computer infected with ransomeware

Hi my computer is infected with ransomeware. I tried using Hitman Pro, Malwarebytes and Norton power eraser but they didn't remove the virus. My documents and photos in Dropbox and Google Drive have been infected as well. Please help me remove the ransomeware.

Thanks

Mary

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-07-2017

Ran by Mary Lee Doll (administrator) on MARYLEEPARKER (24-07-2017 17:57:28)

Running from C:\Users\Mary Lee Doll\Desktop

Loaded Profiles: Mary Lee Doll (Available Profiles: Mary Lee Doll)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(HP) C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

() C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe

(AuthenTec Inc.) C:\Program Files (x86)\HP SimplePass\TouchControl.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

() C:\Program Files\Smart System Care for MARYLEEPARKER\ssc.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(SSCValidator) C:\ProgramData\SSCValidator for MARYLEEPARKER\SSCValidatorService.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIIUE.EXE

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(HP) C:\Program Files (x86)\HP SimplePass\BioMonitor.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(AuthenTec, Inc.) C:\Program Files\Common Files\AuthenTec\TrueService.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Program Files (x86)\HP SimplePass\DownloadAD.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe

(Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe

(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2886416 2012-03-01] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-06] (IDT, Inc.)

HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)

HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-27] (Intel Corporation)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2011-08-26] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIUE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [EPLTarget\P0000000000000002] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIUE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe <==== ATTENTION

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2016-04-22] (Apple Inc.)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [110392 2016-04-22] (Apple Inc.)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [356664 2016-04-22] (Apple Inc.)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIUE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [GoogleDriveSync] => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [67896 2016-04-22] (Apple Inc.)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [2672744 2017-07-24] (Lavasoft)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1143640 2017-05-09] (Google Inc.)

AppInit_DLLs: C:\Program Files => C:\Program Files [0 2017-03-28] ()

AppInit_DLLs-x32: c:\program files => c:\program files [0 2017-03-28] ()

CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

CHR HKU\S-1-5-21-2952237018-83708327-2872441606-1000\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76 75.75.76.76

Tcpip\..\Interfaces\{4682F80D-7A32-40F9-BE6C-31A7F9F94212}: [DhcpNameServer] 168.94.0.1 168.94.0.2 168.94.0.3

Tcpip\..\Interfaces\{AD55C882-F007-47C2-95A8-F71CA8609567}: [DhcpNameServer] 75.75.75.75 75.75.76.76 75.75.76.76

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=N360&pvid=21.6.0.32

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=N360&pvid=21.6.0.32

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=N360&pvid=21.6.0.32

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=N360&pvid=21.6.0.32

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?pc=COSP&ptag=D042517-AA1FD30A82A&form=CONMHP&conlogo=CT3335665

SearchScopes: HKLM -> OldSearch URL =

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> URL hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQtbVwpDFVATbVoIAg9cFQwTeBQAAgtEDAQScV8KUAFJFlRFcx9aFQQTSEcFME0FCFwEURNNfW1QBGsUUkBPNEpwFFs=&q={searchTerms}

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D042517-AA1FD30A82A&form=CONBDF&conlogo=CT3335665&q={searchTerms}

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {1CB7E00C-59B6-4977-A450-D1548A2409B3} URL =

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {6B918251-DA30-40B6-B18A-DE031655C5DF} URL =

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {81A836C3-0BA9-49D2-A029-63131B817BF9} URL =

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {84F89A6D-F60D-4658-A940-421B65C45B99} URL =

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {AD90E975-C86D-4F97-96E0-D0357183044E} URL =

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {CF9DF047-ED3D-4BB3-A20A-53F56FFBE0AF} URL =

SearchScopes: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> {D0D1110F-9F24-4946-AA1C-44A4E1CC74DC} URL =

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-06-29] (Oracle Corporation)

BHO: HP SimplePass Browser Helper Object -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass\x64\IEBHO.dll [2011-12-11] (HP)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-06-29] (Oracle Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-12-06] (HP Inc.)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-08] (Oracle Corporation)

BHO-x32: HP SimplePass Browser Helper Object -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass\IEBHO.DLL [2011-12-11] (HP)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-08] (Oracle Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-12-06] (HP Inc.)

Toolbar: HKLM - HP SimplePass Toolbar - {C98EE38D-21E4-4A50-907D-2B56FEC7013E} - C:\Program Files (x86)\HP SimplePass\x64\IEBHO.dll [2011-12-11] (HP)

Toolbar: HKLM-x32 - HP SimplePass Toolbar - {C98EE38D-21E4-4A50-907D-2B56FEC7013E} - C:\Program Files (x86)\HP SimplePass\IEBHO.DLL [2011-12-11] (HP)

Toolbar: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

Toolbar: HKU\S-1-5-21-2952237018-83708327-2872441606-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

FireFox:

========

FF DefaultProfile: 48gerjji.default

FF ProfilePath: C:\Users\Mary Lee Doll\AppData\Roaming\Mozilla\Firefox\Profiles\48gerjji.default [2017-05-08]

FF NewTab: Mozilla\Firefox\Profiles\48gerjji.default -> hxxp://www.bing.com/?pc=COSP&ptag=D042517-AA1FD30A82A&form=CONMHP&conlogo=CT3335665

FF DefaultSearchEngine: Mozilla\Firefox\Profiles\48gerjji.default -> Bing®

FF SelectedSearchEngine: Mozilla\Firefox\Profiles\48gerjji.default -> Bing®

FF Homepage: Mozilla\Firefox\Profiles\48gerjji.default -> hxxp://www.bing.com/?pc=COSP&ptag=D042517-AA1FD30A82A&form=CONMHP&conlogo=CT3335665

FF SearchPlugin: C:\Users\Mary Lee Doll\AppData\Roaming\Mozilla\Firefox\Profiles\48gerjji.default\searchplugins\bing-lavasoft.xml [2017-04-25]

FF Extension: (TrueSuite Website Logon) - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\[email protected] [2017-03-28] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [{6D5C8FC4-DE46-41bf-9092-93F0F78E9115}] - C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.9.5.39\coFFFw => not found

FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-06-29] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-06-29] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-07] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-07] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-08] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-08] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-08] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-08] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2011-09-28] ()

Chrome:

=======

CHR Profile: C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default [2017-07-24]

CHR Extension: (Google Slides) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-21]

CHR Extension: (Google Docs) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-21]

CHR Extension: (Google Drive) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-21]

CHR Extension: (YouTube) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-21]

CHR Extension: (Google Sheets) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-21]

CHR Extension: (Google Docs Offline) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-21]

CHR Extension: (Website Logon) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfgjjhcgfbfkkoelpepohanhmbhdanh [2017-01-21]

CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-01-21]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-05-08]

CHR Extension: (Gmail) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-21]

CHR Extension: (Chrome Media Router) - C:\Users\Mary Lee Doll\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-19]

CHR HKU\S-1-5-21-2952237018-83708327-2872441606-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Mary Lee Doll\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>

CHR HKU\S-1-5-21-2952237018-83708327-2872441606-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [jpfgjjhcgfbfkkoelpepohanhmbhdanh] - C:\Program Files (x86)\HP SimplePass\tschrome.crx [2011-12-09]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)

R2 FPLService; C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe [260424 2011-12-11] (HP)

S4 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)

S3 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1031704 2016-06-03] (HP)

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [321896 2017-07-06] (HP Inc.)

R2 ISCTAgent; C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [162648 2012-03-16] (Intel Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()

R2 SSCValidator; C:\ProgramData\SSCValidator For MARYLEEPARKER\SSCValidatorService.exe [32256 2017-03-10] (SSCValidator) [File not signed]

R3 TrueService; C:\Program Files\Common Files\AuthenTec\TrueService.exe [269640 2011-12-09] (AuthenTec, Inc.)

R2 WCAssistantService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe [25192 2017-07-24] ()

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 hswpan; C:\Windows\system32\drivers\hswpan.sys [109056 2012-01-27] (Ozmo Inc)

R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()

R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()

R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] ()

R3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-03-01] (Synaptics Incorporated)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-08-16] (Apple, Inc.) [File not signed]

S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2012-04-05] (Microsoft Corporation) [File not signed]

S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [30720 2012-04-05] (Microsoft Corporation) [File not signed]

R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2017-07-24] ()

R1 ZAM; C:\Windows\System32\drivers\zam64.sys [203680 2017-01-05] (Zemana Ltd.)

R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [203680 2017-01-05] (Zemana Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-24 17:54 - 2017-07-24 17:54 - 00040210 _____ C:\Users\Mary Lee Doll\Desktop\Addition.txt

2017-07-24 17:51 - 2017-07-24 17:57 - 00025704 _____ C:\Users\Mary Lee Doll\Desktop\FRST.txt

2017-07-24 17:49 - 2017-07-24 17:57 - 00000000 ____D C:\FRST

2017-07-24 17:47 - 2017-07-24 17:48 - 02382336 _____ (Farbar) C:\Users\Mary Lee Doll\Desktop\FRST64.exe

2017-07-24 17:21 - 2017-07-24 17:21 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-24 17:57 - 2017-01-05 21:15 - 00075211 _____ C:\Windows\ZAM.krnl.trace

2017-07-24 17:57 - 2017-01-05 21:15 - 00043843 _____ C:\Windows\ZAM_Guard.krnl.trace

2017-07-24 17:47 - 2009-07-14 00:45 - 00031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2017-07-24 17:47 - 2009-07-14 00:45 - 00031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2017-07-24 17:36 - 2017-04-24 20:16 - 00002207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2017-07-24 17:36 - 2017-04-24 20:16 - 00002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2017-07-24 17:28 - 2012-04-05 22:02 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2017-07-24 17:28 - 2012-04-05 22:02 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2017-07-24 17:28 - 2012-04-05 22:02 - 00004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2017-07-24 17:28 - 2012-04-05 22:02 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2017-07-24 17:28 - 2012-04-05 22:02 - 00000000 ____D C:\Windows\system32\Macromed

2017-07-24 17:27 - 2009-07-14 01:13 - 00866086 _____ C:\Windows\system32\PerfStringBackup.INI

2017-07-24 17:22 - 2017-03-28 21:09 - 00001130 _____ C:\appverifier.txt

2017-07-24 17:22 - 2017-03-28 20:09 - 00003078 _____ C:\Windows\System32\Tasks\Smart System Care_Logon

2017-07-24 17:21 - 2014-04-28 02:23 - 00000000 ____D C:\Users\Mary Lee Doll\AppData\LocalLow\AuthenTec

2017-07-24 17:21 - 2013-01-08 23:58 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys

2017-07-24 17:21 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

==================== Files in the root of some directories =======

2017-03-28 18:16 - 2017-03-28 18:16 - 0024247 _____ () C:\Users\Mary Lee Doll\AppData\Roaming\UserTile.png

2016-05-14 22:20 - 2016-07-30 23:01 - 0011824 _____ () C:\Users\Mary Lee Doll\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2016-07-30 23:01 - 2016-07-30 23:01 - 3276854 _____ () C:\Users\Mary Lee Doll\AppData\Local\README.bmp

2016-07-30 23:01 - 2016-07-30 23:01 - 0238187 _____ () C:\Users\Mary Lee Doll\AppData\Local\README.html

2016-07-30 23:01 - 2016-07-30 23:01 - 0001659 _____ () C:\Users\Mary Lee Doll\AppData\Local\README.txt

2017-01-05 17:47 - 2017-01-05 17:47 - 0000000 _____ () C:\Users\Mary Lee Doll\AppData\Local\{3A7BAF46-BE4B-4AB1-B0BD-20475FE677A0}

Some files in TEMP:

====================

2017-05-08 16:43 - 2017-04-20 09:17 - 0050720 _____ (HP Inc.) C:\Users\Mary Lee Doll\AppData\Local\Temp\ACLMInstaller.exe

2017-01-05 18:06 - 2017-01-05 18:06 - 2612600 _____ (Microsoft Corporation) C:\Users\Mary Lee Doll\AppData\Local\Temp\DefaultPack.EXE

2017-03-28 20:33 - 2017-01-05 18:09 - 11581544 _____ (SurfRight B.V.) C:\Users\Mary Lee Doll\AppData\Local\Temp\HitmanPro.exe

2017-01-05 20:17 - 2016-12-07 14:21 - 0619656 _____ (HP Inc.) C:\Users\Mary Lee Doll\AppData\Local\Temp\HPSFUpdater.exe

2017-01-05 20:23 - 2016-12-07 04:29 - 0167456 _____ (HP Inc.) C:\Users\Mary Lee Doll\AppData\Local\Temp\UninstallHPSA.exe

2017-05-19 16:27 - 2017-05-19 16:27 - 0733432 _____ (adaware) C:\Users\Mary Lee Doll\AppData\Local\Temp\wcupdater.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-11-15 09:16

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-07-2017

Ran by Mary Lee Doll (24-07-2017 17:57:48)

Running from C:\Users\Mary Lee Doll\Desktop

Windows 7 Home Premium Service Pack 1 (X64) (2014-04-28 06:23:14)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2952237018-83708327-2872441606-500 - Administrator - Disabled)

Guest (S-1-5-21-2952237018-83708327-2872441606-501 - Limited - Disabled)

Mary Lee Doll (S-1-5-21-2952237018-83708327-2872441606-1000 - Administrator - Enabled) => C:\Users\Mary Lee Doll

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 26 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 26.0.0.137 - Adobe Systems Incorporated)

AuthenTec TrueAPI 64-bit (HKLM\...\{F9E64F70-9BE4-4ECD-9B83-09E74CF5B6C3}) (Version: 1.5.0.165 - AuthenTec, Inc.) Hidden

Bejeweled 3 (HKLM-x32\...\WTA-f5b1934f-bab0-4666-b1a5-1c1441c83caa) (Version: 2.2.0.97 - WildTangent) Hidden

Blackhawk Striker 2 (HKLM-x32\...\WTA-ae69a578-7851-4fbd-a24c-7a1b959d5d75) (Version: 2.2.0.95 - WildTangent) Hidden

Chuzzle Deluxe (HKLM-x32\...\WTA-8dbecda4-0052-49ec-ab8c-85f13f01e896) (Version: 2.2.0.95 - WildTangent) Hidden

Cradle of Rome 2 (HKLM-x32\...\WTA-1539d4f2-57a4-4628-b19d-b720e907d790) (Version: 2.2.0.98 - WildTangent) Hidden

D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden

Dora's World Adventure (HKLM-x32\...\WTA-985f3556-da51-4355-8375-da38e1ceeee4) (Version: 2.2.0.95 - WildTangent) Hidden

EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)

Epson Software Updater (HKLM-x32\...\{7BAC3F7A-B963-468E-982E-B5608A87408D}) (Version: 4.4.4 - SEIKO EPSON CORPORATION)

EPSON WF-2540 Series Printer Uninstall (HKLM\...\EPSON WF-2540 Series) (Version: - SEIKO EPSON Corporation)

EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.5.00 - SEIKO EPSON CORPORATION)

ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{4F34A145-8CF3-400C-B5DB-2B1BF604304D}) (Version: 5.1.4 - Hewlett-Packard)

Farm Frenzy (HKLM-x32\...\WTA-1720dceb-be5a-4b3c-a98a-f32a0613cf39) (Version: 2.2.0.98 - WildTangent) Hidden

Farmscapes (HKLM-x32\...\WTA-e0ae73ff-8589-495f-89c9-c17035e09a33) (Version: 2.2.0.98 - WildTangent) Hidden

Final Drive Fury (HKLM-x32\...\WTA-7e821da1-cf4f-4720-bf05-1bd1c5f87b67) (Version: 2.2.0.95 - WildTangent) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 59.0.3071.115 - Google Inc.)

Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden

Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (HKLM-x32\...\{6F340107-F9AA-47C6-B54C-C3A19F11553F}) (Version: 1.00.0000 - Hewlett-Packard Company) Hidden

Hoyle Card Games (HKLM-x32\...\WTA-8a6eafad-0f8e-4e68-b9da-40810369ea0b) (Version: 2.2.0.95 - WildTangent) Hidden

HP 3D DriveGuard (HKLM\...\{FD7FB4D6-4F13-44E5-955A-A69A202D253D}) (Version: 4.1.12.1 - Hewlett-Packard Company)

HP Application Assistant (HKLM\...\{0CE7EBAF-157D-4111-9146-057CB2A4023E}) (Version: 1.1.466.3970 - Hewlett-Packard)

HP CoolSense (HKLM-x32\...\{16B7BDA1-B967-4D2D-8B27-E12727C28350}) (Version: 2.10.3 - Hewlett-Packard Company)

HP Documentation (HKLM-x32\...\{0D83FCDE-8CAF-45E6-907D-6AF8E2A5EE01}) (Version: 1.1.0.0 - Hewlett-Packard)

HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)

HP Launch Box (HKLM\...\{5A847522-375C-4D05-BD3D-88C450CC047F}) (Version: 1.1.5 - Hewlett-Packard Company)

HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)

HP Power Manager (HKLM-x32\...\{7E799992-5DA0-4A1A-9443-B1836B063FEC}) (Version: 1.4.8 - Hewlett-Packard Company)

HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)

HP Security Assistant (HKLM\...\{42719DC3-4982-47DD-B025-B21C4BDD504D}) (Version: 3.0.3 - Hewlett-Packard Company)

HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15430.4033 - Hewlett-Packard Company)

HP SimplePass (HKLM-x32\...\{880B5A98-B242-4B53-BD6F-41EA17495EAD}) (Version: 5.4.0.402 - Hewlett-Packard)

HP Software Framework (HKLM-x32\...\{D63F6B96-86C6-4EE9-9494-AD71749242E5}) (Version: 4.5.6.1 - Hewlett-Packard Company)

HP Support Assistant (HKLM-x32\...\{4780AF24-213D-4187-86F2-0014A6D6077B}) (Version: 8.3.50.9 - HP Inc.)

HP Support Solutions Framework (HKLM-x32\...\{00612F78-52C4-46C0-97F0-F50B6036B5E2}) (Version: 12.7.27.15 - HP Inc.)

iCloud (HKLM\...\{ADFDB647-35C0-4254-9EE6-2D9C3B7104BD}) (Version: 5.2.1.69 - Apple Inc.)

IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6392.0 - IDT)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2653 - Intel Corporation)

Intel® PROSet/Wireless for Bluetooth® + High Speed (HKLM\...\{37EC048A-81A2-452A-8D1F-3BE2018E767D}) (Version: 15.1.0.0096 - Intel Corporation)

Intel® PROSet/Wireless Software for Bluetooth® Technology (HKLM\...\{520C4DD4-2BC7-409B-BA48-E1A4F832662D}) (Version: 2.1.0.0140 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)

Intel® Smart Connect Technology 2.0 x64 (HKLM\...\{D1B033E8-A077-4B0D-9831-5798E19E861E}) (Version: 2.0.1083.0 - Intel)

Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)

Intel® WiDi (HKLM-x32\...\{7FCB8D5D-9396-4D17-8CFA-349D6D49CD32}) (Version: 3.0.13.0 - Intel Corporation)

Intel® Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )

Intel® Wireless Music device driver (HKLM\...\{4169B8AC-D144-4E38-A9CA-637EA44129ED}) (Version: 1.5.5323.0 - Intel Corporation)

Intel® PROSet/Wireless WiFi Software (HKLM\...\{E2D0B67F-8032-4E11-87C6-C8C721D331B3}) (Version: 15.01.0500.0903 - Intel Corporation)

Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)

Itibiti RTC (HKLM-x32\...\{730E03E4-350E-48E5-9D3E-4329903D454D}) (Version: 0.0.1 - Itibiti Inc) Hidden <==== ATTENTION

iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)

Java 7 Update 60 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417060FF}) (Version: 7.0.600 - Oracle)

Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

Jewel Match 3 (HKLM-x32\...\WTA-21d45372-cdbc-4fa3-aaee-37bd1fac5b18) (Version: 2.2.0.98 - WildTangent) Hidden

Jewel Quest Mysteries: The Seventh Gate Collector's Edition (HKLM-x32\...\WTA-6dfad915-0d67-48ae-b5cf-b3aa6ddcb562) (Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (HKLM-x32\...\WTA-06d20f35-d1eb-4572-9a53-10c1f295c838) (Version: 2.2.0.95 - WildTangent) Hidden

Junk Mail filter update (HKLM-x32\...\{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}) (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Luxor HD (HKLM-x32\...\WTA-92406fd4-e62a-471e-91ba-fc82125c20ec) (Version: 2.2.0.98 - WildTangent) Hidden

Mah Jong Medley (HKLM-x32\...\WTA-8fb9e0fe-cc88-4d22-a948-a30d849fa12d) (Version: 2.2.0.95 - WildTangent) Hidden

Mesh Runtime (HKLM-x32\...\{8C6D6116-B724-4810-8F2D-D047E6B7D68E}) (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.5139.5005 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 53.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 53.0 (x86 en-US)) (Version: 53.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 53.0.0.6312 - Mozilla)

opensource (HKLM-x32\...\{3677D4D8-E5E0-49FC-B86E-06541CF00BBE}) (Version: 1.0.14960.3876 - Your Company Name) Hidden

Penguins! (HKLM-x32\...\WTA-58a91ced-1e81-47d1-9b8b-43265b8a0d07) (Version: 2.2.0.98 - WildTangent) Hidden

Plants vs. Zombies - Game of the Year (HKLM-x32\...\WTA-83f4f823-d7db-4e8b-a75e-247c52bd447d) (Version: 2.2.0.98 - WildTangent) Hidden

PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)

Poker Superstars III (HKLM-x32\...\WTA-4ffb0573-94be-4c10-bc22-2b6e8002d381) (Version: 2.2.0.95 - WildTangent) Hidden

Polar Bowler (HKLM-x32\...\WTA-845b3a38-4e78-4a14-8492-c76e3eab9d3b) (Version: 2.2.0.97 - WildTangent) Hidden

Polar Golfer (HKLM-x32\...\WTA-3f176464-299c-4f60-a1c6-8633929003bd) (Version: 2.2.0.98 - WildTangent) Hidden

QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.54.309.2012 - Realtek)

Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.27016 - Realtek Semiconductor Corp.)

RollerCoaster Tycoon 3: Platinum (HKLM-x32\...\WTA-0c66269c-e424-4c36-b3b6-7dc94a041310) (Version: 2.2.0.98 - WildTangent) Hidden

Smart System Care (HKLM\...\{E6298C62-873B-43BF-915D-F7B481C0633F}_is1) (Version: 1.0.0.25380 - )

swMSM (HKLM-x32\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.2.0 - Synaptics Incorporated)

Torchlight (HKLM-x32\...\WTA-f5b498d2-5ea0-4919-a647-24eb8439503e) (Version: 2.2.0.98 - WildTangent) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

Update Installer for WildTangent Games App (HKLM-x32\...\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent) Hidden

Validity WBF DDK (HKLM\...\{D8360C56-B89D-47AA-91A5-8D27A20844FB}) (Version: 4.3.304.0 - Validity Sensors, Inc.)

Virtual Villagers 4 - The Tree of Life (HKLM-x32\...\WTA-7aa487f6-4cc9-4629-80b6-c25cbdf8ce8c) (Version: 2.2.0.98 - WildTangent) Hidden

Web Companion (HKLM-x32\...\{798e5abd-d88c-47e0-a564-a309f6a32eb5}) (Version: 3.1.1602.3093 - Lavasoft)

WildTangent Games App (HP Games) (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp) (Version: 4.0.5.36 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

Zuma's Revenge (HKLM-x32\...\WTA-59b1b39c-68d6-44e8-823e-905b72bed68f) (Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => -> No File

ContextMenuHandlers01: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2016-04-22] (Apple Inc.)

ContextMenuHandlers05: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2012-02-15] (Intel Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {115E49F0-21E4-4FE6-8CF4-1BE314A1FEA7} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe

Task: {29A1E78D-2816-4AEF-8F01-329E4C94DDFC} - System32\Tasks\Norton Family\Norton Error Processor => C:\Program Files (x86)\Norton Family\Engine\3.1.0.17\SymErr.exe

Task: {3A85D9A5-F85F-45DA-965A-7041C5AD407B} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => %windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate -nolegacy

Task: {4F43DEAB-DB1C-4369-A173-CDC88F27FB49} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.)

Task: {629AF78D-C99E-4C62-A4F1-C3796C9A01F7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

Task: {6504FDA7-719D-484A-BE56-376D358B1481} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-06] (HP Inc.)

Task: {68B3070B-22DE-4964-9BC8-255CD7633776} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe

Task: {791C3D30-B459-430C-A8DF-38326619CA56} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2016-12-06] (HP Inc.)

Task: {831F08CA-988C-41EF-99EF-6B760E6BFD8D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-12-06] (HP Inc.)

Task: {8E6D96C6-CE9B-42F5-90C5-EE05CD5E7A6A} - System32\Tasks\Norton Family\Norton Error Analyzer => C:\Program Files (x86)\Norton Family\Engine\3.1.0.17\SymErr.exe

Task: {932F1FAC-52EB-4B01-932C-04287637BFCB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-04-24] (Google Inc.)

Task: {9AD94154-5C88-43F6-AC7B-B573BE2DB1ED} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-04-24] (Google Inc.)

Task: {A6E75A84-A62E-4AFB-9866-65AD515D701E} - System32\Tasks\Smart System Care_Logon => C:\Program Files\Smart System Care for MARYLEEPARKER\ssc.exe [2017-03-24] ()

Task: {BCBC275C-AFE4-4DD6-BE54-D3EBA7506544} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-07-24] (Adobe Systems Incorporated)

Task: {D43E5145-484D-4C14-BE6A-24BD9C50F0A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-12-06] (HP Inc.)

Task: {EBC9170A-F43A-4F7E-BDAF-50BE8643C1E8} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Apple Diagnostics.job => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe

Task: C:\Windows\Tasks\Chrome Cleanup Tool logs upload retry.job => c:\users\mary lee doll\appdata\local\microsoft\windows\temporary internet files\content.ie5\t67yp4ln\chrome_cleanup_tool.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d041826045bbea.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0981fbbf68ef8.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0e2ba721cf56b.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0f7eae32fc594.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1346dba2e6bb3.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1607ebf40d02c.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1ac9de457d9e4.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1e9393f052357.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\Launch 8742.job => C:\Program Files (x86)\YTDownloader\YTDownloader.exe <==== ATTENTION

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2012-02-09 20:26 - 2012-02-09 20:26 - 00133632 ____N () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe

2012-02-09 20:26 - 2012-02-09 20:26 - 00048128 ____N () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\NetworkHeuristic.dll

2012-02-09 20:26 - 2012-02-09 20:26 - 00036864 ____N () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\ISCTNetDetect.dll

2017-03-28 20:09 - 2017-03-24 16:41 - 02798280 _____ () C:\Program Files\Smart System Care for MARYLEEPARKER\ssc.exe

2012-02-15 05:53 - 2012-02-15 05:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2011-12-20 03:34 - 2011-12-20 03:34 - 00108880 ____N () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe

2017-05-19 16:30 - 2017-05-09 05:13 - 03767640 _____ () C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\libglesv2.dll

2017-05-19 16:30 - 2017-05-09 05:13 - 00100696 _____ () C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\libegl.dll

2011-12-11 07:47 - 2011-12-11 07:47 - 00254792 ____N () C:\Program Files (x86)\HP SimplePass\DownloadAD.exe

2017-04-25 04:04 - 2017-07-24 17:50 - 00025192 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe

2017-04-25 04:04 - 2017-07-24 17:50 - 00017000 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll

2017-04-25 04:04 - 2017-07-24 17:50 - 00036968 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll

2014-10-18 09:50 - 2014-10-18 09:50 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll

2013-01-08 23:58 - 2012-02-01 20:25 - 00059904 ____N () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

2013-01-08 23:59 - 2012-03-07 10:27 - 01198872 ____N () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

2017-04-25 04:04 - 2017-07-24 17:50 - 00138856 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

2017-04-25 04:04 - 2017-07-24 17:50 - 00058472 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Common.Platform.dll

2017-04-25 04:04 - 2017-07-24 17:50 - 00018024 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.UpdateComponents.dll

2017-04-25 04:04 - 2017-07-24 17:50 - 00303720 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

2017-04-25 04:04 - 2017-07-24 17:50 - 00030312 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AvastWrapper.dll

2017-04-25 04:04 - 2017-07-24 17:50 - 00058984 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Mary Lee Doll\Documents\2014-05-20 20.48.43.jpg:com.dropbox.attributes [998]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost

IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com

IE trusted site: HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\localhost -> localhost

IE trusted site: HKU\S-1-5-21-2952237018-83708327-2872441606-1000\...\webcompanion.com -> hxxp://webcompanion.com

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2952237018-83708327-2872441606-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Mary Lee Doll\AppData\Local\Temp\README.BMP

DNS Servers: 75.75.75.75 - 75.75.76.76

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{52C4BF7F-5C94-4A95-A507-8B489B8E2771}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{A792B5FE-396E-4F8B-82C3-95113C8E8EC9}] => (Allow) LPort=2869

FirewallRules: [{5BAE5497-2A39-4842-972D-F2C907D18123}] => (Allow) LPort=1900

FirewallRules: [{308EED34-4DCD-4614-9DAD-61F321923816}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{AC74E118-52C2-4C96-9BA5-870330A3B869}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

FirewallRules: [{70AB249A-7304-4F79-B8E0-C413E39AB343}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

FirewallRules: [{9771420E-D4FE-45A8-958E-7CEFB51D95E7}] => (Allow) C:\Program Files (x86)\Intel Corporation\Intel WiDi\WiDiApp.exe

FirewallRules: [{133FDCFC-4EE3-4E50-9094-0CE40576982B}] => (Allow) C:\Users\Mary Lee Doll\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{4B4EA3BA-A0C5-4BFE-B4FB-C13992C547C6}] => (Allow) C:\Users\Mary Lee Doll\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [TCP Query User{F6E67799-CEB7-4C5E-ADCD-516A4E50449F}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [UDP Query User{9509B954-EA6C-4343-ADE4-8497B5C25A69}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [TCP Query User{A5A779C8-CC27-493A-BFB8-72FCAFAA402C}C:\program files\java\jre7\bin\javaw.exe] => (Block) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [UDP Query User{8D9FA3F9-7CFE-48B0-9E9F-7C0A4CF51051}C:\program files\java\jre7\bin\javaw.exe] => (Block) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [TCP Query User{CD658BB6-2B75-4F5D-A52B-E120D9D01CDD}C:\users\mary lee doll\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\mary lee doll\appdata\roaming\dropbox\bin\dropbox.exe

FirewallRules: [UDP Query User{FBAC876F-3911-450D-8586-DACDB49388EB}C:\users\mary lee doll\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\mary lee doll\appdata\roaming\dropbox\bin\dropbox.exe

FirewallRules: [{FA2FECEE-CC73-46F8-93D3-1C1ECA6FB3D4}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

FirewallRules: [{9CD83AD3-3580-4D57-962A-0AB311CD02AC}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

FirewallRules: [{8AF3CD2F-C00C-4E9D-8E11-EE1AECEC09C2}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe

FirewallRules: [{7FA52FED-ED77-4632-AC0B-F546918739DE}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe

FirewallRules: [{86734710-D2F4-4120-80E3-BF53242DF560}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe

FirewallRules: [{2A285179-F54B-4C5B-80DF-E411697FAB62}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{0D970CE3-FD04-4626-8B2B-05991E42D8EA}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

FirewallRules: [{78B76A1C-E43A-4607-99E5-26E535F19C6C}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

FirewallRules: [{011E82BA-6975-4C52-A500-ED524D6FD74B}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe

FirewallRules: [{7D382CF9-0888-4056-BF74-6420971B699E}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe

FirewallRules: [{576DA96F-8FD2-4C07-84B0-457FB99AA3B1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{46C86B25-CF16-4D67-823C-4FF7D8EBD22F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{85D71F6C-47AF-454C-A544-8FB11549ED1B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

11-01-2017 06:48:11 Installed Epson Software Updater

16-01-2017 11:22:22 Checkpoint by HitmanPro

20-01-2017 18:22:54 Removed FAX Utility

20-01-2017 18:37:54 Removed Google Drive

28-03-2017 17:17:01 Removed Evernote v. 4.5.2

28-03-2017 17:25:48 Removed Google Earth

28-03-2017 20:34:43 Removed Skype™ 6.11

==================== Faulty Device Manager Devices =============

Name: Malwarebytes Anti-Exploit

Description: Malwarebytes Anti-Exploit

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer:

Service: ESProtectionDriver

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:

==================

Error: (07/24/2017 05:31:01 PM) (Source: CVHSVC) (EventID: 100) (User: )

Description: Information only.

(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.

Error: (07/24/2017 05:26:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (07/24/2017 05:26:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (07/24/2017 05:21:38 PM) (Source: Application Virtualization Client) (EventID: 3008) (User: )

Description: {hap=12:app=OfficeVirt 9014006604090000:tid=1550}

The client was unable to connect to an Application Virtualization Server (rc 24604E0A-40000193)

Error: (07/24/2017 05:21:38 PM) (Source: Application Virtualization Client) (EventID: 5009) (User: )

Description: {hap=12:app=OfficeVirt 9014006604090000:tid=1550}

The Application Virtualization Client could not connect to stream URL 'http://c2r.microsoft....7122.5000.sft'(rc 24604E0A-40000193, original rc 24604E0A-40000193).

Error: (07/24/2017 05:21:36 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (07/24/2017 05:21:20 PM) (Source: ISCT Agent) (EventID: 1003) (User: )

Description: CAgentState::SetTimerSource Failed to set max wake duration, error=0.

Error: (07/24/2017 05:21:20 PM) (Source: ISCT Agent) (EventID: 1003) (User: )

Description: CISCTPnpDriverApi::SetMaxWakeDuration *****IOCTL_ISCT_SAWD(SAWD) Failed, Error=0x2

Error: (05/26/2017 10:12:24 PM) (Source: CVHSVC) (EventID: 100) (User: )

Description: Information only.

(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.

Error: (05/26/2017 10:08:35 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

System errors:

=============

Error: (07/24/2017 05:46:49 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)

Description: The following fatal alert was received: 70.

Error: (07/24/2017 05:46:46 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)

Description: The following fatal alert was received: 70.

Error: (07/24/2017 05:23:22 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)

Description: The following fatal alert was received: 70.

Error: (07/24/2017 05:23:20 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)

Description: The following fatal alert was received: 70.

Error: (07/24/2017 05:22:20 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID

{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}

and APPID

{344ED43D-D086-4961-86A6-1106F4ACAD9B}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (07/24/2017 05:21:38 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

ESProtectionDriver

Error: (07/24/2017 05:21:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The MBAMChameleon service failed to start due to the following error:

The system cannot find the file specified.

Error: (05/26/2017 10:02:58 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID

{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}

and APPID

{344ED43D-D086-4961-86A6-1106F4ACAD9B}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (05/26/2017 10:02:38 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

ESProtectionDriver

Error: (05/26/2017 10:01:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The MBAMChameleon service failed to start due to the following error:

The system cannot find the file specified.

CodeIntegrity:

===================================

Date: 2017-01-05 08:27:07.777

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Web Protect\pcwtc64f.sys because the set of per-page image hashes could not be found on the system.

Date: 2017-01-05 08:27:07.714

Date: 2017-01-04 14:41:00.843

Date: 2017-01-04 14:41:00.765

Date: 2014-11-15 07:16:30.120

Date: 2014-11-15 07:16:30.005

Date: 2014-11-15 07:13:37.257

Date: 2014-11-15 07:11:42.056

Date: 2014-10-18 09:21:49.049

Date: 2014-10-18 09:20:01.909

==================== Memory info ===========================

Processor: Intel® Core™ i5-3210M CPU @ 2.50GHz

Percentage of memory in use: 61%

Total physical RAM: 8094.31 MB

Available physical RAM: 3124.55 MB

Total Virtual: 16186.8 MB

Available Virtual: 11480.72 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:678.66 GB) (Free:535.78 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive d: (Recovery) (Fixed) (Total:19.69 GB) (Free:2.12 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 7A38ABE9)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=678.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=19.7 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=102 MB) - (Type=0C)

==================== End of Addition.txt ============================Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-07-2017

Ran by Mary Lee Doll (24-07-2017 17:57:48)

Running from C:\Users\Mary Lee Doll\Desktop

Windows 7 Home Premium Service Pack 1 (X64) (2014-04-28 06:23:14)

Boot Mode: Normal

=========================================================

Edited by Parker0211, 24 July 2017 - 04:35 PM.

#1
Parker0211

Posted 24 July 2017 - 04:08 PM

Advertisements

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

computer infected with ransomeware

#1 Parker0211 Posted 24 July 2017 - 04:08 PM

Advertisements

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Sign In

#1
Parker0211

Posted 24 July 2017 - 04:08 PM