[Sherry718]

It started with random tabs popping open in chrome. I checked my extensions but have very few and they seem innocuous so I reset chrome settings and that worked for a while.  A few days later, entirely new pages were opening in chrome. Malware Bytes is able to stop them from loading but not from opening.  In addition, I've noticed ads at the top of the google results page and above the ads it says RocketTab powered by xt-2.

Thanks for your help

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-06-2017 01

Ran by sherry (administrator) on SHERRY-PC (17-06-2017 19:55:18)

Running from C:\Users\sherry\Desktop

Loaded Profiles: sherry (Available Profiles: sherry)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 9 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(Acer Incorporated) C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

(Acer Incorporated) C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe

(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Gateway MyBackup\IScheduleSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Flux Software LLC) C:\Users\sherry\AppData\Local\FluxSoftware\Flux\flux.exe

(AOL Inc.) C:\Program Files (x86)\AOL 9.0\waol.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\Ymsgr_tray.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Gateway MyBackup\BackupManagerTray.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(AOL Inc.) C:\Program Files (x86)\Common Files\AOL\1344345328\ee\aolsoftware.exe

(AOL LLC) C:\Program Files (x86)\Common Files\AOL\acs\AOLacsd.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerEvent.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(AOL Inc.) C:\Program Files (x86)\AOL 9.0\shellmon.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Acer Incorporated) C:\Program Files\Gateway\Gateway Updater\ALU.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

==================== Registry (Whitelisted) ====================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12343400 2011-12-27] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2868496 2012-02-14] (Synaptics Incorporated)

HKLM\...\Run: [Power Management] => C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)

HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Gateway MyBackup\BackupManagerTray.exe [289816 2012-01-05] (NTI Corporation)

HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1106512 2012-03-02] (Dritek System Inc.)

HKLM-x32\...\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1344345328\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-347477782-969298193-3004215-1000\ DisallowedCertificates: 145FCBD24F5EDC1F8C44EFFA16BE739CB808DAF9 (U)

HKU\S-1-5-21-347477782-969298193-3004215-1000\ DisallowedCertificates: 9AAF24A4D6CA8CCDF64BBF916CBC77512A9B0CA7 (U)

HKU\S-1-5-21-347477782-969298193-3004215-1000\...\Run: [Messenger (Yahoo!)] => C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)

HKU\S-1-5-21-347477782-969298193-3004215-1000\...\Run: [Aim] => C:\Program Files (x86)\AIM\aim.exe [4331392 2012-05-30] (AOL Inc.)

HKU\S-1-5-21-347477782-969298193-3004215-1000\...\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL 9.0\AOL.EXE [50512 2011-08-04] (AOL Inc.)

HKU\S-1-5-21-347477782-969298193-3004215-1000\...\Run: [f.lux] => C:\Users\sherry\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)

HKU\S-1-5-21-347477782-969298193-3004215-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9532120 2017-04-10] (Piriform Ltd)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 167.206.13.180 167.206.13.181

Tcpip\..\Interfaces\{8F034D99-4ACF-4E6F-A43E-A3C94E818EAD}: [DhcpNameServer] 167.206.13.180 167.206.13.181

 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?pc=MAGW

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?pc=MAGW

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com/?pc=MAGW

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com/?pc=MAGW

HKU\S-1-5-21-347477782-969298193-3004215-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com/?pc=MAGW

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AGWTDF&pc=MAGW&src=IE-SearchBox

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AGWTDF&pc=MAGW&src=IE-SearchBox

SearchScopes: HKLM-x32 -> DefaultScope value is missing

SearchScopes: HKU\S-1-5-21-347477782-969298193-3004215-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)

BHO: No Name -> {EDBBE0D0-A76A-4FE4-AE6B-13BCEFFD75C8} -> No File

BHO-x32: IeVodPlugin.BHO -> {6e646953-24b9-4f74-a3c0-3fe83bc5ee22} -> C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

Toolbar: HKU\S-1-5-21-347477782-969298193-3004215-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://linksyssupport.webex.com/client/T27L10NSP32EP12-14988-PSOLINKSYS/support/ieatgpc1.cab

 

FireFox:

========

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)

FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2010-12-07] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-05-11] (Adobe Systems Inc.)

 

Chrome: 

=======

CHR DefaultProfile: Default

CHR Profile: C:\Users\sherry\AppData\Local\Google\Chrome\User Data\BackupDefault [2017-05-31] <==== ATTENTION

CHR Extension: (No Name) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\BackupDefault\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-30]

CHR Extension: (No Name) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\BackupDefault\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-11]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\BackupDefault\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-07-30]

CHR Extension: (No Name) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\BackupDefault\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-11]

CHR Extension: (No Name) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\BackupDefault\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-11]

CHR Extension: (Google Wallet) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\BackupDefault\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-11]

CHR Extension: (No Name) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\BackupDefault\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-11]

CHR Profile: C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default [2017-06-17]

CHR Extension: (Google Slides) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-07]

CHR Extension: (Google Docs) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-07]

CHR Extension: (Google Drive) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]

CHR Extension: (YouTube) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]

CHR Extension: (Google Search) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]

CHR Extension: (Google Sheets) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-07]

CHR Extension: (Google Docs Offline) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-22]

CHR Extension: (Unseen) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\iicapmagmhahddefgokbabbgieiogjop [2017-03-20]

CHR Extension: (Chrome Web Store Payments) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-11]

CHR Extension: (Gmail) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-31]

CHR Extension: (Chrome Media Router) - C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-13]

 

==================== Services (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S3 DCDhcpService; C:\Program Files (x86)\Gateway\WDAgent\DCDhcpService.exe [111776 2012-01-18] (Atheros Communication Inc.) [File not signed]

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)

R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Gateway MyBackup\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ======================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [43664 2014-12-06] ()

R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [22800 2012-02-14] (Synaptics Incorporated)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2017-06-17 19:55 - 2017-06-17 19:55 - 00016417 _____ C:\Users\sherry\Desktop\FRST.txt

2017-06-17 19:53 - 2017-06-17 19:55 - 00000000 ____D C:\FRST

2017-06-17 19:53 - 2017-06-17 19:53 - 02438656 _____ (Farbar) C:\Users\sherry\Desktop\FRST64.exe

2017-06-17 19:50 - 2017-06-17 19:50 - 02438656 _____ (Farbar) C:\Users\sherry\Downloads\FRST64.exe

2017-06-17 19:15 - 2017-06-17 19:15 - 00002266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2017-06-17 19:15 - 2017-06-17 19:15 - 00002254 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2017-06-17 19:14 - 2017-06-17 19:14 - 01130328 _____ (Google Inc.) C:\Users\sherry\Downloads\ChromeSetup.exe

2017-06-08 23:05 - 2017-06-08 23:05 - 03626104 _____ (Google) C:\Users\sherry\Downloads\chrome_cleanup_tool (1).exe

2017-06-04 14:05 - 2017-06-04 14:05 - 03625080 _____ (Google) C:\Users\sherry\Downloads\chrome_cleanup_tool.exe

2017-05-31 16:40 - 2017-05-31 16:40 - 00023518 _____ C:\Users\sherry\Documents\cc_20170531_163959.reg

2017-05-26 23:10 - 2017-05-26 23:10 - 00398066 _____ C:\Users\sherry\Documents\DSC01300.zip

2017-05-26 23:10 - 2017-05-26 23:10 - 00000000 ____D C:\Users\sherry\Documents\DSC01300

2017-05-26 09:58 - 2017-05-26 09:58 - 03905070 _____ C:\Users\sherry\Desktop\trumpshove.mp4

2017-05-22 20:56 - 2017-05-22 20:56 - 00272796 _____ C:\Users\sherry\Desktop\manche.mp4

2017-05-22 20:55 - 2017-05-22 20:55 - 00097052 _____ C:\Users\sherry\Desktop\manch.html

2017-05-22 20:55 - 2017-05-22 20:55 - 00000000 ____D C:\Users\sherry\Desktop\manch_files

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2017-06-17 19:53 - 2009-07-14 00:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2017-06-17 19:53 - 2009-07-14 00:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2017-06-17 19:18 - 2012-08-07 09:10 - 00000000 ____D C:\Users\sherry\AppData\Local\Google

2017-06-17 19:15 - 2013-11-03 21:50 - 00000000 ____D C:\Program Files (x86)\Google

2017-06-17 19:06 - 2017-05-13 14:12 - 00084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys

2017-06-15 02:05 - 2009-07-14 01:13 - 00714754 _____ C:\Windows\system32\PerfStringBackup.INI

2017-06-15 02:05 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf

2017-06-15 01:59 - 2017-05-13 14:12 - 00252832 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2017-06-15 01:59 - 2017-05-13 14:12 - 00113592 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys

2017-06-15 01:59 - 2017-05-13 14:12 - 00044960 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2017-06-15 01:59 - 2009-07-13 22:34 - 00000520 _____ C:\Windows\win.ini

2017-06-15 01:58 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2017-06-07 12:26 - 2017-05-13 14:12 - 00188312 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys

2017-06-07 12:25 - 2017-05-13 14:11 - 00077376 _____ C:\Windows\system32\Drivers\mbae64.sys

 

==================== Files in the root of some directories =======

 

2014-09-07 23:35 - 2014-09-07 23:35 - 0000000 _____ () C:\Users\sherry\AppData\Local\{B444DEE7-8AD9-4D72-B7BB-D6B723FD0A4C}

2012-05-21 10:49 - 2012-05-21 10:51 - 0002454 _____ () C:\ProgramData\clear.fiSDK20.log

2012-05-21 10:50 - 2012-05-21 10:50 - 0000032 _____ () C:\ProgramData\PS.log

 

Some files in TEMP:

====================

2011-07-29 02:40 - 2011-07-29 02:40 - 0148808 _____ (AOL Inc.) C:\Users\sherry\AppData\Local\Temp\AcsInstall.dll

2014-01-28 20:34 - 2014-01-02 12:52 - 0120912 _____ (RealNetworks, Inc.) C:\Users\sherry\AppData\Local\Temp\lowproc.exe

2014-11-08 04:33 - 2014-12-04 19:01 - 0601088 _____ () C:\Users\sherry\AppData\Local\Temp\Quarantine.exe

2003-10-23 14:27 - 2003-10-23 14:27 - 0022528 _____ (Microsoft Corporation) C:\Users\sherry\AppData\Local\Temp\SHFOLDER.DLL

2014-11-08 04:47 - 2014-10-17 07:39 - 0665682 _____ (SQLite Development Team) C:\Users\sherry\AppData\Local\Temp\sqlite3.dll

2014-01-28 20:34 - 2014-01-02 12:52 - 0090624 _____ (RealNetworks, Inc.) C:\Users\sherry\AppData\Local\Temp\stubhelper.dll

2012-08-13 23:26 - 2012-04-20 18:17 - 0225792 ____N () C:\Users\sherry\AppData\Local\Temp\uninst.dll

 

==================== Bamital & volsnap ======================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

LastRegBack: 2017-06-12 00:48

 

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-06-2017 01

Ran by sherry (17-06-2017 19:56:11)

Running from C:\Users\sherry\Desktop

Windows 7 Home Premium Service Pack 1 (X64) (2012-08-08 01:07:28)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-347477782-969298193-3004215-500 - Administrator - Disabled)

Guest (S-1-5-21-347477782-969298193-3004215-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-347477782-969298193-3004215-1002 - Limited - Enabled)

sherry (S-1-5-21-347477782-969298193-3004215-1000 - Administrator - Enabled) => C:\Users\sherry

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.03) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated)

Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden

AIM 7 (HKLM-x32\...\AIM_7) (Version:  - )

AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\...\AOL Uninstaller) (Version:  - AOL Inc.)

Backup Manager V3 (x32 Version: 3.0.0.100 - NTI Corporation) Hidden

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 15.0.6.2 - Broadcom Corporation)

Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 15.0.7.1 - Broadcom Corporation)

CCleaner (HKLM\...\CCleaner) (Version: 5.29 - Piriform)

Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden

Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Cisco WebEx Meetings (HKLM-x32\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)

clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.00.3003 - Acer Incorporated)

clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.00.3003 - Acer Incorporated)

clear.fi SDK - MVP 2 (x32 Version: 2.0.1415 - CyberLink Corp.) Hidden

clear.fi SDK- Movie 2 (x32 Version: 2.0.1406 - CyberLink Corp.) Hidden

Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

CyberLink MediaEspresso (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.1720_38230 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden

Evernote v. 4.5.2 (HKLM-x32\...\{F77EF646-19EB-11E1-9A9E-984BE15F174E}) (Version: 4.5.2.5866 - Evernote Corp.)

f.lux (HKU\S-1-5-21-347477782-969298193-3004215-1000\...\Flux) (Version:  - )

FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden

Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden

Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Gateway Games (HKLM-x32\...\WildTangent gateway Master Uninstall) (Version: 1.0.2.5 - WildTangent)

Gateway MyBackup (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.100 - NTI Corporation)

Gateway Power Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3010 - Gateway Incorporated)

Gateway Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3507 - Gateway Incorporated)

Gateway Registration (HKLM-x32\...\Gateway Registration) (Version: 1.04.3506 - Gateway Incorporated)

Gateway ScreenSaver (HKLM-x32\...\Gateway Screensaver) (Version: 1.1.0915.2011 - Gateway Incorporated)

Gateway Social Networks (HKLM-x32\...\InstallShield_{64EF903E-D00A-414C-94A4-FBA368FFCDC9}) (Version: 3.0.3106 - CyberLink Corp.)

Gateway Social Networks (x32 Version: 3.0.3106 - CyberLink Corp.) Hidden

GIMP 2.6.10 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.10 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 59.0.3071.104 - Google Inc.)

Google Earth (HKLM-x32\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden

Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden

Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Gateway Incorporated)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)

Intel® OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2653 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)

Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.13 - Gateway)

Malwarebytes version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.5139.5005 - Microsoft Corporation)

Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)

Nero DiscSpeed 10 (HKLM-x32\...\{34490F4E-48D0-492E-8249-B48BECF0537C}) (Version: 6.4.10500.1.100 - Nero AG)

Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.6.10700.5.100 - Nero AG)

Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{62BF4BD3-B1F6-4FA2-8388-CC0647ACBF86}) (Version: 10.6.10300 - Nero AG)

Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.6.10600.4.100 - Nero AG)

Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)

Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden

Qualcomm Atheros Direct Connect (x32 Version: 3.0 - Qualcomm Atheros) Hidden

Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 3.0 - Qualcomm Atheros)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6543 - Realtek Semiconductor Corp.)

Saver (x32 Version: 1.0.0.0 - savey.net) Hidden

Saver 1.0 (HKLM-x32\...\Saver) (Version: 1.0 - Saver) <==== ATTENTION

SHG Installation Vista Windows 7 (HKLM-x32\...\{6746C5C1-09E9-4BD2-B166-02F525215EEC}) (Version: 1.4.85 - SafeHarborGames.net)

Skype™ 5.5 (HKLM-x32\...\{AA59DDE4-B672-4621-A016-4C248204957A}) (Version: 5.5.117 - Skype Technologies S.A.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.41.5 - Synaptics Incorporated)

Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

Video Web Camera (HKLM-x32\...\InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}) (Version: 1.5.2108.00 - CyberLink Corp.)

Video Web Camera (x32 Version: 1.5.2108.00 - CyberLink Corp.) Hidden

Virtual Villagers 5 - New Believers (x32 Version: 2.2.0.97 - WildTangent) Hidden

Welcome Center (HKLM-x32\...\Gateway Welcome Center) (Version: 1.02.3507 - Gateway Incorporated)

WildTangent Games App (Gateway Games) (x32 Version: 4.0.5.32 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)

Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {0E7EB7B1-B409-49A4-BD50-C7BA4B665485} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)

Task: {0FECC875-4C1C-4AE2-ABD6-A59838AD74F6} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Gateway\Gateway Recovery Management\NotificationCenter\Notification.exe [2012-01-18] (Acer)

Task: {3A856728-FE33-4BCC-9905-101D8C328A17} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-05-20] (CyberLink)

Task: {4C7C1546-E15D-4896-B7BA-9537B8BC8FFE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)

Task: {98152A5B-8D76-43A0-A041-EFC9CB98A7B9} - System32\Tasks\UALU notificatin => C:\Program Files\Gateway\Gateway Updater\UALU.exe [2012-02-06] (Acer Incorporated)

Task: {9CA7EB37-3F15-46D7-AB23-9799B6C9FFCE} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-04-10] (Piriform Ltd)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

 

==================== Shortcuts & WMI ========================

 

(The entries could be listed to be restored or removed.)

 

 

ShortcutWithArgument: C:\Users\Public\Desktop\Netflix.lnk -> C:\ProgramData\OEM_E471269A730D\Netflix\StartURL.exe () -> hxxp://homepage.gateway.com/redirect.aspx?rid=09000002

 

==================== Loaded Modules (Whitelisted) ==============

 

2012-03-19 03:02 - 2012-02-14 13:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2017-04-07 03:41 - 2017-04-07 03:41 - 00054488 _____ () C:\Program Files\CCleaner\branding.dll

2017-06-17 19:15 - 2017-06-15 03:29 - 03807064 _____ () C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.104\libglesv2.dll

2017-06-17 19:15 - 2017-06-15 03:29 - 00100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.104\libegl.dll

2017-06-16 18:05 - 2017-06-16 18:05 - 31133184 _____ () C:\Users\sherry\AppData\Local\Google\Chrome\User Data\PepperFlash\26.0.0.131\pepflashplayer.dll

2012-01-05 17:22 - 2012-01-05 17:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Gateway MyBackup\sqlite3.dll

2012-01-05 17:22 - 2012-01-05 17:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Gateway MyBackup\ACE.dll

2012-01-05 17:22 - 2012-01-05 17:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Gateway MyBackup\MailConverter32.dll

2011-08-04 17:23 - 2011-08-04 17:23 - 00045056 _____ () C:\Program Files (x86)\AOL 9.0\zlib.dll

2011-08-04 17:23 - 2011-08-04 17:23 - 00053248 _____ () C:\Program Files (x86)\AOL 9.0\xmlparse.dll

2011-08-04 17:23 - 2011-08-04 17:23 - 00081920 _____ () C:\Program Files (x86)\AOL 9.0\xmltok.dll

2012-08-12 19:47 - 2012-05-25 04:25 - 00921600 _____ () C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

2012-03-19 02:21 - 2012-03-19 02:21 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\f60e9ba23f7e809458b53f5becdbd201\IsdiInterop.ni.dll

2012-03-19 02:21 - 2012-02-01 19:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

2012-05-21 10:39 - 2012-02-07 21:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

AlternateDataStreams: C:\ProgramData\Temp:373E1720 [131]

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sndappv2 => ""="service"

 

==================== Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

IE restricted site: HKU\S-1-5-21-347477782-969298193-3004215-1000\...\123-template.com -> hxxp://123-template.com

IE restricted site: HKU\S-1-5-21-347477782-969298193-3004215-1000\...\adnxs.com -> hxxp://ib.adnxs.com

IE restricted site: HKU\S-1-5-21-347477782-969298193-3004215-1000\...\kareeza.com -> hxxp://post.kareeza.com

IE restricted site: HKU\S-1-5-21-347477782-969298193-3004215-1000\...\pubmatic.com -> hxxp://ads.pubmatic.com

IE restricted site: HKU\S-1-5-21-347477782-969298193-3004215-1000\...\yieldmanager.com -> hxxp://ad.yieldmanager.com

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-347477782-969298193-3004215-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\sherry\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 167.206.13.180 - 167.206.13.181

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{7A46C67F-EB5F-4559-9B17-12D38A35DC24}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{9FFDE226-F7C2-4D2F-BA5C-9B2912351A60}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{B1F3AE02-8B56-439E-9346-3D5E00DD9724}] => (Allow) LPort=2869

FirewallRules: [{4E05DCD1-FF50-4D87-9DB1-238E7CD5515D}] => (Allow) LPort=1900

FirewallRules: [{5CE72A02-6A81-4C2C-ADA3-D71418A5F5AF}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{B73E93CB-3624-4982-9CF6-F06D1062370A}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

FirewallRules: [{79B93EA3-437E-45F9-B8EB-F08DB4069B17}] => (Allow) C:\Program Files (x86)\Gateway\WDAgent\DCDhcpService.exe

FirewallRules: [{B9E73F02-C99E-43D8-98A1-7009AB209E90}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\DMCDaemon.exe

FirewallRules: [{D983CD5A-2DB4-4A2A-A2B3-6CC1C9EE3F72}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\DMCDaemon.exe

FirewallRules: [{422AB09B-75FB-414D-96E5-720AE1D51BD7}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\WindowsUpnpMV.exe

FirewallRules: [{A9C081AE-767A-470F-83DC-B454A2DED31D}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\WindowsUpnpMV.exe

FirewallRules: [{305753E4-C8CE-432B-9D69-B937ADA01C1C}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\DMCDaemon.exe

FirewallRules: [{339EB311-E1E8-41B5-BE26-60B665BA5C65}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\DMCDaemon.exe

FirewallRules: [{2388D73B-D011-4603-BE54-12AA481345CE}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\WindowsUpnp.exe

FirewallRules: [{BCE2F79C-1550-424D-869E-C6EAEC4B27A4}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\WindowsUpnp.exe

FirewallRules: [{63010025-697B-4ACD-A37E-02967B2A4156}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK20\MVP\VideoPlayer.exe

FirewallRules: [{EE45CB9C-8E53-4D5B-BCC9-6BDA9968E853}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK20\MVP\MusicPlayer.exe

FirewallRules: [{9F09CC8B-1AAE-4DC8-92F2-8C5138893E3C}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLDial.exe

FirewallRules: [{F31BA990-D048-4526-9C86-9AA74E58CEA4}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLDial.exe

FirewallRules: [{94E5DAE0-E3B9-4D89-88E9-77D0C4DDE386}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLacsd.exe

FirewallRules: [{298171A6-6218-4A92-861A-B7AC41059BBC}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLacsd.exe

FirewallRules: [{6C79FCE8-DF5B-4162-9A7B-8CD56408970F}] => (Allow) C:\Program Files (x86)\Common Files\AOL\1344345328\ee\aolsoftware.exe

FirewallRules: [{AB4D6CDF-5F36-44B9-895D-C999F1F317DC}] => (Allow) C:\Program Files (x86)\Common Files\AOL\1344345328\ee\aolsoftware.exe

FirewallRules: [{C11FDB4F-FCF2-473A-ABAB-D31A6D152201}] => (Allow) C:\Program Files (x86)\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe

FirewallRules: [{5A599731-580A-4D48-9F20-07E88CC6F619}] => (Allow) C:\Program Files (x86)\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe

FirewallRules: [{EC6D69EB-D12C-4579-8C31-3CB75097F981}] => (Allow) C:\Program Files (x86)\Common Files\AOL\Loader\aolload.exe

FirewallRules: [{162D40F2-E378-4FEF-ADA7-7DEFE377E4E6}] => (Allow) C:\Program Files (x86)\Common Files\AOL\Loader\aolload.exe

FirewallRules: [{926C5832-F321-4872-A9CB-304B76AD5C29}] => (Allow) C:\Program Files (x86)\Common Files\AOL\System Information\sinf.exe

FirewallRules: [{B9B1520B-48F8-4756-9658-776D9DE6D061}] => (Allow) C:\Program Files (x86)\Common Files\AOL\System Information\sinf.exe

FirewallRules: [{9EB5599E-67B2-4B99-8717-2DBC674C5B90}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{A49295AC-B6B3-4047-8BBD-D7C8E5B1FDC5}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{5161DD04-F3ED-4E16-B8C7-12CBE0248A86}] => (Allow) C:\Program Files (x86)\AOL 9.0\waol.exe

FirewallRules: [{DFC4E77A-C2F4-44B2-AE27-19131C936E3D}] => (Allow) C:\Program Files (x86)\AOL 9.0\waol.exe

FirewallRules: [{3B8BE374-8614-4D16-9F05-B6CD56DA6BF1}] => (Allow) C:\Program Files (x86)\AIM\aim.exe

FirewallRules: [{A3DA9BE2-AE8B-4659-AA5F-8EEDE6F9E918}] => (Allow) C:\Program Files (x86)\AIM\aim.exe

FirewallRules: [{421033DA-934E-4122-BF9B-A10C4740AD2F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

==================== Restore Points =========================

 

20-05-2017 00:35:47 Scheduled Checkpoint

27-05-2017 05:59:09 Scheduled Checkpoint

04-06-2017 00:00:03 Scheduled Checkpoint

11-06-2017 00:00:05 Scheduled Checkpoint

 

==================== Faulty Device Manager Devices =============

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (06/16/2017 09:50:20 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 02:09:18 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 02:01:47 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 02:01:47 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 02:01:47 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 02:01:46 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 02:01:46 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 02:01:46 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 02:01:46 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

 

Error: (06/15/2017 01:59:19 AM) (Source: Windows Search Service) (EventID: 7010) (User: )

Description: The index cannot be initialized.

 

Details:

The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

 

 

System errors:

=============

Error: (06/15/2017 01:59:20 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.

 

Error: (06/15/2017 01:59:20 AM) (Source: Service Control Manager) (EventID: 7024) (User: )

Description: The Windows Search service terminated with service-specific error %%-1073473535.

 

Error: (06/15/2017 01:58:38 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 1:56:19 AM on ‎6/‎15/‎2017 was unexpected.

 

Error: (06/08/2017 07:13:50 AM) (Source: iaStor) (EventID: 9) (User: )

Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

 

Error: (06/07/2017 05:24:56 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

 

Error: (06/06/2017 05:50:03 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EapHost service.

 

Error: (05/26/2017 11:25:34 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.

 

Error: (05/26/2017 11:25:34 AM) (Source: Service Control Manager) (EventID: 7024) (User: )

Description: The Windows Search service terminated with service-specific error %%-1073473535.

 

Error: (05/26/2017 11:22:51 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 11:21:34 AM on ‎5/‎26/‎2017 was unexpected.

 

Error: (05/19/2017 04:15:50 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the fdPHost service.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Pentium® CPU B950 @ 2.10GHz

Percentage of memory in use: 48%

Total physical RAM: 3932.36 MB

Available physical RAM: 2015.18 MB

Total Virtual: 7862.91 MB

Available Virtual: 5560.9 MB

 

==================== Drives ================================

 

Drive c: (Gateway) (Fixed) (Total:447.66 GB) (Free:401.18 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 86489292)

Partition 1: (Not Active) - (Size=18 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=447.7 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

 

[Advertisements]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

programs to remove
Saver 1.0

Next

Download AdwCleaner from here. Save the file to the desktop.
NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.

• XP users: Double click the AdwCleaner icon to start the program.
• Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
  You will see the following console:

• Click the Scan button and wait for the scan to finish.
• After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Pending. Please uncheck elements you don't want to remove.
• Click the Clean button.
• Everything checked will be moved to Quarantine.
• When the program has finished cleaning a report appears.Once done it will ask to reboot, allow this

• On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt

[zep516]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

programs to remove
Saver 1.0

Next

Download AdwCleaner from here. Save the file to the desktop.
NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.

• XP users: Double click the AdwCleaner icon to start the program.
• Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
  You will see the following console:

• Click the Scan button and wait for the scan to finish.
• After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Pending. Please uncheck elements you don't want to remove.
• Click the Clean button.
• Everything checked will be moved to Quarantine.
• When the program has finished cleaning a report appears.Once done it will ask to reboot, allow this

• On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt

[Sherry718]

Hi zep, 

I decided to blame an extension called Unseen and I uninstalled it and my issues seem to have disappeared but here's the scan

 

# AdwCleaner v6.047 - Logfile created 18/06/2017 at 16:40:32

# Updated on 19/05/2017 by Malwarebytes

# Database : 2017-06-18.1 [Local]

# Operating System : Windows 7 Home Premium Service Pack 1 (X64)

# Username : sherry - SHERRY-PC

# Running from : C:\Users\sherry\Desktop\adwcleaner_6.047.exe

# Mode: Clean

# Support : https://www.malwarebytes.com/support

 

 

 

***** [ Services ] *****

 

 

 

***** [ Folders ] *****

 

[-] Folder deleted: C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Extensions\iicapmagmhahddefgokbabbgieiogjop

 

 

***** [ Files ] *****

 

[-] File deleted: C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_iicapmagmhahddefgokbabbgieiogjop_0.localstorage

 

 

***** [ DLL ] *****

 

 

 

***** [ WMI ] *****

 

 

 

***** [ Shortcuts ] *****

 

 

 

***** [ Scheduled Tasks ] *****

 

 

 

***** [ Registry ] *****

 

 

 

***** [ Web browsers ] *****

 

[-] [C:\Users\sherry\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: iicapmagmhahddefgokbabbgieiogjop

 

 

*************************

 

:: "Tracing" keys deleted

:: Winsock settings cleared

 

*************************

 

C:\AdwCleaner\AdwCleaner[C0].txt - [2101 Bytes] - [13/05/2017 22:27:49]

C:\AdwCleaner\AdwCleaner[C2].txt - [1256 Bytes] - [18/06/2017 16:40:32]

C:\AdwCleaner\AdwCleaner[R0].txt - [10472 Bytes] - [09/03/2014 10:38:21]

C:\AdwCleaner\AdwCleaner[R1].txt - [1678 Bytes] - [06/12/2014 11:56:51]

C:\AdwCleaner\AdwCleaner[S0].txt - [10531 Bytes] - [09/03/2014 10:42:35]

C:\AdwCleaner\AdwCleaner[S1].txt - [1753 Bytes] - [06/12/2014 11:59:50]

C:\AdwCleaner\AdwCleaner[S2].txt - [2156 Bytes] - [13/05/2017 22:27:04]

C:\AdwCleaner\AdwCleaner[S3].txt - [2145 Bytes] - [18/06/2017 16:39:18]

 

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1769 Bytes] ##########

[zep516]

Looks good.

There was still that program in the programs an features list (uninstall list) saver, that I would uninstall.

Other that that if all is well we can call it a day.

[Sherry718]

I uninstalled it-- the scan shows it still there?

Update-- I checked, it's gone.

 

Thanks for your help!

Edited by Sherry718, 18 June 2017 - 03:13 PM.

[zep516]

Do you actually still see it in the uninstall list ?

If so what options are present if you right click on it ?

[Sherry718]

its gone from my installed programs list-- there's nothing to click on

[zep516]

Very well.

If there are no further issues we can close the topic.

You may delete all the programs we downloaded and the log files as well.

Thanks
Joe

[Sherry718]

Thank you

[zep516]

You usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:

Safe Computing Practices please read Here


Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Thanks
Joe