    ==================== Drives ================================
     
    Drive c: () (Fixed) (Total:74.5 GB) (Free:30.68 GB) NTFS ==>[drive with boot components (Windows XP)]
     
    ==================== MBR & Partition Table ==================
     
    ========================================================
    Disk: 0 (MBR Code: Windows XP) (Size: 74.5 GB) (Disk ID: B174B174)
    Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
     
    ==================== End of Addition.txt ============================

    • 0

    #6
    RKinner

    RKinner

      Malware Expert

    • Expert
    • 20,025 posts
    • MVP

    Looks like MFC is playing hard to get.  It changed the permissions on the keys and files so we weren't able to remove them last time.  Let's try again:

     

     
    Download the attached fixlist.txt to the same location as FRST
     
    Attached File  fixlist.txt   6.41KB   58 downloads
     
    Run FRST and press Fix
    A fix log will be generated please post that 
     
     
    Run FRST again as before.  Make sure Addition.txt is checked and hit Scan.  Post both logs.
     
    Let's also run Combofix:
     
    ComboFix
     
    :!: It must be saved to your desktop, do not run it from your browser:!:
     
     
    Download and Save this file --  to your Desktop -- from either of these two sources:
     
    Double click on ComboFix to start the program.  
     
     
     
        * :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
        
        
        * A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.  
     
    A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.
     
    A file will be created at => C:\Combofix.txt or C:\Combofix\Combofix.txt . I'll need to see that in your reply.
     
     

    • 0

    #7
    izzykins17

    izzykins17

      Member

    • Topic Starter
    • Member
    • PipPip
    • 11 posts
    Fix result of Farbar Recovery Scan Tool (x86) Version: 20-06-2016 01
    Ran by Isabella (2016-06-22 20:33:02) Run:4
    Running from C:\Documents and Settings\Isabella\My Documents\Downloads\New Folder
    Loaded Profiles: Isabella (Available Profiles: Isabella & Gabriella & Sophia & Heather & Guest)
    Boot Mode: Normal
     
    ==============================================
     
    fixlist content:
    *****************
    (Kingsoft Corporation) C:\Program Files\cmcm\Clean Master\cmcore.exe
    (DotC United Inc) C:\Program Files\MPC Cleaner\MPCProtectService.exe
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    CHR HomePage: Default -> hxxp://taplika.com/?f=1&a=tpl_installertech_15_16&cd=2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCtBtDtBtN1L2XzutAtFtCtDtFtBtFtDtN1L1Czu2Z1E1I1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyDtD0CyD0Ezz0C0EtG0B0C0B0FtGtAtB0CyCtGyBtByC0CtGtCtCtCtB0B0D0A0C0AzytByD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtCtA&cr=1768884837&ir=
    CHR Plugin: (Widevine Content Decryption Module) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => No File
    R2 cmcore; c:\program files\cmcm\Clean Master\cmcore.exe [315208 2016-04-13] (Kingsoft Corporation)R2 MPCProtectService; C:\Program Files\MPC Cleaner\MPCProtectService.exe [350688 2016-06-14] (DotC United Inc)
    R0 MPCBase; C:\WINDOWS\System32\drivers\MPCBase.sys [29032 2016-06-14] (DotC United Inc)
    R3 ksapi; C:\WINDOWS\system32\drivers\ksapi.sys [81768 2016-04-13] (Kingsoft Corporation)
    R1 MPCKpt; C:\WINDOWS\System32\DRIVERS\MPCKpt.sys [53992 2016-06-14] (DotC United Inc)
    R2 MPCProtectService; C:\Program Files\MPC Cleaner\MPCProtectService.exe [350688 2016-06-14] (DotC United Inc)
    2016-06-22 12:01 - 2016-06-22 12:01 - 00001476 _____ C:\Documents and Settings\All Users.WINDOWS\Desktop\MPC Cleaner.lnk
    2016-06-22 12:01 - 2016-06-22 12:01 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC
    2016-06-22 12:01 - 2016-06-22 12:01 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC
    2016-06-14 12:21 - 2016-06-14 12:20 - 00053992 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
    2016-06-14 12:21 - 2016-06-14 12:20 - 00029032 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCBase.sys
    2016-06-14 12:20 - 2016-06-14 12:30 - 00000000 ____D C:\Program Files\MPC Cleaner
    AV: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    AlternateDataStreams: C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0B4227B4 [268]
    AlternateDataStreams: C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0B4227B4 [268]
    ListPermissions: C:\Program Files\Internet Explorer\iexplore.bat
    ListPermissions: C:\Program Files\Google\Chrome\Application\chrome.bat
    ListPermissions: C:\Program Files\Mozilla Firefox\firefox.bat
    ListPermissions: HKLM\SYSTEM\CurrentControlSet\services\MPCKpt
    SetDefaultFilePermissions: C:\Program Files\Internet Explorer\iexplore.bat
    SetDefaultFilePermissions: C:\Program Files\Google\Chrome\Application\chrome.bat
    SetDefaultFilePermissions: C:\Program Files\Mozilla Firefox\firefox.bat 
    CMD: Type C:\Program Files\Internet Explorer\iexplore.bat
    CMD: Type C:\Program Files\Google\Chrome\Application\chrome.bat
    CMD: Type C:\Program Files\Mozilla Firefox\firefox.bat
    C:\Program Files\Internet Explorer\iexplore.bat
    C:\Program Files\Google\Chrome\Application\chrome.bat
    C:\Program Files\Mozilla Firefox\firefox.bat
    SetDefaultFilePermissions: C:\Documents and Settings\Isabella\Start Menu\Programs\Int?rn?t ??pl?r?r.lnk
    SetDefaultFilePermissions: C:\Documents and Settings\Isabella\Desktop\G??gl? ?hr?m?.lnk
    SetDefaultFilePermissions: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\G??gl? ?hr?m?.lnk
    SetDefaultFilePermissions: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\L?un?h Int?rn?t ??pl?r?r ?r?ws?r.lnk 
    SetDefaultFilePermissions: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\??zill? Fir?f??.lnk
    SetDefaultFilePermissions: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\G??gl? ?hr?m? (2).lnk
    SetDefaultFilePermissions: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\??zill? Fir?f??.lnk
    Shortcut: C:\Documents and Settings\Isabella\Start Menu\Programs\Int?rn?t ??pl?r?r.lnk -> C:\Program Files\Internet Explorer\iexplore.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Desktop\G??gl? ?hr?m?.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\G??gl? ?hr?m?.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\L?un?h Int?rn?t ??pl?r?r ?r?ws?r.lnk -> C:\Program Files\Internet Explorer\iexplore.bat ()
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\??zill? Fir?f??.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat ()
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\G??gl? ?hr?m? (2).lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat ()
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\??zill? Fir?f??.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat ()
    SetDefaultFilePermissions: C:\WINDOWS\System32\drivers\MPCBase.sys
    SetDefaultFilePermissions: C:\WINDOWS\system32\Drivers\MPCKpt.sys
    SetDefaultFilePermissions: C:\WINDOWS\system32\Drivers\MPCBase.sys
    C:\WINDOWS\System32\drivers\MPCBase.sys
    C:\WINDOWS\system32\Drivers\MPCKpt.sys
    C:\WINDOWS\system32\Drivers\MPCBase.sys
    Unlock: HKLM\SYSTEM\CurrentControlSet\services\MPCKpt
    unlock: C:\Program Files\MPC Cleaner
    C:\Program Files\MPC Cleaner
    REG: reg delete HKLM\SYSTEM\CurrentControlSet\services\MPCKpt
    REG: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"
    REG: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}"
    CMD: FOR /F "usebackq delims==" %i IN (`wevtutil el`) DO wevtutil cl "%i"
    EmptyTemp:
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
    *****************
     
    C:\Program Files\cmcm\Clean Master\cmcore.exe
    [1668] C:\Program Files\cmcm\Clean Master\cmcore.exe => process closed successfully.
    C:\Program Files\MPC Cleaner\MPCProtectService.exe
    C:\Program Files\MPC Cleaner\MPCProtectService.exe => Could not close process
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    Chrome HomePage => removed successfully.
    C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => not found.
    cmcore => Service stopped successfully.
    cmcore => service removed successfully.
    MPCBase => Unable to stop service.
    MPCBase => service could not remove
    ksapi => Unable to stop service.
    ksapi => service removed successfully.
    MPCKpt => Unable to stop service.
    MPCKpt => service could not remove
    MPCProtectService => Unable to stop service.
    MPCProtectService => service could not remove
    "C:\Documents and Settings\All Users.WINDOWS\Desktop\MPC Cleaner.lnk" => not found.
    C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC => moved successfully
    "C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC" => not found.
    Could not move "C:\WINDOWS\system32\Drivers\MPCKpt.sys" => Scheduled to move on reboot.
    Could not move "C:\WINDOWS\system32\Drivers\MPCBase.sys" => Scheduled to move on reboot.
     
    "C:\Program Files\MPC Cleaner" folder move:
     
    Could not move "C:\Program Files\MPC Cleaner" => Scheduled to move on reboot.
     
    AV: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF} => removed successfully.
    C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => moved successfully
    C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
    C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
    C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP => ":0B4227B4" ADS removed successfully..
    "C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP" => ":0B4227B4" ADS not found.
    ===================================
    permissions of "C:\Program Files\Internet Explorer\iexplore.bat":
     
    Owner: DAVID-0A47797B5\Isabella
     
    DACL(AI):
     
    BUILTIN\Users ALLOW READ/EXECUTE (I)
    PU ALLOW MODIFY (I)
    BUILTIN\Administrators ALLOW FULL (I)
    NT AUTHORITY\SYSTEM ALLOW FULL (I)
    DAVID-0A47797B5\Isabella ALLOW FULL (I)
     
    ===================================
     
    "C:\Program Files\Google\Chrome\Application\chrome.bat" -> Getting permissions failed. File/Folder not found.
    ===================================
    permissions of "C:\Program Files\Mozilla Firefox\firefox.bat":
     
    Owner: DAVID-0A47797B5\Isabella
     
    DACL(AI):
     
    BUILTIN\Users ALLOW READ/EXECUTE (I)
    PU ALLOW MODIFY (I)
    BUILTIN\Administrators ALLOW FULL (I)
    NT AUTHORITY\SYSTEM ALLOW FULL (I)
    DAVID-0A47797B5\Isabella ALLOW FULL (I)
     
    ===================================
    ===================================
    permissions of "HKLM\SYSTEM\CurrentControlSet\services\MPCKpt":
     
    Owner: EVERYONE
     
    DACL(PAI):
     
    EVERYONE ALLOW FULL (NI)
     
    ===================================
    "C:\Program Files\Internet Explorer\iexplore.bat" => Default permissions restored successfully.
    "C:\Program Files\Google\Chrome\Application\chrome.bat" => not found.
    "C:\Program Files\Mozilla Firefox\firefox.bat" => Default permissions restored successfully.
     
    =========  Type C:\Program Files\Internet Explorer\iexplore.bat =========
     
    The system cannot find the file specified.
    Error occurred while processing: C:\Program.
    The system cannot find the path specified.
     
    ========= End of CMD: =========
     
     
    =========  Type C:\Program Files\Google\Chrome\Application\chrome.bat =========
     
    The system cannot find the file specified.
    Error occurred while processing: C:\Program.
    The system cannot find the path specified.
     
    ========= End of CMD: =========
     
     
    =========  Type C:\Program Files\Mozilla Firefox\firefox.bat =========
     
    The system cannot find the file specified.
    Error occurred while processing: C:\Program.
    The system cannot find the path specified.
     
    ========= End of CMD: =========
     
    C:\Program Files\Internet Explorer\iexplore.bat => moved successfully
    "C:\Program Files\Google\Chrome\Application\chrome.bat" => not found.
    C:\Program Files\Mozilla Firefox\firefox.bat => moved successfully
    "C:\Documents and Settings\Isabella\Start Menu\Programs\Int?rn?t ??pl?r?r.lnk" => Default permissions Could not restore.
    "C:\Documents and Settings\Isabella\Desktop\G??gl? ?hr?m?.lnk" => not found.
    "C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\G??gl? ?hr?m?.lnk" => Default permissions Could not restore.
    "C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\L?un?h Int?rn?t ??pl?r?r ?r?ws?r.lnk" => Default permissions Could not restore.
    "C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\??zill? Fir?f??.lnk" => Default permissions Could not restore.
    "C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\G??gl? ?hr?m? (2).lnk" => Default permissions Could not restore.
    "C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\??zill? Fir?f??.lnk" => Default permissions Could not restore.
    Shortcut: C:\Documents and Settings\Isabella\Start Menu\Programs\Int?rn?t ??pl?r?r.lnk -> C:\Program Files\Internet Explorer\iexplore.bat () => Error: No automatic fix found for this entry.
    Shortcut: C:\Documents and Settings\Isabella\Desktop\G??gl? ?hr?m?.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat () => Error: No automatic fix found for this entry.
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\G??gl? ?hr?m?.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat () => Error: No automatic fix found for this entry.
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\L?un?h Int?rn?t ??pl?r?r ?r?ws?r.lnk -> C:\Program Files\Internet Explorer\iexplore.bat () => Error: No automatic fix found for this entry.
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\??zill? Fir?f??.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat () => Error: No automatic fix found for this entry.
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\G??gl? ?hr?m? (2).lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat () => Error: No automatic fix found for this entry.
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\??zill? Fir?f??.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat () => Error: No automatic fix found for this entry.
    "C:\WINDOWS\System32\drivers\MPCBase.sys" => Default permissions restored successfully.
    "C:\WINDOWS\system32\Drivers\MPCKpt.sys" => Default permissions restored successfully.
    "C:\WINDOWS\system32\Drivers\MPCBase.sys" => Default permissions restored successfully.
    Could not move "C:\WINDOWS\System32\drivers\MPCBase.sys" => Scheduled to move on reboot.
    Could not move "C:\WINDOWS\system32\Drivers\MPCKpt.sys" => Scheduled to move on reboot.
    Could not move "C:\WINDOWS\system32\Drivers\MPCBase.sys" => Scheduled to move on reboot.
    "HKLM\SYSTEM\CurrentControlSet\services\MPCKpt" => key was unlocked
    "C:\Program Files\MPC Cleaner" => was unlocked
     
    "C:\Program Files\MPC Cleaner" folder move:
     
    Could not move "C:\Program Files\MPC Cleaner" => Scheduled to move on reboot.
     
     
    ========= reg delete HKLM\SYSTEM\CurrentControlSet\services\MPCKpt =========
     
     
    Permanently delete the registry key SYSTEM\CurrentControlSet\services\MPCKpt (Y/N)? 
    Error:  Access is denied.
     
     
    ========= End of Reg: =========
     
     
    ========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" =========
     
     
    Permanently delete the registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} (Y/N)? 
    The operation completed successfully
     
     
    ========= End of Reg: =========
     
     
    ========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}" =========
     
     
    Permanently delete the registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE} (Y/N)? 
    The operation completed successfully
     
     
    ========= End of Reg: =========
     
     
    =========  FOR /F "usebackq delims==" %i IN (`wevtutil el`) DO wevtutil cl "%i" =========
     
     
    ========= End of CMD: =========
     
     
    =========== EmptyTemp: ==========
     
    BITS transfer queue => 0 B
    DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache => 0 B
    Java, Flash, Steam htmlcache => 810 B
    Windows/system/dllcache/drivers => 483 B
    Edge => 0 B
    Chrome => 390884800 B
    Firefox => 48022299 B
    Opera => 0 B
     
    Temp, IE cache, history, cookies, recent:
    Default User.WINDOWS => 0 B
    All Users.WINDOWS => 0 B
    systemprofile => 0 B
    LocalService.NT AUTHORITY => 0 B
    NetworkService.NT AUTHORITY => 0 B
    Isabella => 173316 B
    Gabriella => 0 B
    Sophia => 0 B
    Heather => 0 B
    Guest => 0 B
     
    RecycleBin => 86817 B
    EmptyTemp: => 418.8 MB temporary data Removed.
     
    ================================
     
    Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-06-22 20:35:32)
     
    "C:\WINDOWS\system32\Drivers\MPCKpt.sys" => Could not move
    "C:\WINDOWS\system32\Drivers\MPCBase.sys" => Could not move
    "C:\Program Files\MPC Cleaner" => Could not move
    "C:\WINDOWS\System32\drivers\MPCBase.sys" => Could not move
    "C:\WINDOWS\system32\Drivers\MPCKpt.sys" => Could not move
    "C:\WINDOWS\system32\Drivers\MPCBase.sys" => Could not move
    "C:\Program Files\MPC Cleaner" => Could not move
     
    ==== End of Fixlog 20:35:32 ====
     
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-06-2016 01
    Ran by Isabella (administrator) on DAVID-0A47797B5 (22-06-2016 20:37:47)
    Running from C:\Documents and Settings\Isabella\My Documents\Downloads\New Folder
    Loaded Profiles: Isabella (Available Profiles: Isabella & Gabriella & Sophia & Heather & Guest)
    Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
    Internet Explorer Version 6 (Default browser: "C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe" -- "%1")
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
     
    ==================== Processes (Whitelisted) =================
     
    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
     
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore.exe
    (DotC United Inc) C:\Program Files\MPC Cleaner\MPCProtectService.exe
    (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
    (Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
    (DotC United Inc) C:\Program Files\MPC Cleaner\MPCTray.exe
    (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
    (Realtek Semiconductor Corp.) C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe
    (Google Inc.) C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
    (Google Inc.) C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
    (Google Inc.) C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
    (Google Inc.) C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
     
     
    ==================== Registry (Whitelisted) ===========================
     
    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
     
    HKLM\...\Run: [igfxhkcmd] => C:\WINDOWS\system32\hkcmd.exe [77824 2006-03-23] (Intel Corporation)
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\ssstars.scr [14336 2008-04-14] (Microsoft Corporation)
    ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [115440 2013-05-07] (SuperAdBlocker.com)
    Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\RNX-MiniN1 11n USB Wireless LAN Utility.lnk [2012-04-14]
    ShortcutTarget: RNX-MiniN1 11n USB Wireless LAN Utility.lnk -> C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
    Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\RNX-MiniN1 11n USB Wireless LAN Utility.lnk [2012-04-14]
    ShortcutTarget: RNX-MiniN1 11n USB Wireless LAN Utility.lnk -> C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
     
    ==================== Internet (Whitelisted) ====================
     
    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
     
    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
    Tcpip\..\Interfaces\{82E1604E-4B41-41E2-92FD-BAA899DD6B25}: [DhcpNameServer] 75.75.75.75 75.75.76.76
     
    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    URLSearchHook: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-21-1177238915-823518204-1644491937-1004 -> {FDC320A9-B4B2-491E-B140-815C11613CB6} URL = hxxp://search.yahoo.com/search?p={searchTerms}
    StartMenuInternet: IEXPLORE.EXE - iexplore.exe
     
    FireFox:
    ========
    FF ProfilePath: C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default
    FF DefaultSearchEngine: Yahoo! Powered
    FF Keyword.URL: user_pref("keyword.URL", true);
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-16] ()
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
    FF Plugin: @unity3d.com/UnityPlayer -> C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll [2008-07-17] (Unity Technologies ApS)
    FF Plugin HKU\S-1-5-21-1177238915-823518204-1644491937-1004: @unity3d.com/UnityPlayer,version=1.0 -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll [2016-04-11] (Unity Technologies ApS)
    FF SearchPlugin: C:\Documents and Settings\Isabella\Application Data\Mozilla\Firefox\Profiles\79gk91dw.default\searchplugins\findit.xml [2016-06-17]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-01-19] [not signed]
     
    Chrome: 
    =======
    CHR HomePage: Default -> hxxp://taplika.com/?f=1&a=tpl_installertech_15_16&cd=2XzuyEtN2Y1L1QzutDtDtCtAyBtB0EtCtBtByC0B0B0EyDyDtN0D0Tzu0StCtBtDtBtN1L2XzutAtFtCtDtFtBtFtDtN1L1Czu2Z1E1I1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyDtD0CyD0Ezz0C0EtG0B0C0B0FtGtAtB0CyCtGyBtByC0CtGtCtCtCtB0B0D0A0C0AzytByD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0EyByD0F0F0CtCtG0FtAtC0BtGyE0D0F0FtGzytAzyyEtGtAyEzzzytAtA0FyCzztD0Bzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtCtA&cr=1768884837&ir=
    CHR StartupUrls: Default -> "hxxp://www.google.com/"
    CHR Plugin: (Widevine Content Decryption Module) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => No File
    CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\49.0.2623.112\PepperFlash\pepflashplayer.dll ()
    CHR Profile: C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-19]
    CHR Extension: (Google Drive) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-23]
    CHR Extension: (YouTube) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-23]
    CHR Extension: (Google Search) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-23]
    CHR Extension: (Google Docs Offline) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]
    CHR Extension: (Core) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gkhcgfdghbiidgeccbldhfceleibkkpe [2016-03-26]
    CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
    CHR Extension: (Gmail) - C:\Documents and Settings\Isabella\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-05]
    CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
    CHR HKU\S-1-5-21-1177238915-823518204-1644491937-1004\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
    StartMenuInternet: Google Chrome - C:\PROGRA~1\Google\Chrome\APPLIC~1\chrome.exe
     
    ==================== Services (Whitelisted) ========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [142648 2014-07-22] (SUPERAntiSpyware.com)
    S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
    S3 LPDSVC; C:\WINDOWS\system32\tcpsvcs.exe [19456 2008-04-14] (Microsoft Corporation)
    R2 MPCProtectService; C:\Program Files\MPC Cleaner\MPCProtectService.exe [350688 2016-06-14] (DotC United Inc)
     
    ===================== Drivers (Whitelisted) ==========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    R2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [21361 2012-04-14] (Cisco Systems, Inc.) [File not signed]
    S3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [4122368 2008-09-24] (Realtek Semiconductor Corp.) [File not signed]
    S3 Leapfrog-USBLAN; C:\WINDOWS\System32\DRIVERS\btblan.sys [33792 2011-08-23] (Belcarra Technologies) [File not signed]
    R0 MPCBase; C:\WINDOWS\System32\drivers\MPCBase.sys [29032 2016-06-14] (DotC United Inc)
    R1 MPCKpt; C:\WINDOWS\System32\DRIVERS\MPCKpt.sys [53992 2016-06-14] (DotC United Inc)
    R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-14] (Microsoft Corporation)
    R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2008-04-14] (Microsoft Corporation)
    R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2008-04-14] (Microsoft Corporation)
    R3 RTL8192cu; C:\WINDOWS\System32\DRIVERS\RTL8192cu.sys [987904 2011-09-02] (Realtek Semiconductor Corporation                           ) [File not signed]
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    S3 XPTWOPORT; C:\WINDOWS\System32\DRIVERS\XPTWOPORT.SYS [15872 2011-09-02] (Realtek Semiconductor Corporation                           ) [File not signed]
    U5 FontCache3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [46104 2008-07-29] (Microsoft Corporation)
     
    ==================== NetSvcs (Whitelisted) ===================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
     
    ==================== One Month Created files and folders ========
     
    (If an entry is included in the fixlist, the file/folder will be moved.)
     
    2016-06-22 20:34 - 2016-06-22 20:34 - 00001476 _____ C:\Documents and Settings\All Users.WINDOWS\Desktop\MPC Cleaner.lnk
    2016-06-22 20:34 - 2016-06-22 20:34 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC
    2016-06-22 20:34 - 2016-06-22 20:34 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\MPC
    2016-06-22 18:33 - 2016-06-22 18:33 - 00000783 _____ C:\Documents and Settings\Isabella\Desktop\Shortcut to chrome.lnk
    2016-06-22 12:50 - 2016-06-22 12:50 - 00047016 _____ C:\Documents and Settings\Isabella\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2016-06-22 11:32 - 2016-06-22 11:32 - 00213672 _____ C:\WINDOWS\system32\FNTCACHE.DAT
    2016-06-20 11:14 - 2016-06-20 11:15 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\IMVUClient
    2016-06-18 11:31 - 2016-06-18 11:31 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\ESET
    2016-06-18 10:01 - 2016-06-22 20:37 - 00000000 ____D C:\FRST
    2016-06-18 10:01 - 2016-06-18 10:01 - 00006787 _____ C:\Documents and Settings\Isabella\My Documents\JRT.txt
    2016-06-18 10:00 - 2016-06-18 10:00 - 00006787 _____ C:\Documents and Settings\Isabella\Desktop\JRT.txt
    2016-06-18 09:45 - 2016-06-22 11:31 - 00000000 ____D C:\AdwCleaner
    2016-06-17 19:39 - 2016-06-14 11:38 - 00001827 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk
    2016-06-17 19:39 - 2016-06-14 11:38 - 00001827 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk
    2016-06-17 14:46 - 2016-06-17 14:46 - 00001203 _____ C:\Documents and Settings\Isabella\Desktop\Shortcut to MikuMikuDance.lnk
    2016-06-16 15:57 - 2016-06-22 20:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
    2016-06-16 09:17 - 2016-06-18 09:54 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000730 _____ C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Mozilla Firefox.lnk
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000730 _____ C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Mozilla Firefox.lnk
    2016-06-16 09:17 - 2016-06-18 09:53 - 00000724 _____ C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
    2016-06-16 08:45 - 2016-06-16 08:46 - 00062186 _____ C:\WINDOWS\ntbtlog.txt
    2016-06-14 13:55 - 2016-06-14 13:55 - 00000908 _____ C:\Documents and Settings\Isabella\Desktop\Tech support.txt
    2016-06-14 13:23 - 2016-06-14 13:23 - 00000000 ____D C:\WINDOWS\pss
    2016-06-14 13:17 - 2016-06-14 13:17 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\LogMeIn Rescue Applet
    2016-06-14 12:21 - 2016-06-14 12:20 - 00053992 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
    2016-06-14 12:21 - 2016-06-14 12:20 - 00029032 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCBase.sys
    2016-06-14 12:20 - 2016-06-14 12:30 - 00000000 ____D C:\Program Files\MPC Cleaner
    2016-06-14 11:56 - 2016-06-14 11:57 - 00000000 ____D C:\Program Files\OpenSupport
    2016-06-14 11:43 - 2016-06-15 13:46 - 00000000 ____D C:\Program Files\Win32_ComputerSystemProduct-1465929799---
    2016-06-14 11:43 - 2016-06-14 11:39 - 00002116 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\FreeDownloadManager.ORG
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Free Download Manager
    2016-06-14 11:25 - 2016-06-14 11:25 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Free Download Manager
    2016-06-13 14:57 - 2016-06-13 15:24 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\PasswordBoss
    2016-06-13 14:57 - 2016-06-13 15:24 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\PasswordBoss
    2016-06-13 14:56 - 2016-06-13 15:21 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
    2016-06-13 14:56 - 2016-06-13 15:21 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
    2016-05-30 12:38 - 2016-05-30 12:38 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\PPC-software
    2016-05-30 12:38 - 2016-05-30 12:38 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\updates
    2016-05-30 12:37 - 2016-05-30 12:37 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\ScreenSnapshotTool
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\efo
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Unchecky
    2016-05-30 12:34 - 2016-05-30 12:34 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Unchecky
    2016-05-30 12:24 - 2016-05-30 12:24 - 00040404 ____H C:\WINDOWS\system32\mlfcache.dat
    2016-05-29 14:15 - 2016-05-29 14:15 - 00000000 ____D C:\Program Files\RobloxVersions
     
    ==================== One Month Modified files and folders ========
     
    (If an entry is included in the fixlist, the file/folder will be moved.)
     
    2016-06-22 20:38 - 2011-08-27 08:47 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Temp
    2016-06-22 20:35 - 2015-07-17 09:18 - 00002422 _____ C:\WINDOWS\system32\wpa.dbl
    2016-06-22 20:35 - 2015-06-19 14:04 - 00000000 _____ C:\WINDOWS\RTacDbg.txt
    2016-06-22 20:34 - 2011-08-27 08:47 - 00000178 ___SH C:\Documents and Settings\Isabella\ntuser.ini
    2016-06-22 20:34 - 2011-08-26 19:59 - 00032596 _____ C:\WINDOWS\SchedLgU.Txt
    2016-06-22 20:34 - 2011-08-26 19:59 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2016-06-22 14:02 - 2016-02-16 17:41 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\1455669675843
    2016-06-22 11:52 - 2011-08-27 08:47 - 00000000 ___RD C:\Documents and Settings\Isabella\My Documents
    2016-06-20 17:13 - 2015-04-08 16:16 - 00000306 ____C C:\WINDOWS\QTW.INI
    2016-06-20 13:06 - 2015-11-24 08:34 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\IMVU
    2016-06-20 11:15 - 2015-11-28 10:32 - 00001949 _____ C:\Documents and Settings\Isabella\Desktop\IMVU.lnk
    2016-06-18 11:09 - 2011-08-26 20:51 - 00000000 ____D C:\Documents and Settings\Sophia\Local Settings\Temp
    2016-06-18 11:09 - 2011-08-26 19:59 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp
    2016-06-18 11:07 - 2011-08-27 08:47 - 00000000 ____D C:\Documents and Settings\Isabella
    2016-06-18 09:53 - 2016-04-14 07:37 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2016-06-18 09:53 - 2016-04-14 07:37 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2016-06-17 12:20 - 2015-06-18 20:27 - 00001825 ____C C:\Documents and Settings\Guest\Desktop\Google Chrome.lnk
    2016-06-17 12:20 - 2015-06-18 20:27 - 00000815 ____C C:\Documents and Settings\Guest\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2015-04-22 12:03 - 00001825 _____ C:\Documents and Settings\Heather\Desktop\Google Chrome.lnk
    2016-06-17 12:20 - 2015-04-17 18:26 - 00000815 _____ C:\Documents and Settings\Heather\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2011-08-26 20:51 - 00000815 _____ C:\Documents and Settings\Sophia\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 12:20 - 2008-08-22 13:06 - 00000779 ____C C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
    2016-06-17 03:12 - 2015-01-10 21:26 - 00000000 ____D C:\WINDOWS\system32\MRT
    2016-06-17 03:00 - 2011-09-08 23:52 - 139785240 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2016-06-16 16:16 - 2012-04-06 18:07 - 00796352 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
    2016-06-16 16:16 - 2011-09-09 19:04 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
    2016-06-16 09:25 - 2011-08-26 19:58 - 00000178 __SHC C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.ini
    2016-06-16 08:52 - 2011-11-04 21:59 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\ApplicationHistory
    2016-06-16 08:45 - 2008-08-22 13:06 - 00000000 __SHD C:\WINDOWS\CSC
    2016-06-15 14:21 - 2015-04-15 21:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2909212$
    2016-06-15 14:21 - 2015-04-15 21:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2510581$
    2016-06-15 14:21 - 2015-04-15 21:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2964358$
    2016-06-15 14:21 - 2015-04-15 21:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2936068$
    2016-06-15 14:21 - 2015-01-10 21:44 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868626$
    2016-06-15 14:21 - 2015-01-10 21:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2922229$
    2016-06-15 14:21 - 2015-01-10 21:42 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2916036$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2929961$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2900986$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2898715$
    2016-06-15 14:21 - 2015-01-10 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2847311$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$
    2016-06-15 14:21 - 2015-01-10 21:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2930275$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
    2016-06-15 14:21 - 2015-01-10 21:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862152$
    2016-06-15 14:21 - 2015-01-10 21:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876331$
    2016-06-15 14:21 - 2015-01-10 21:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
    2016-06-15 14:21 - 2015-01-10 21:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
    2016-06-15 14:21 - 2015-01-10 21:31 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893294$
    2016-06-15 14:21 - 2015-01-10 21:25 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2892075$
    2016-06-15 14:21 - 2015-01-10 21:25 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$
    2016-06-15 14:21 - 2015-01-10 21:16 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$
    2016-06-15 14:21 - 2013-04-14 13:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2820917$
    2016-06-15 14:21 - 2013-04-14 13:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2808735$
    2016-06-15 14:21 - 2013-04-14 13:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2813345$
    2016-06-15 14:21 - 2013-04-14 13:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2813170$
    2016-06-15 14:21 - 2013-03-24 09:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB939683$
    2016-06-15 14:21 - 2013-03-24 09:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB929399$
    2016-06-15 14:21 - 2013-03-24 09:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB954154_WM11$
    2016-06-15 14:21 - 2013-03-17 00:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2807986$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2799494$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2778344$
    2016-06-15 14:21 - 2013-03-08 12:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2758857$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2802968$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2780091$
    2016-06-15 14:21 - 2013-03-08 12:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2779562$
    2016-06-15 14:21 - 2013-03-08 12:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2753842-v2$
    2016-06-15 14:21 - 2013-03-08 12:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2770660$
    2016-06-15 14:21 - 2013-03-08 12:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2757638$
    2016-06-15 14:21 - 2012-11-29 19:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2761226$
    2016-06-15 14:21 - 2012-11-29 19:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2727528$
    2016-06-15 14:21 - 2012-10-12 20:47 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2724197$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2756822$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2749655$
    2016-06-15 14:21 - 2012-10-12 20:45 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2661254-v2$
    2016-06-15 14:21 - 2012-09-22 09:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2736233$
    2016-06-15 14:21 - 2012-08-18 03:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2731847$
    2016-06-15 14:21 - 2012-08-18 03:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2712808$
    2016-06-15 14:21 - 2012-08-18 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2705219$
    2016-06-15 14:21 - 2012-08-18 03:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2723135$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2719985$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2718523$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2691442$
    2016-06-15 14:21 - 2012-07-14 03:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2655992$
    2016-06-15 14:21 - 2012-07-14 03:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2698365$
    2016-06-15 14:21 - 2012-06-13 20:40 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2707511$
    2016-06-15 14:21 - 2012-06-13 20:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2685939$
    2016-06-15 14:21 - 2012-06-13 20:32 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2709162$
    2016-06-15 14:21 - 2012-06-09 03:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2718704$
    2016-06-15 14:21 - 2012-05-11 14:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2695962$
    2016-06-15 14:21 - 2012-05-11 14:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2676562$
    2016-06-15 14:18 - 2016-04-10 09:26 - 00000000 ____D C:\Documents and Settings\Isabella\Start Menu\ByteFence
    2016-06-15 14:15 - 2011-08-26 20:51 - 00000000 ___RD C:\Documents and Settings\Sophia\My Documents
    2016-06-15 13:46 - 2016-04-14 07:34 - 00000000 ____D C:\SUPERDelete
    2016-06-14 18:12 - 2016-04-14 07:25 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2016-06-14 16:48 - 2008-08-22 05:45 - 00000000 ___HD C:\WINDOWS\inf
    2016-06-14 13:17 - 2012-03-10 12:25 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\Deployment
    2016-06-14 12:28 - 2016-04-14 04:01 - 00769698 _____ C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1177238915-823518204-1644491937-1004-0.dat
    2016-06-14 12:28 - 2016-04-14 04:01 - 00207690 _____ C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    2016-06-14 12:17 - 2016-04-03 18:35 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\translate-65e7cca1b27e50ede238fedb48951a63
    2016-06-14 12:17 - 2016-04-03 18:35 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\emoticons-c6fcecc50023c7b811f3454d9d5636c0
    2016-06-14 12:17 - 2016-04-03 18:28 - 00000000 ____D C:\Documents and Settings\Isabella\Application Data\instagram-65e4ac1c5edb34c0da5ebbeca821d5af
    2016-06-14 12:10 - 2011-08-26 19:59 - 00000000 __SHD C:\Documents and Settings\LocalService.NT AUTHORITY
    2016-06-14 11:38 - 2016-04-03 18:22 - 00001616 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk
    2016-06-14 11:38 - 2016-04-03 18:22 - 00001616 ____R C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk
    2016-06-14 11:38 - 2015-04-16 07:13 - 00001659 ____R C:\Documents and Settings\Isabella\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk
    2016-06-13 15:28 - 2016-04-14 07:22 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
    2016-06-13 15:26 - 2016-04-10 09:26 - 00065536 _____ C:\WINDOWS\system32\config\Reason.evt
    2016-06-13 15:21 - 2011-08-26 12:38 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS
    2016-06-13 15:20 - 2010-03-23 15:00 - 00000000 ____D C:\Program Files\Auslogics
    2016-06-13 14:56 - 2016-04-10 09:16 - 00000344 __RSH C:\Documents and Settings\All Users.WINDOWS\ntuser.pol
    2016-06-13 14:07 - 2016-05-11 20:05 - 00000000 ____D C:\Program Files\Common Files\COMODO
    2016-06-13 11:22 - 2015-04-17 17:54 - 00000000 ____D C:\Documents and Settings\Heather\Local Settings\Temp
    2016-05-30 12:43 - 2016-05-06 20:37 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\RobloxVersions
    2016-05-30 12:28 - 2012-04-07 21:53 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
    2016-05-30 12:28 - 2012-04-07 21:53 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
    2016-05-29 14:15 - 2016-05-06 20:37 - 00000000 ____D C:\Documents and Settings\Isabella\Local Settings\Application Data\RobloxDownloads
    2016-05-23 23:25 - 2016-04-14 07:24 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
     
    ==================== Bamital & volsnap =================
     
    (There is no automatic fix for files that do not pass verification.)
     
    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
     
    ==================== End of FRST.txt ============================
     
    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-06-2016 01
    Ran by Isabella (2016-06-22 20:38:54)
    Running from C:\Documents and Settings\Isabella\My Documents\Downloads\New Folder
    Microsoft Windows XP Professional Service Pack 3 (X86) (2011-08-27 14:52:56)
    Boot Mode: Normal
    ==========================================================
     
     
    ==================== Accounts: =============================
     
    Administrator (S-1-5-21-1177238915-823518204-1644491937-500 - Administrator - Enabled)
    ASPNET (S-1-5-21-1177238915-823518204-1644491937-1007 - Limited - Enabled)
    Gabriella (S-1-5-21-1177238915-823518204-1644491937-1005 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Gabriella
    Guest (S-1-5-21-1177238915-823518204-1644491937-501 - Limited - Disabled) => %SystemDrive%\Documents and Settings\Guest
    Heather (S-1-5-21-1177238915-823518204-1644491937-1009 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Heather
    HelpAssistant (S-1-5-21-1177238915-823518204-1644491937-1000 - Limited - Disabled)
    Isabella (S-1-5-21-1177238915-823518204-1644491937-1004 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Isabella
    Sophia (S-1-5-21-1177238915-823518204-1644491937-1006 - Limited - Enabled) => %SystemDrive%\Documents and Settings\Sophia
    SUPPORT_388945a0 (S-1-5-21-1177238915-823518204-1644491937-1002 - Limited - Disabled)
     
    ==================== Security Center ========================
     
    (If an entry is included in the fixlist, it will be removed.)
     
     
    ==================== Installed Programs ======================
     
    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
     
    Adobe Flash Player 22 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)
    Adobe Flash Player 22 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
    Clean Master (HKLM\...\Clean Master) (Version: 1.0 - Cheetah Mobile)
    Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.2.6793.01 - Dell)
    Dell System Detect (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\58d94f3ce2c27db0) (Version: 7.3.0.6 - Dell)
    Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
    Google Update Helper (Version: 1.3.21.169 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.30.3 - Google Inc.) Hidden
    IMVU Avatar Chat Software (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\IMVU Avatar chat client software BETA) (Version:  - )
    Intel® Graphics Media Accelerator Driver (HKLM\...\{8A708DD8-A5E6-11D4-A706-000629E95E20}) (Version: 6.14.10.4543 - )
    JSWPFCom (Version: 1.07.0000 - JumpStart World) Hidden
    JSWPFGrade1 (Version: 1.07.0000 - JumpStart World) Hidden
    Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
    Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
    Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
    Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
    Microsoft Office Professional Edition 2003 (HKLM\...\{91E30409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
    Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version:  - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
    Microsoft WinUsb 2.0 (HKLM\...\winusb0200) (Version:  - Microsoft Corporation)
    Mozilla Firefox 47.0 (x86 en-US) (HKLM\...\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 47.0.0.5999 - Mozilla)
    Realtek AC'97 Audio (HKLM\...\{FB08F381-6533-4108-B7DD-039E11FBC27E}) (Version: 5.33 - Realtek Semiconductor Corp.)
    RNX-MiniN1 Wireless LAN Driver and Utility (HKLM\...\{9C049499-055C-4a0c-A916-1D12314F45EB}) (Version: 1.00.0179 - Rosewill Inc)
    SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 5.12.01.5246 - Analog Devices)
    SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1216 - SUPERAntiSpyware.com)
    Translate (HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\translate-65e7cca1b27e50ede238fedb48951a63) (Version: 1.2.2 - Dzexon)
    Unity Web Player (HKLM\...\UnityWebPlayer) (Version: 2.1.0f5_16147 - Unity Technologies ApS)
    WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
    Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version:  - )
    Windows Media Player 11 (HKLM\...\Windows Media Player) (Version:  - )
     
    ==================== Custom CLSID (Whitelisted): ==========================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    CustomCLSID: HKU\S-1-5-21-1177238915-823518204-1644491937-1004_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
     
    ==================== Scheduled Tasks (Whitelisted) =============
     
    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
     
     
    ==================== Shortcuts =============================
     
    (The entries could be listed to be restored or removed.)
     
    Shortcut: C:\Documents and Settings\Isabella\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk -> C:\Program Files\Internet Explorer\iexplore.bat (No File)
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Gооglе Сhrоmе.lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat (No File)
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\Program Files\Internet Explorer\iexplore.bat (No File)
    Shortcut: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Моzillа Firеfох.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat (No File)
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Gооglе Сhrоmе (2).lnk -> C:\Program Files\Google\Chrome\Application\chrome.bat (No File)
    Shortcut: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Моzillа Firеfох.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat (No File)
     
    ShortcutWithArgument: C:\Documents and Settings\Isabella\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://navigation.iwatchavi.com/
     
    ==================== Loaded Modules (Whitelisted) ==============
     
    2012-04-14 16:53 - 2009-12-09 21:20 - 00126976 _____ () C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\EnumDevLib.dll
    2012-04-14 16:53 - 2007-07-12 11:11 - 01163264 _____ () C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\acAuth.dll
     
    ==================== Alternate Data Streams (Whitelisted) =========
     
    (If an entry is included in the fixlist, only the ADS will be removed.)
     
     
    ==================== Safe Mode (Whitelisted) ===================
     
    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
     
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
     
    ==================== Association (Whitelisted) ===============
     
    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)
     
     
    ==================== Internet Explorer trusted/restricted ===============
     
    (If an entry is included in the fixlist, it will be removed from the registry.)
     
    IE trusted site: HKU\S-1-5-19\...\clonewarsadventures.com -> clonewarsadventures.com
    IE trusted site: HKU\S-1-5-19\...\freerealms.com -> freerealms.com
    IE trusted site: HKU\S-1-5-19\...\soe.com -> soe.com
    IE trusted site: HKU\S-1-5-19\...\sony.com -> sony.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\dell.com -> dell.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\driversupport.com -> hxxp://apps.driversupport.com
    IE trusted site: HKU\S-1-5-21-1177238915-823518204-1644491937-1004\...\driversupport.com -> hxxps://apps.driversupport.com
     
    ==================== Hosts content: ==========================
     
    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)
     
    2008-04-14 00:00 - 2016-06-15 14:08 - 00000914 ____N C:\WINDOWS\system32\Drivers\etc\hosts
     
    127.0.0.1       localhost
    127.0.0.1       down.baidu2016.com
    127.0.0.1       123.sogou.com
    127.0.0.1       www.czzsyzgm.com
    127.0.0.1       www.czzsyzxl.com
    127.0.0.1       union.baidu2019.com
     
    ==================== Other Areas ============================
     
    (Currently there is no automatic fix for this section.)
     
    HKU\S-1-5-21-1177238915-823518204-1644491937-1004\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Isabella\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    DNS Servers: 75.75.75.75 - 75.75.76.76
    Windows Firewall is enabled.
     
    ==================== MSCONFIG/TASK MANAGER disabled items ==
     
    (Currently there is no automatic fix for this section.)
     
     
    ==================== FirewallRules (Whitelisted) ===============
     
    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    StandardProfile\AuthorizedApplications: [C:\Program Files\RNX-MiniN1\11n USB Wireless LAN Utility\RtWLan.exe] => Enabled:RtWlan
    StandardProfile\AuthorizedApplications: [C:\Program Files\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Local Settings\Application Data\Akamai\netsession_win.exe] => Enabled:Akamai NetSession Client
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe] => Enabled:EBook Codec Downloader
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FormatFactory.exe] => Enabled:Format Factory
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\Desktop\FormatFactory\FFModules\Package\PTInstOnline.exe] => Enabled:Picosmos Tools Downloader
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Isabella\My Documents\Downloads\solutoinstaller.exe] => Enabled:SolutoInstaller
    StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Program Files\Mozilla Firefox)
    StandardProfile\GloballyOpenPorts: [1542:UDP] => Enabled:Realtek WPS UDP Prot
    StandardProfile\GloballyOpenPorts: [53:UDP] => Enabled:Realtek AP UDP Prot
    StandardProfile\GloballyOpenPorts: [135:TCP] => Enabled:TCP Port 135
    StandardProfile\GloballyOpenPorts: [5000:TCP] => Enabled:TCP Port 5000
    StandardProfile\GloballyOpenPorts: [5001:TCP] => Enabled:TCP Port 5001
    StandardProfile\GloballyOpenPorts: [5002:TCP] => Enabled:TCP Port 5002
    StandardProfile\GloballyOpenPorts: [5003:TCP] => Enabled:TCP Port 5003
    StandardProfile\GloballyOpenPorts: [5004:TCP] => Enabled:TCP Port 5004
    StandardProfile\GloballyOpenPorts: [5005:TCP] => Enabled:TCP Port 5005
    StandardProfile\GloballyOpenPorts: [5006:TCP] => Enabled:TCP Port 5006
    StandardProfile\GloballyOpenPorts: [5007:TCP] => Enabled:TCP Port 5007
    StandardProfile\GloballyOpenPorts: [5008:TCP] => Enabled:TCP Port 5008
    StandardProfile\GloballyOpenPorts: [5009:TCP] => Enabled:TCP Port 5009
    StandardProfile\GloballyOpenPorts: [5010:TCP] => Enabled:TCP Port 5010
    StandardProfile\GloballyOpenPorts: [5011:TCP] => Enabled:TCP Port 5011
    StandardProfile\GloballyOpenPorts: [5012:TCP] => Enabled:TCP Port 5012
    StandardProfile\GloballyOpenPorts: [5013:TCP] => Enabled:TCP Port 5013
    StandardProfile\GloballyOpenPorts: [5014:TCP] => Enabled:TCP Port 5014
    StandardProfile\GloballyOpenPorts: [5015:TCP] => Enabled:TCP Port 5015
    StandardProfile\GloballyOpenPorts: [5016:TCP] => Enabled:TCP Port 5016
    StandardProfile\GloballyOpenPorts: [5017:TCP] => Enabled:TCP Port 5017
    StandardProfile\GloballyOpenPorts: [5018:TCP] => Enabled:TCP Port 5018
    StandardProfile\GloballyOpenPorts: [5019:TCP] => Enabled:TCP Port 5019
    StandardProfile\GloballyOpenPorts: [5020:TCP] => Enabled:TCP Port 5020
    StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22007
    StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [80:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [443:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [20010:UDP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [3478:UDP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7850:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7852:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [7853:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [27022:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [6881:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [33333:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [20443:TCP] => Enabled:War Thunder
    StandardProfile\GloballyOpenPorts: [8090:TCP] => Enabled:War Thunder
     
    ==================== Restore Points =========================
     
    19-06-2016 21:36:50 System Checkpoint
    21-06-2016 21:15:13 System Checkpoint
     
    ==================== Faulty Device Manager Devices =============
     
     
    ==================== Event log errors: =========================
     
    Application errors:
    ==================
    Error: (06/22/2016 08:07:25 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 08:07:25 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 07:44:55 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 07:44:55 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 06:12:25 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 06:12:25 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 06:11:55 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 06:11:55 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 04:59:50 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.
     
    Error: (06/22/2016 04:59:50 PM) (Source: Userenv) (EventID: 1041) (User: NT AUTHORITY)
    Description: Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.
     
     
    System errors:
    =============
    Error: (06/22/2016 08:33:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Clean Master Core Service service terminated unexpectedly.  It has done this 1 time(s).
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for Security with the following error: 
    %%5 = Access is denied.
     
     
    Error: (06/22/2016 11:31:53 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
    Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
    %%5 = Access is denied.
     
     
     
    ==================== Memory info =========================== 
     
    Processor:  Intel® Pentium® 4 CPU 3.00GHz
    Percentage of memory in use: 31%
    Total physical RAM: 2038.07 MB
    Available physical RAM: 1397.5 MB
    Total Virtual: 3412.69 MB
    Available Virtual: 2922.18 MB
     
    ==================== Drives ================================
     
    Drive c: () (Fixed) (Total:74.5 GB) (Free:30.54 GB) NTFS ==>[drive with boot components (Windows XP)]
     
    ==================== MBR & Partition Table ==================
     
    ========================================================
    Disk: 0 (MBR Code: Windows XP) (Size: 74.5 GB) (Disk ID: B174B174)
    Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
     
    ==================== End of Addition.txt ============================
     
    ComboFix 16-06-01.01 - Isabella 06/22/2016  20:48:01.1.2 - x86
    Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2038.1688 [GMT -7:00]
    Running from: C:\Documents and Settings\Isabella\My Documents\Downloads\ComboFix.exe
     
    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
     

    • 0

    #8
    RKinner

    RKinner

      Malware Expert

    • Expert
    • 20,025 posts
    • MVP

    We got rid of some of it but it's putting up a fight.

     

    What happened when you ran Combofix?

    Try it again and see if it will install the Recovery Console.

     

     

    Let's see what Process Explorer sees:

     

    Get Process Explorer
     
    Save it to your desktop then run it (Vista or Win7 - right click and Run As Administrator).  
     
    View, Select Column, check Verified Signer, OK
    Options, Verify Image Signatures
     
     
    Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  
     
    Wait a full minute then:
     
    File, Save As, Save.  Note the file name.   Open the file  on your desktop and copy and paste the text to a reply.
     
    Also let's try aswmbr:
     


    Download aswMBR.exe  to your desktop.
    Right click on aswMBR.exe and Run As ADmin
    uncheck trace disk IO calls
    Change the Quickscan to C:\
     (Allow the Avast engine download if asked) Click the "Scan" button to start scan
    On completion of the scan (Note if the Fix button is enabled (not the FixMBR button) and tell me) click save log, save it to your desktop and post in your next reply
     

    • 0

    #9
    izzykins17

    izzykins17

      Member

    • Topic Starter
    • Member
    • PipPip
    • 11 posts
    ComboFix 16-06-01.01 - Isabella 06/23/2016   7:21:09.2.2 - x86
    Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2038.1510 [GMT -7:00]
    Running from: C:\Documents and Settings\Isabella\My Documents\Downloads\ComboFix.exe
     
    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
     
    Process CPU Private Bytes Working Set PID Description Company Name Verified Signer
    alg.exe 1,152 K 1,912 K 688 Application Layer Gateway Service Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    chrome.exe 1,844 K 1,944 K 3772 Google Chrome Google Inc. (Verified) Google Inc
    chrome.exe 58,592 K 66,140 K 2632 Google Chrome Google Inc. (Verified) Google Inc
    csrss.exe 1,708 K 3,252 K 800 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    explorer.exe 14,424 K 23,404 K 3136 Windows Explorer Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    hkcmd.exe 744 K 1,832 K 1180 hkcmd Module Intel Corporation (Verified) Microsoft Windows Hardware Compatibility Publisher
    lsass.exe 3,784 K 740 K 880 LSA Shell (Export Version) Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    MPCProtectService.exe 6,524 K 5,992 K 1964 MPC Protect Service DotC United Inc (Verified) DotCash Limited
    MPCTray.exe 14,144 K 8,920 K 376 MPC Tray DotC United Inc (Verified) DotCash Limited
    RtWLan.exe 7,056 K 4,532 K 1344 RtWLan ( For WinXP/2003) Application Realtek Semiconductor Corp. (No signature was present in the subject) Realtek Semiconductor Corp.
    SASCore.exe 1,708 K 1,176 K 1908 Core Service SUPERAntiSpyware.com (Verified) SUPERAntiSpyware.com
    services.exe 1,692 K 2,896 K 868 Services and Controller app Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    smss.exe 168 K 224 K 752 Windows NT Session Manager Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    spoolsv.exe 3,180 K 1,560 K 1756 Spooler SubSystem App Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    svchost.exe 3,036 K 2,612 K 1044 Generic Host Process for Win32 Services Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    svchost.exe 1,852 K 2,060 K 1092 Generic Host Process for Win32 Services Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    svchost.exe 1,336 K 1,872 K 1400 Generic Host Process for Win32 Services Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    svchost.exe 1,216 K 2,056 K 1428 Generic Host Process for Win32 Services Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    svchost.exe 1,468 K 1,752 K 1456 Generic Host Process for Win32 Services Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    svchost.exe 2,220 K 3,148 K 1472 Generic Host Process for Win32 Services Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    svchost.exe 2,352 K 1,664 K 428 Generic Host Process for Win32 Services Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    svchost.exe 18,832 K 18,272 K 1132 Generic Host Process for Win32 Services Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    System 0 K 116 K 4
    winlogon.exe 6,712 K 2,484 K 824 Windows NT Logon Application Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    wmiprvse.exe 1,968 K 5,844 K 388 WMI Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    wmiprvse.exe 1,808 K 4,924 K 3900 WMI Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    wscntfy.exe 564 K 1,448 K 1628 Windows Security Center Notification App Microsoft Corporation (Verified) Microsoft Windows Component Publisher
    Interrupts < 0.01 0 K 0 K n/a Hardware Interrupts and DPCs
    chrome.exe 0.77 92,524 K 100,176 K 2028 Google Chrome Google Inc. (Verified) Google Inc
    procexp.exe 1.54 18,344 K 25,216 K 3440 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation
    System Idle Process 97.69 0 K 16 K 0
     
    aswMBR version 1.0.1.2290 Copyright© 2014 AVAST Software
    Run date: 2016-06-23 07:30:36
    -----------------------------
    07:30:36.750    OS Version: Windows 5.1.2600 Service Pack 3
    07:30:36.750    Number of processors: 2 586 0x403
    07:30:36.750    ComputerName: DAVID-0A47797B5  UserName: Isabella
    07:30:37.468    Initialize success
    07:30:37.515    VM: initialized successfully
    07:30:37.515    VM: Intel CPU virtualization not supported 
    07:32:52.578    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e
    07:32:52.578    Disk 0 Vendor: WDC_WD800JD-75MSA3 10.01E04 Size: 76293MB BusType: 3
    07:32:52.812    Disk 0 MBR read successfully
    07:32:52.812    Disk 0 MBR scan
    07:32:52.812    Disk 0 Windows XP default MBR code
    07:32:52.843    Disk 0 Partition 1 80 (A) 07      HPFS/NTFS NTFS        76285 MB offset 63
    07:32:52.890    Disk 0 default boot code
    07:32:52.953    Disk 0 scanning sectors +156232125
    07:32:53.062    Disk 0 scanning C:\WINDOWS\system32\drivers
    07:32:59.921    Service scanning
    07:33:12.421    Modules scanning
    07:33:12.421    Disk 0 statistics 46212/0/0 @ 3.52 MB/s
    07:33:12.421    Scan finished successfully
    07:33:41.937    Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Isabella\My Documents\Downloads\MBR.dat"
    07:33:41.953    The log file has been saved successfully to "C:\Documents and Settings\Isabella\My Documents\Downloads\aswMBR.txt"
     
    The fix button was not enabled.

    • 0

    #10
    RKinner

    RKinner

      Malware Expert

    • Expert
    • 20,025 posts
    • MVP

    Run Process Explorer again and hit the space bar.  Click once on the Process Column Header.  This will sort the processes by name.  Find

     
    MPCProtectService.exe 
    MPCTray.exe 
     
     
    Right click on the first one and Suspend Process.
    Right click on the second one and Kill Process.
     
    If that works (neither comes back to life) then
     
     
    Download the attached fixlist.txt to the same location as FRST
     
    Attached File  fixlist.txt   1.92KB   72 downloads
     
    Run FRST and press Fix
    A fix log will be generated please post that 
     
     
    Run FRST again as before.  Make sure Addition.txt is checked and hit Scan.  Post both logs.
     
    If Process Express is unable to keep the MFC files from running then boot into Safe Mode with networking
    (Reboot and when you see the maker's logo, hear a beep or it talks about F8, start tapping the F8 key slowly.  Keep tapping until the Safe Mode Menu appears and choose Safe Mode with Networking.  Login with your usual login.)
     
    Then try and do the fixlist
     
    Also try renaming combofix.exe to george.exe and run it in safe mode.  If it asks to install the rescue console then tell it OK.
     
     
     

     


    • 0

    Advertisements


    #11
    izzykins17

    izzykins17

      Member

    • Topic Starter
    • Member
    • PipPip
    • 11 posts

    Access is denied and I cant suspend the process.   


    • 0

    #12
    RKinner

    RKinner

      Malware Expert

    • Expert
    • 20,025 posts
    • MVP

    OK.  Try it in Safe Mode with Networking.


    • 0

    #13
    izzykins17

    izzykins17

      Member

    • Topic Starter
    • Member
    • PipPip
    • 11 posts

    Then the processes don't show up.


    • 0

    #14
    RKinner

    RKinner

      Malware Expert

    • Expert
    • 20,025 posts
    • MVP

    That's the idea.  MFC doesn't run in Safe Mode so if you run FRST and do the fixlist thing in Safe Mode then it should be able to remove MFC.  If you can't get FRST to do a Fix in Safe Mode then try to get Combofix to run after renaming it to george.  If that doesn't work then try running msconfig.  See http://netsquirrel.c...sconfig_xp.html

     

    Once in msconfig look under Services and see if you can uncheck anything that starts with mfc then Apply.  Repeat for Startup.  Reboot and then try the fix. 

     


    • 0

    #15
    izzykins17

    izzykins17

      Member

    • Topic Starter
    • Member
    • PipPip
    • 11 posts

    I tried running FRST but no fixlist showed up after the scan and I still can see MPC start up everytime I turn on my computer.


    • 0






    Similar Topics

    0 user(s) are reading this topic

    0 members, 0 guests, 0 anonymous users

    As Featured On:

    Microsoft Yahoo BBC MSN PC Magazine Washington Post HP