Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Malware Help


  • Please log in to reply

#1
tsvc15

tsvc15

    New Member

  • Member
  • Pip
  • 2 posts

Hi there. I use Malwarebytes. Every month I run a scan just to make sure everything is good. For years I've had no issues but a couple of days ago it detected 2 threats during a scan.

 

 
www.malwarebytes.com
 
-Log Details-
Scan Date: 3/26/20
Scan Time: 11:22 PM
Log File: 20185d7a-6fda-11ea-a104-0ceee6f8eedc.json
 
-Software Information-
Version: 4.1.0.56
Components Version: 1.0.835
Update Package Version: 1.0.21426
License: Free
 
-System Information-
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: User-HP\User
 
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 189637
Threats Detected: 2
Threats Quarantined: 2
Time Elapsed: 25 min, 19 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Detect
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 1
Malware.Heuristic.7, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEXPLORE.EXE, Quarantined, 7, 0, , , , 
 
Registry Value: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Data Stream: 0
(No malicious items detected)
 
Folder: 0
(No malicious items detected)
 
File: 1
Malware.Heuristic.7, C:\USERS\USER\APPDATA\LOCAL\TEMP\RARSFX0\PROCS\IEXPLORE.EXE, Quarantined, 7, 0, 1.0.21426, 7, dds, 00649573
 
Physical Sector: 0
(No malicious items detected)
 
WMI: 0
(No malicious items detected)
 
 
(end)
 
Quarantined both. Today I decided to do another scan as I was bothered by the fact that I got Malware. Ran a scan and got another threat. This time only one.
 
 
www.malwarebytes.com
 
-Log Details-
Scan Date: 3/28/20
Scan Time: 5:37 PM
Log File: 604dabda-713c-11ea-a74f-0ceee6f8eedc.json
 
-Software Information-
Version: 4.1.0.56
Components Version: 1.0.859
Update Package Version: 1.0.21530
License: Free
 
-System Information-
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: User-HP\User
 
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 189553
Threats Detected: 1
Threats Quarantined: 1
Time Elapsed: 27 min, 6 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Detect
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 0
(No malicious items detected)
 
Registry Value: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Data Stream: 0
(No malicious items detected)
 
Folder: 0
(No malicious items detected)
 
File: 1
Malware.Heuristic.7, C:\USERS\USER\APPDATA\LOCAL\TEMP\RARSFX0\PEV.EXE, Quarantined, 7, 0, 1.0.21530, 7, dds, 00652104
 
Physical Sector: 0
(No malicious items detected)
 
WMI: 0
(No malicious items detected)
 
 
(end)
 
It's quarantined but I feel like this problem won't go away. That if I were to run a scan again in a few days I might find more Malware. Any help with how to deal with this is greatly appreciated. 
 
Thank you

 


  • 0

Advertisements


#2
iMacg3

iMacg3

    GeekU PowerPC G3

  • GeekU Moderator
  • 1,899 posts
Hi tsvc15, welcome to the Geeks to Go malware removal forum.

I am iMacg3 and will be helping you with your computer problems.

Please keep the following information in mind before we begin:
  • Back up any important data before we continue.
    • Back up any important data on your computer to external media. I will not knowingly suggest any steps that will damage your computer; however, malware infections are often unpredictable and it may be necessary to reformat and reinstall your operating system depending on the infection.
  • Do not install any new software or run any fixes/tools on your system unless I request that you do so.
    • Running additional tools on your system can interfere with the clean-up process, or cause issues such as false positives.
  • Please read all instructions carefully, and complete them in the order listed.
    • Items that are especially important will be highlighted in bold or red.
  • If your computer seems to start working normally, please don't abandon the topic.
    • Even if your system is behaving normally, there may still be some malware remnants left over. Additionally, malware can re-infect the computer if some remnants are left. Therefore, please complete all requested steps to make sure any malware is successfully eradicated from your PC.
  • If you have pirated or illegal software on your computer, uninstall it now before proceeding.
    • Using pirated/cracked software is an easy way to infect your computer - almost as easy as intentionally downloading malware. Therefore, please remove any, if present, before we begin the clean-up.
  • If you don't respond to your topic in 4 days, it will be closed.
    • If your topic is closed and you still need assistance, send me a Personal Message with a link to your topic.
  • If you have questions at any time during the cleanup, feel free to ask.
---------------------------------------------------
Farbar Recovery Scan Tool (FRST)

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your system, and that will be the right version.
  • Right-click FRST.exe/FRST64.exe then click "Run as administrator"
  • When the tool opens, click Yes to the disclaimer.
  • Press the Scan button.
  • When finished, it will produce logs called FRST.txt and Addition.txt in the same directory the tool was run from.
  • Please copy and paste the logs in your next reply.

  • 0

#3
tsvc15

tsvc15

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts

Hi thanks for the response. Appreciate the help

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-03-2020
Ran by User (administrator) on USER-HP (Hewlett-Packard HP Mini 210-1000) (29-03-2020 00:35:25)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) Language: العربية (السعودية)‏
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Adobe Inc. -> Adobe Systems) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
(Broadcom Corporation -> Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation -> Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Broadcom Corporation -> Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Corel Corporation -> WinZip Computing) C:\Program Files\WinZip\WzPreloader.exe
(DATA TRANSFER OF NEVADA, LLC  -> Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
(DeviceVM, Inc.) [File not signed] C:\SPLASH.SYS\config\DVMExportService.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Company ->  Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(Hewlett-Packard Company -> ) C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Company -> Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard Company -> Hewlett-Packard) C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
(Hewlett-Packard) [File not signed] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Intel Corporation -> Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Intel Corporation -> Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxtray.exe
(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows Hardware Compatibility Publisher -> Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_5576240ee6baaa25\AEstSrv.exe
(Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_5576240ee6baaa25\stacsv.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Sun Microsystems, Inc.) [File not signed] C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Zecter Inc. -> Zecter Inc.) C:\Program Files\Hewlett-Packard\HP CloudDrive\zumodrive.exe
 
==================== Registry (Whitelisted) ===================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-11-03] (Synaptics Incorporated -> Synaptics Incorporated)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation -> Intel Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2009-10-12] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
HKLM\...\Run: [HP] => C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe [589104 2009-07-14] (DATA TRANSFER OF NEVADA, LLC  -> Hewlett-Packard)
HKLM\...\Run: [QlbCtrl.exe] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [322104 2009-08-20] (Hewlett-Packard Company ->  Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [WirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [499768 2009-09-01] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM\...\Run: [ZumoDrive] => C:\Program Files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk [2042 2010-12-27] () [File not signed]
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [587288 2017-03-14] (Oracle America, Inc. -> Oracle Corporation)
HKLM\...\Run: [WinZip UN] => C:\Program Files\WinZip\WZUpdateNotifier.exe [2268624 2019-05-17] (Corel Corporation -> Corel Corporation)
HKLM\...\Run: [WinZip PreLoader] => C:\Program Files\WinZip\WzPreloader.exe [130624 2019-05-17] (Corel Corporation -> WinZip Computing)
HKLM\...\Run: [WinZip FAH] => C:\Program Files\WinZip\FAHConsole.exe [455360 2019-05-17] (WinZip Computing LLC -> WinZip Computing, S.L.)
HKU\S-1-5-21-3461133905-2381754433-3374124651-1000\...\Run: [Simplify Media] => C:\Program Files\HP\HP MediaStream\HPMediaStream.exe [21498376 2009-10-23] (Simplify Media, Inc. -> Simplify Media, Inc.)
HKU\S-1-5-21-3461133905-2381754433-3374124651-1000\...\Run: [msnmsgr] => C:\Program Files\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
HKLM\Software\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\80.0.3987.149\Installer\chrmstp.exe [2020-03-18] (Google LLC -> Google LLC)
HKLM\Software\...\Authentication\Credential Providers: [{50968FF7-10C1-4fb3-98B0-CD654D6CB97E}] -> C:\Program Files\WIDCOMM\Bluetooth Software\\BtwCP.dll [2009-09-04] (Broadcom Corporation -> Broadcom Corporation.)
HKLM\Software\...\Authentication\Credential Providers: [{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL [2010-09-21] (Microsoft Corporation -> Microsoft Corp.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-11-30]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation -> Broadcom Corporation.)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2016-11-30]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation -> Microsoft Corporation)
 
==================== Scheduled Tasks (Whitelisted) ============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0247B2BB-C362-4B82-9EE4-4F6EAA120DD2} - System32\Tasks\RecoveryCDWin7 => C:\Program Files\Hewlett-Packard\HP Setup\RemEngine.exe [38456 2009-10-07] (Hewlett-Packard Company -> )
Task: {204F1052-FC49-4DD6-8104-81B3C29541FF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1242704 2020-02-25] (Adobe Inc. -> Adobe Systems)
Task: {2BD05BA6-988D-4BD3-A9CD-9A39F80AF524} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {2E2A89C9-3BBA-453D-81E0-1D50BA51E0F7} - System32\Tasks\WinZip Update Notifier 1 => C:\Program Files\WinZip\WZUpdateNotifier.exe [2268624 2019-05-17] (Corel Corporation -> Corel Corporation)
Task: {3B5C1F2B-3FF6-42A0-89F5-139AE8A3B746} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [1379592 2009-10-16] (Hewlett-Packard -> Hewlett-Packard)
Task: {4A309451-EFCB-4BF4-863D-939DE072AC7F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc -> Google Inc.)
Task: {5B184694-64C3-4633-94C5-945B3FA561D6} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {5CEEAE39-82F3-4F66-889C-06814E860C58} - System32\Tasks\WinZip Update Notifier 2 => C:\Program Files\WinZip\WZUpdateNotifier.exe [2268624 2019-05-17] (Corel Corporation -> Corel Corporation)
Task: {64650E7F-1118-4916-B63E-4F3633AE184D} - System32\Tasks\Registration => C:\Program Files\Hewlett-Packard\HP Setup\RemEngine.exe [38456 2009-10-07] (Hewlett-Packard Company -> )
Task: {6AEF0C98-2CB4-4B67-8C70-4C977C7355CC} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask => {B1AEBB5D-EAD9-4476-B375-9C3ED9F32AFC}
Task: {6B7AC694-8D6D-481B-9DD8-2A3A741ADA6D} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem => {927EA2AF-1C54-43D5-825E-0074CE028EEE}
Task: {9334C323-F100-4656-9BA0-E4AA69C0F9C2} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe
Task: {94B668EE-6F76-4302-82E6-7983C2E2A328} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc -> Google Inc.)
Task: {97F6641F-9E26-466C-BBDB-9EC1B1E22B5C} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [1379592 2009-10-16] (Hewlett-Packard -> Hewlett-Packard)
Task: {9F54B95F-5096-4803-AE61-E9B3AC5B616D} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
Task: {B66EA050-59D3-4E30-8652-E3FD5897F1E9} - System32\Tasks\WinZip Update Notifier 3 => C:\Program Files\WinZip\WZUpdateNotifier.exe [2268624 2019-05-17] (Corel Corporation -> Corel Corporation)
Task: {B7F179D5-CD0A-4A46-99B4-9285E01800B9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [269504 2016-05-13] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {D1EC85D6-9CAD-4B4B-B8BB-258765583B68} - System32\Tasks\GoogleUpdateTaskMachineCore1d1e944aed98777 => C:\Program Files\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc -> Google Inc.)
Task: {D21F6024-191F-4454-BBBC-09A650DA2549} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {D5AEA61B-8AAD-44CD-BAC0-360E9EA72245} - System32\Tasks\{4908488D-3C6B-49EA-9A61-00CD5186EEE4} => "c:\program files\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/6.1.0.129.272/en/abandoninstall?page=tsProgressBar
Task: {E405E471-818C-459A-93B3-CF75E647BF39} - System32\Tasks\GoogleUpdateTaskMachineUA1d1e944af3d8143 => C:\Program Files\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc -> Google Inc.)
Task: {F93C7104-998A-4A38-B935-775A3138B3C3} - System32\Tasks\Microsoft\Windows\Location\Notifications => C:\Windows\System32\LocationNotificationWindows.exe
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Winsock: Catalog5 06 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280 2010-09-21] (Microsoft Corporation -> Microsoft Corp.)
Winsock: Catalog5 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280 2010-09-21] (Microsoft Corporation -> Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 64.71.255.204 64.71.255.198
Tcpip\..\Interfaces\{BC3338C4-7E79-4C29-AF82-106FE814952E}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{CE8FD610-94AB-4EB8-8D8D-28A4167AE16D}: [DhcpNameServer] 64.71.255.204 64.71.255.198
 
Internet Explorer:
==================
SearchScopes: HKLM -> DefaultScope {95FBE619-19B8-4D4D-85FF-AC655C023F00} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {12FD45BA-0F44-4C46-93F6-DE497A12A58A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3461133905-2381754433-3374124651-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://tbsearch.ask.com/redirect?client=ie&tb=PTV&o=15184&src=crm&q={searchTerms}&locale=en_US
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-09-22] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll [2017-06-30] (Oracle America, Inc. -> Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corporation -> Microsoft Corp.)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-06-30] (Oracle America, Inc. -> Oracle Corporation)
Toolbar: HKU\S-1-5-21-3461133905-2381754433-3374124651-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-3461133905-2381754433-3374124651-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_131-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-00131-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_131-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_131-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll [2010-04-16] (Microsoft Corporation -> Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation -> Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll [2010-04-16] (Microsoft Corporation -> Microsoft Corporation)
 
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ivvbeojz.default [2020-02-26]
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ivvbeojz.default\user.js [2013-10-12]
FF Homepage: Mozilla\Firefox\Profiles\ivvbeojz.default -> hxxp://www.rogers.com/smartkey
FF NetworkProxy: Mozilla\Firefox\Profiles\ivvbeojz.default -> type", 0
FF Extension: (DivX Web Player) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ivvbeojz.default\Extensions\[email protected] [2012-11-12] [Legacy] [not signed]
FF Extension: (Simple Adblock) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ivvbeojz.default\Extensions\[email protected] [2013-04-21] [Legacy] [not signed]
FF Extension: (Google Code Correction) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ivvbeojz.default\features\{0de90141-3771-4976-9faa-b18fbb1e0711}\[email protected] [2018-06-17] [Legacy]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ivvbeojz.default\searchplugins\avg-secure-search.xml [2013-10-11]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-13] (Adobe Systems Incorporated -> )
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [2009-03-20] (Adobe Systems, Inc.) [File not signed]
FF Plugin: @funwebproducts.com/Plugin -> C:\Program Files\FunWebProducts\Installr\1.bin\NPFunWeb.dll [No File]
FF Plugin: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll [2017-06-30] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll [2017-06-30] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-16] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2020-03-05] (Adobe Inc. -> Adobe Systems Inc.)
 
Chrome: 
=======
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2020-03-29]
CHR DownloadDir: C:\Users\User\Desktop
CHR Extension: (Slides) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13]
CHR Extension: (Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2020-02-19]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Sheets) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13]
CHR Extension: (Google Docs Offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2020-03-11]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-04]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-05]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-03-19]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile [2018-01-14]
 
==================== Services (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-02-06] (ArcSoft, Inc. -> ArcSoft Inc.)
R2 AdobeARMservice; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [88648 2020-02-25] (Adobe Inc. -> Adobe Systems)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_5576240ee6baaa25\aestsrv.exe [81920 2009-03-02] (Microsoft Windows Hardware Compatibility Publisher -> Andrea Electronics Corporation)
R2 DvmMDES; C:\SPLASH.SYS\config\DVMExportService.exe [323584 2009-07-08] (DeviceVM, Inc.) [File not signed]
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-15] (Hewlett-Packard) [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [5547464 2020-03-11] (Malwarebytes Inc -> Malwarebytes)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_5576240ee6baaa25\STacSV.exe [221266 2009-10-12] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Windows -> Microsoft Corporation)
R2 wlidsvc; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [1710464 2010-09-21] (Microsoft Corporation -> Microsoft Corp.)
 
===================== Drivers (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 athr; C:\Windows\System32\DRIVERS\athr.sys [1096704 2009-07-13] (Microsoft Windows -> Atheros Communications, Inc.)
R3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl6.sys [2494968 2009-10-27] (Broadcom Corporation -> Broadcom Corporation)
R3 btwaudio; C:\Windows\System32\drivers\btwaudio.sys [86056 2009-09-17] (Broadcom Corporation -> Broadcom Corporation.)
R3 btwavdt; C:\Windows\System32\DRIVERS\btwavdt.sys [108072 2009-09-17] (Broadcom Corporation -> Broadcom Corporation.)
R3 btwl2cap; C:\Windows\System32\DRIVERS\btwl2cap.sys [29472 2009-09-17] (Broadcom Corporation -> Broadcom Corporation.)
R3 btwrchid; C:\Windows\System32\DRIVERS\btwrchid.sys [18472 2009-09-17] (Broadcom Corporation -> Broadcom Corporation.)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [109456 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R1 DVMIO; C:\SPLASH.SYS\config\dvmio.sys [17624 2009-09-29] (DeviceVM Inc. -> DeviceVM, Inc.)
R3 HpqKbFiltr; C:\Windows\system32\DRIVERS\HpqKbFiltr.sys [15872 2009-04-29] (Microsoft Windows Hardware Compatibility Publisher -> Hewlett-Packard Development Company, L.P.)
S3 RSUSBSTOR; C:\Windows\System32\Drivers\RtsUStor.sys [174592 2009-09-01] (Microsoft Windows Hardware Compatibility Publisher -> Realtek Semiconductor Corp.)
S3 RTL8167; C:\Windows\System32\DRIVERS\Rt86win7.sys [204288 2009-10-02] (Microsoft Windows Hardware Compatibility Publisher -> Realtek )
S3 SrvHsfHDA; C:\Windows\System32\DRIVERS\VSTAZL3.SYS [207360 2009-07-13] (Microsoft Windows -> Conexant Systems, Inc.)
S3 SrvHsfV92; C:\Windows\System32\DRIVERS\VSTDPV3.SYS [980992 2009-07-13] (Microsoft Windows -> Conexant Systems, Inc.)
S3 SrvHsfWinac; C:\Windows\System32\DRIVERS\VSTCNXT3.SYS [661504 2009-07-13] (Microsoft Windows -> Conexant Systems, Inc.)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [147344 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 STHDA; C:\Windows\System32\DRIVERS\stwrt.sys [420864 2009-10-12] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed]
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-11] (Microsoft Windows -> Microsoft Corporation)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One month (created) ===================
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2020-03-29 00:35 - 2020-03-29 00:37 - 000026046 _____ C:\Users\User\Desktop\FRST.txt
2020-03-29 00:34 - 2020-03-29 00:36 - 000000000 ____D C:\FRST
2020-03-29 00:32 - 2020-03-29 00:33 - 002008064 _____ (Farbar) C:\Users\User\Desktop\FRST.exe
2020-03-28 18:14 - 2020-03-28 18:14 - 000001302 _____ C:\Users\User\Documents\mbscan2.txt
2020-03-26 23:55 - 2020-03-26 23:55 - 000001425 _____ C:\Users\User\Documents\mbscan.txt
 
==================== One month (modified) ==================
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2020-03-29 00:34 - 2009-07-14 00:34 - 000016480 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2020-03-29 00:34 - 2009-07-14 00:34 - 000016480 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2020-03-27 02:12 - 2019-09-07 16:08 - 000129056 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae.sys
2020-03-27 02:08 - 2010-01-04 05:12 - 000000177 ____H C:\dvmexp.idx
2020-03-27 02:04 - 2009-09-06 19:02 - 000782510 _____ C:\Windows\system32\PerfStringBackup.INI
2020-03-27 02:04 - 2009-07-13 22:37 - 000000000 ____D C:\Windows\inf
2020-03-27 01:59 - 2010-12-28 15:17 - 000000000 ____D C:\Users\User\Tracing
2020-03-27 01:59 - 2010-12-27 23:31 - 000000184 _____ C:\ProgramData\HPWALog.txt
2020-03-27 01:58 - 2010-12-27 23:31 - 000000000 ____D C:\Users\User\.migoDesktop
2020-03-27 01:58 - 2009-07-14 00:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2020-03-24 22:19 - 2019-01-06 15:27 - 000000000 ____D C:\Program Files\Infantry Online
2020-03-20 21:05 - 2019-07-03 14:34 - 000004464 _____ C:\Windows\system32\Tasks\Adobe Acrobat Update Task
2020-03-20 21:04 - 2019-07-03 14:32 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2020-03-20 20:34 - 2016-07-28 22:55 - 000003322 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA1d1e944af3d8143
2020-03-20 20:34 - 2016-07-28 22:55 - 000003194 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore1d1e944aed98777
2020-03-18 13:55 - 2014-12-04 19:56 - 000002130 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2020-03-18 13:55 - 2014-12-04 19:56 - 000002089 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2020-03-16 22:00 - 2012-07-31 00:03 - 000000000 ____D C:\Users\User\AppData\Local\CrashDumps
2020-03-15 04:04 - 2013-08-14 20:16 - 000000000 ____D C:\Windows\system32\MRT
2020-03-15 03:07 - 2011-01-20 08:34 - 118379832 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2020-03-11 22:35 - 2019-09-07 16:08 - 000001908 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
 
==================== Files in the root of some directories ========
 
2010-12-27 23:31 - 2010-12-27 23:31 - 000000000 _____ () C:\Users\User\AppData\Local\AtStart.txt
2010-12-27 23:31 - 2010-12-27 23:31 - 000000000 _____ () C:\Users\User\AppData\Local\DSwitch.txt
2010-12-27 23:31 - 2010-12-27 23:31 - 000000000 _____ () C:\Users\User\AppData\Local\QSwitch.txt
 
==================== SigCheck ============================
 
(There is no automatic fix for files that do not pass verification.)
 
 
LastRegBack: 2016-05-09 15:18
==================== End of FRST.txt ========================
 
 
 
 
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 28-03-2020
Ran by User (29-03-2020 00:38:53)
Running from C:\Users\User\Desktop
Microsoft Windows 7 Starter  Service Pack 1 (X86) (2010-12-28 03:24:19)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-3461133905-2381754433-3374124651-500 - Administrator - Disabled)
Guest (S-1-5-21-3461133905-2381754433-3374124651-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3461133905-2381754433-3374124651-1004 - Limited - Enabled)
User (S-1-5-21-3461133905-2381754433-3374124651-1000 - Administrator - Enabled) => C:\Users\User
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
ActiveCheck component for HP Active Support Library (HKLM\...\{254C37AA-6B72-4300-84F6-98A82419187E}) (Version: 3.0.0.1 - Hewlett-Packard) Hidden
Adobe Acrobat Reader DC (HKLM\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 20.006.20042 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.7.0.1530 - Adobe Systems Incorporated)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.5 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}) (Version: 11.0 - Adobe Systems, Inc.)
ArcSoft WebCam Companion 3 (HKLM\...\{34985F59-8F6F-46F4-9AD5-53E2714294D2}) (Version: 3.0.189 - ArcSoft)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.18.41 - Broadcom Corporation)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.2118 - CyberLink Corp.)
ESU for Microsoft Windows 7 (HKLM\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
GOM Player (HKLM\...\GOM Player) (Version: 2.1.21.4846 - Gretech Crop.)
Google Chrome (HKLM\...\Google Chrome) (Version: 80.0.3987.149 - Google LLC)
Google Update Helper (HKLM\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.35.451 - Google LLC) Hidden
Google Update Helper (HKLM\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
HP CloudDrive (HKLM\...\ZumoDrive) (Version:  - )
HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: 1.0.0.71 - WildTangent)
HP Integrated Module with Bluetooth wireless technology (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)
HP MediaStream (HKLM\...\{4414C431-245A-4AF7-8FE0-3ED2333FD8D2}) (Version: 2.5.1466 - Simplify Media)
HP Quick Launch Buttons (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.50.7.1 - Hewlett-Packard)
HP QuickSync (HKLM\...\{EEA95E6C-6847-49BE-83C9-ED92D8E18983}) (Version: 5.1.234.4788 - Hewlett-Packard)
HP QuickWeb (HKLM\...\{21FFAF37-E51A-41AB-8749-ACD1F9CF8E37}) (Version: 1.1.2.2 - DeviceVM, Inc.)
HP Setup (HKLM\...\{17B4760F-334B-475D-829F-1A3E94A6A4E6}) (Version: 1.2.3560.3170 - Hewlett-Packard)
HP Support Assistant (HKLM\...\{06F22256-8A8D-4F3F-B22C-6E07313D0FD1}) (Version: 4.2.6.13 - Hewlett-Packard)
HP Update (HKLM\...\{D46D081B-F60E-467E-A7C4-117B70D76731}) (Version: 5.001.000.014 - Hewlett-Packard)
HP User Guides 0169 (HKLM\...\{4B7057D5-6D5D-4088-8217-48EA20C44373}) (Version: 1.01.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{1061DF04-CF33-40B0-8360-D07C9BBEB122}) (Version: 3.50.10.1 - Hewlett-Packard)
HPAsset component for HP Active Support Library (HKLM\...\{669D4A35-146B-4314-89F1-1AC3D7B88367}) (Version: 3.0.0.3 - Hewlett-Packard) Hidden
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6246.0 - IDT)
Infantry Online (HKLM\...\{C5C9130F-1F0F-47E7-96D1-032573247263}) (Version: 2.1.0.9 - Free Infantry Group) Hidden
Infantry Online (HKU\S-1-5-21-3461133905-2381754433-3374124651-1000\...\Infantry Online 2.1.0.9) (Version: 2.1.0.9 - Free Infantry Group)
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.1929 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java 8 Update 131 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180131F0}) (Version: 8.0.1310.11 - Oracle Corporation)
Junk Mail filter update (HKLM\...\{8E5233E1-7495-44FB-8DEB-4BE906D59619}) (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Malwarebytes version 4.1.0.56 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.1.0.56 - Malwarebytes)
Microsoft .NET Framework 4.8 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.8.03761 - Microsoft Corporation)
Microsoft .NET Framework 4.8 (العربية) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1025) (Version: 4.8.03761 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version:  - Microsoft)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50918.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 49.0.1 (x86 en-GB) (HKLM\...\Mozilla Firefox 49.0.1 (x86 en-GB)) (Version: 49.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 49.0.1 - Mozilla)
Mumble 1.2.19 (HKLM\...\{9BCF5203-72BB-4425-A391-83BF298EF376}) (Version: 1.2.19 - Thorvald Natvig)
OpenOffice.org 3.4.1 (HKLM\...\{C1D2E768-21A2-4AEF-AF5E-48E9CE6550F2}) (Version: 3.41.9593 - Apache Software Foundation)
Paint XP version 1.2 (HKLM\...\{2367FAB6-055A-4923-835F-F57F7BBBA363}_is1) (Version: 1.2 - MSPAINTXP.COM)
Power2Go (HKLM\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3318 - CyberLink Corp.) Hidden
Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3318 - CyberLink Corp.)
QLBCASL (HKLM\...\{F1D7AC58-554A-4A58-B784-B61558B1449A}) (Version: 6.40.17.2 - Hewlett-Packard) Hidden
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0010 - Realtek)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30104 - Realtek Semiconductor Corp.)
Recovery Manager (HKLM\...\{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.5.2214 - CyberLink Corp.) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.13.1 - Synaptics Incorporated)
The KMPlayer (remove only) (HKLM\...\The KMPlayer) (Version:  - )
Times Reader (HKLM\...\{491ADA37-04EE-2ECE-9F86-DDC0106047AC}) (Version: 2.055 - The New York Times Company)
VC80CRTRedist - 8.0.50727.6195 (HKLM\...\{933B4015-4618-4716-A828-5289FC03165F}) (Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WildTangent ShortcutProvider (HKLM\...\{80831F60-19D7-43B3-A60C-5CAF8C478DF6}) (Version: 4.5.1.170 - WildTangent) Hidden
Windows Driver Package - Broadcom Bluetooth  (06/15/2009 6.2.0.9000) (HKLM\...\B7541EC5F72AA713F557569278EB6273725F5607) (Version: 06/15/2009 6.2.0.9000 - Broadcom)
Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405) (HKLM\...\A6A8668C0A13640CA28FE2A7D9654BE4AE478B13) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinZip 23.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C2411E}) (Version: 23.0.13431 - Corel Corporation)
 
==================== Custom CLSID (Whitelisted): ==============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-3461133905-2381754433-3374124651-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 -> C:\Program Files\WinZip\adxloader.WinZipExpressForOffice.dll (Corel Corporation -> )
ShellIconOverlayIdentifiers: [00Zecter] -> {D25B32FE-CB96-491A-98FF-AD59DA382D69} => C:\Program Files\Hewlett-Packard\HP CloudDrive\ShellExt.dll [2009-10-28] (Versionate Inc.) [File not signed]
ShellIconOverlayIdentifiers: [01Zecter] -> {EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5} => C:\Program Files\Hewlett-Packard\HP CloudDrive\ShellExt.dll [2009-10-28] (Versionate Inc.) [File not signed]
ShellIconOverlayIdentifiers: [02Zecter] -> {B3C78E40-6B64-47C3-AE34-60B770881EB8} => C:\Program Files\Hewlett-Packard\HP CloudDrive\ShellExt.dll [2009-10-28] (Versionate Inc.) [File not signed]
ShellIconOverlayIdentifiers: [03Zecter] -> {622AFE52-33F6-4D9F-9966-E0BC52D7D69D} => C:\Program Files\Hewlett-Packard\HP CloudDrive\ShellExt.dll [2009-10-28] (Versionate Inc.) [File not signed]
ShellIconOverlayIdentifiers: [04Zecter] -> {855156F0-2A0F-11DE-8C30-0800200C9A66} => C:\Program Files\Hewlett-Packard\HP CloudDrive\ShellExt.dll [2009-10-28] (Versionate Inc.) [File not signed]
ContextMenuHandlers1: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshlstb.dll [2019-05-17] (Corel Corporation -> WinZip Computing)
ContextMenuHandlers1: [Zecter] -> {E032716F-2E0A-4CCB-9FEB-BF2090B035DF} => C:\Program Files\Hewlett-Packard\HP CloudDrive\ShellExt.dll [2009-10-28] (Versionate Inc.) [File not signed]
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers4: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshlstb.dll [2019-05-17] (Corel Corporation -> WinZip Computing)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2009-09-23] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshlstb.dll [2019-05-17] (Corel Corporation -> WinZip Computing)
ContextMenuHandlers6: [Zecter] -> {E032716F-2E0A-4CCB-9FEB-BF2090B035DF} => C:\Program Files\Hewlett-Packard\HP CloudDrive\ShellExt.dll [2009-10-28] (Versionate Inc.) [File not signed]
 
==================== Codecs (Whitelisted) ====================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Drivers32: [msacm.divxa32] => C:\Windows\system32\msaud32_divx.acm [186368 2003-02-03] (Microsoft Corporation) [File not signed]
 
==================== Shortcuts & WMI ========================
 
==================== Loaded Modules (Whitelisted) =============
 
2008-11-13 18:28 - 2008-11-13 18:28 - 000007168 _____ ( ) [File not signed] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\Interop.HPQTOASTERLib.dll
2008-11-13 18:28 - 2008-11-13 18:28 - 000005120 _____ ( ) [File not signed] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\Interop.HPQWMIEXLib.dll
2020-03-27 02:00 - 2020-03-27 02:00 - 000379904 _____ () [File not signed] C:\Users\User\AppData\Local\Temp\libsqlitejdbc-8274762169473387228.lib
2010-12-27 23:31 - 2020-03-27 01:59 - 000197120 _____ () [File not signed] C:\Users\User\AppData\Local\Temp\WindowsAPI.dll
2010-12-27 23:31 - 2010-12-27 23:31 - 000077824 _____ (Eclipse Foundation) [File not signed] C:\Users\User\AppData\Local\Temp\swt-gdip-win32-3448.dll
2010-12-27 23:31 - 2010-12-27 23:31 - 000335872 _____ (Eclipse Foundation) [File not signed] C:\Users\User\AppData\Local\Temp\swt-win32-3448.dll
2009-09-01 14:30 - 2009-09-01 14:30 - 000013824 _____ (Hewlett-Packard Development Company, L.P.) [File not signed] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\ar\HPWAMain.resources.dll
2010-01-04 05:06 - 2010-01-04 05:06 - 000101376 _____ (Hewlett-Packard) [File not signed] C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
2010-01-04 04:44 - 2009-06-04 23:03 - 000073728 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel Matrix Storage Manager\ENU\IAAMon_ENU.dll
2010-01-04 04:44 - 2009-06-04 23:02 - 000118784 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel Matrix Storage Manager\ENU\PlugInRAID_ENU.dll
2010-01-04 04:44 - 2009-06-04 22:55 - 000208896 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel Matrix Storage Manager\ISDI.dll
2009-07-14 07:54 - 2009-07-14 07:54 - 000348160 _____ (Microsoft Corporation) [File not signed] C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\msvcr71.dll
2010-12-28 14:32 - 2010-12-28 14:32 - 000352256 _____ (Microsoft Corporation) [File not signed] C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_ar_b77a5c561934e089\mscorlib.resources.dll
2010-12-28 14:32 - 2010-12-28 14:32 - 000040960 _____ (Microsoft Corporation) [File not signed] C:\Windows\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_ar_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll
2012-07-23 20:20 - 2012-07-23 20:20 - 001101824 _____ (Microsoft Corporation) [File not signed] C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_cbf5e994470a1a8f\MFC80.DLL
2012-07-23 20:20 - 2012-07-23 20:20 - 001093120 _____ (Microsoft Corporation) [File not signed] C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_cbf5e994470a1a8f\MFC80U.DLL
2009-07-14 07:54 - 2009-07-14 07:54 - 002301952 _____ (Sun Microsystems, Inc.) [File not signed] C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\client\jvm.dll
2009-07-14 07:54 - 2009-07-14 07:54 - 000015872 _____ (Sun Microsystems, Inc.) [File not signed] C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\hpi.dll
2009-07-14 07:54 - 2009-07-14 07:54 - 000126976 _____ (Sun Microsystems, Inc.) [File not signed] C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\java.dll
2009-07-14 07:54 - 2009-07-14 07:54 - 000077824 _____ (Sun Microsystems, Inc.) [File not signed] C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\net.dll
2009-07-14 07:54 - 2009-07-14 07:54 - 000031744 _____ (Sun Microsystems, Inc.) [File not signed] C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\verify.dll
2009-07-14 07:54 - 2009-07-14 07:54 - 000047104 _____ (Sun Microsystems, Inc.) [File not signed] C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\zip.dll
2009-10-28 21:18 - 2009-10-28 21:18 - 000661504 _____ (Versionate Inc.) [File not signed] C:\Program Files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
 
==================== Alternate Data Streams (Whitelisted) ========
 
==================== Safe Mode (Whitelisted) ==================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
 
==================== Association (Whitelisted) =================
 
==================== Internet Explorer trusted/restricted ==========
 
==================== Hosts content: =========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 22:04 - 2009-06-10 17:39 - 000000824 _____ C:\Windows\system32\drivers\etc\hosts
 
==================== Other Areas ===========================
 
(Currently there is no automatic fix for this section.)
 
HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\ProgramData\Oracle\Java\javapath;C:\Program Files\Common Files\Microsoft Shared\Windows Live;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files\Broadcom\Broadcom 802.11\Driver;C:\Program Files\WIDCOMM\Bluetooth Software\
HKU\S-1-5-21-3461133905-2381754433-3374124651-1000\Control Panel\Desktop\\Wallpaper -> %windir%\web\wallpaper\windows\img0.jpg
DNS Servers: 64.71.255.204 - 64.71.255.198
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
==================== FirewallRules (Whitelisted) ================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [TCP Query User{33DA6925-0959-4372-82BB-5B3D2AFCC0C2}C:\program files\hewlett-packard\hp quicksync\jre\bin\javaw.exe] => (Block) C:\program files\hewlett-packard\hp quicksync\jre\bin\javaw.exe
FirewallRules: [UDP Query User{AAFDA8FA-54DB-4858-B711-59147468F957}C:\program files\hewlett-packard\hp quicksync\jre\bin\javaw.exe] => (Block) C:\program files\hewlett-packard\hp quicksync\jre\bin\javaw.exe
FirewallRules: [{D945B66C-2523-423A-96E9-7AE6B3126403}] => (Allow) C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{C8D0A1AB-A3F7-48EA-A1FB-D37A3866DBBE}] => (Allow) svchost.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{1D1710F4-336B-465F-8E81-FE4E70C394AD}] => (Allow) C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{8258AB0D-2343-40AE-BD5B-7DDF1B50468D}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{12A1DEA4-154A-40CD-92AB-F659330AAFDA}C:\program files\hewlett-packard\hp quicksync\jre\bin\javaw.exe] => (Block) C:\program files\hewlett-packard\hp quicksync\jre\bin\javaw.exe
FirewallRules: [UDP Query User{17516C5A-8C23-4DE9-9A83-D1BC6822CAB5}C:\program files\hewlett-packard\hp quicksync\jre\bin\javaw.exe] => (Block) C:\program files\hewlett-packard\hp quicksync\jre\bin\javaw.exe
FirewallRules: [{C663071D-460E-4C21-A8AF-D6977B2B49B1}] => (Allow) C:\Program Files\Steam\Steam.exe No File
FirewallRules: [{FC9D5C45-DA19-415A-A413-EB50309E73A0}] => (Allow) C:\Program Files\Steam\Steam.exe No File
FirewallRules: [{998901DC-328C-42B7-9DDB-AD46317B8630}] => (Allow) C:\Program Files\Steam\bin\steamwebhelper.exe No File
FirewallRules: [{662310F8-7794-4C58-B856-8A9AC76F1931}] => (Allow) C:\Program Files\Steam\bin\steamwebhelper.exe No File
FirewallRules: [TCP Query User{67A38F2C-5FAC-4A00-A8FF-BBB3EDAC4F46}C:\users\user\appdata\local\popcorn time community\nw.exe] => (Block) C:\users\user\appdata\local\popcorn time community\nw.exe No File
FirewallRules: [UDP Query User{2B7CE4C5-6B31-45AB-B4F0-04AA6A40A208}C:\users\user\appdata\local\popcorn time community\nw.exe] => (Block) C:\users\user\appdata\local\popcorn time community\nw.exe No File
FirewallRules: [{93267959-D3CE-41E0-AA98-477DE8ABE4C4}] => (Allow) C:\Program Files\Ventrilo\Ventrilo.exe No File
FirewallRules: [{63247B58-D3DD-440E-88E7-41F2BCD37296}] => (Allow) C:\Program Files\Ventrilo\Ventrilo.exe No File
FirewallRules: [{2929A2A3-3952-4B10-B511-0064BFA9EB1A}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{3C909B20-234D-4431-96D4-942CA02F3688}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{BF63ADEE-D316-4818-ACE3-11591F49FAF2}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
 
==================== Restore Points =========================
 
08-03-2020 19:02:42 Windows Update
15-03-2020 03:00:49 Windows Update
17-03-2020 03:00:50 Windows Update
21-03-2020 14:47:53 Windows Update
24-03-2020 13:38:49 Windows Update
28-03-2020 14:31:26 Windows Update
 
==================== Faulty Device Manager Devices ============
 
 
==================== Event log errors: ========================
 
Application errors:
==================
Error: (03/27/2020 02:04:22 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 001 language ID. The first DWORD in the Data section contains the Win32 error code.
 
Error: (03/27/2020 02:04:21 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 001 language ID. The first DWORD in the Data section contains the Win32 error code.
 
Error: (03/24/2020 01:44:17 PM) (Source: MsiInstaller) (EventID: 1024) (User: NT AUTHORITY)
Description: ‏‏المنتج: Microsoft Office OneNote MUI (English) 2007 - تعذر تثبيت تحديث 'Update for Microsoft Office OneNote 2007 Help (KB963670)'. رمز الخطأ 1603. تمكن لـ Windows Installer إنشاء سجلات للمساعدة في استكشاف المشاكل الخاصة بتثبيت حزم البرامج وحلها. استخدم الارتباط التالي للحصول على إرشادات حول تشغيل دعم التسجيل: http://go.microsoft....k/?LinkId=23127
 
Error: (03/24/2020 01:44:01 PM) (Source: MsiInstaller) (EventID: 1024) (User: NT AUTHORITY)
Description: ‏‏المنتج: Microsoft Office PowerPoint MUI (English) 2007 - تعذر تثبيت تحديث 'Update for Microsoft Office Powerpoint 2007 Help (KB963669)'. رمز الخطأ 1603. تمكن لـ Windows Installer إنشاء سجلات للمساعدة في استكشاف المشاكل الخاصة بتثبيت حزم البرامج وحلها. استخدم الارتباط التالي للحصول على إرشادات حول تشغيل دعم التسجيل: http://go.microsoft....k/?LinkId=23127
 
Error: (03/24/2020 01:43:49 PM) (Source: MsiInstaller) (EventID: 1024) (User: NT AUTHORITY)
Description: ‏‏المنتج: Microsoft Office Shared MUI (English) 2007 - تعذر تثبيت تحديث 'Update for Microsoft Office 2007 Help for Common Features (KB963673)'. رمز الخطأ 1603. تمكن لـ Windows Installer إنشاء سجلات للمساعدة في استكشاف المشاكل الخاصة بتثبيت حزم البرامج وحلها. استخدم الارتباط التالي للحصول على إرشادات حول تشغيل دعم التسجيل: http://go.microsoft....k/?LinkId=23127
 
Error: (03/24/2020 01:43:41 PM) (Source: MsiInstaller) (EventID: 1024) (User: NT AUTHORITY)
Description: ‏‏المنتج: Microsoft Office Word MUI (English) 2007 - تعذر تثبيت تحديث 'Update for Microsoft Office Word 2007 Help (KB963665)'. رمز الخطأ 1603. تمكن لـ Windows Installer إنشاء سجلات للمساعدة في استكشاف المشاكل الخاصة بتثبيت حزم البرامج وحلها. استخدم الارتباط التالي للحصول على إرشادات حول تشغيل دعم التسجيل: http://go.microsoft....k/?LinkId=23127
 
Error: (03/24/2020 01:43:35 PM) (Source: MsiInstaller) (EventID: 1024) (User: NT AUTHORITY)
Description: ‏‏المنتج: Microsoft Office Excel MUI (English) 2007 - تعذر تثبيت تحديث 'Update for Microsoft Office Excel 2007 Help (KB963678)'. رمز الخطأ 1603. تمكن لـ Windows Installer إنشاء سجلات للمساعدة في استكشاف المشاكل الخاصة بتثبيت حزم البرامج وحلها. استخدم الارتباط التالي للحصول على إرشادات حول تشغيل دعم التسجيل: http://go.microsoft....k/?LinkId=23127
 
Error: (03/24/2020 01:41:37 PM) (Source: MsiInstaller) (EventID: 1024) (User: NT AUTHORITY)
Description: ‏‏المنتج: Microsoft Office Shared MUI (English) 2007 - تعذر تثبيت تحديث 'Microsoft Office 2007 Service Pack 3 (SP3)'. رمز الخطأ 1603. تمكن لـ Windows Installer إنشاء سجلات للمساعدة في استكشاف المشاكل الخاصة بتثبيت حزم البرامج وحلها. استخدم الارتباط التالي للحصول على إرشادات حول تشغيل دعم التسجيل: http://go.microsoft....k/?LinkId=23127
 
 
System errors:
=============
Error: (03/27/2020 06:49:50 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: ‏‏تم الوصول إلى نهاية المهلة (30000 مللي ثانية) أثناء انتظار استجابة معاملة من الخدمة ShellHWDetection.
 
Error: (03/27/2020 05:10:08 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: ‏‏تم الوصول إلى نهاية المهلة (30000 مللي ثانية) أثناء انتظار استجابة معاملة من الخدمة Netman.
 
Error: (03/27/2020 01:58:24 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: ‏‏فشل تحميل برنامج التشغيل التالي الخاص ببدء تشغيل النظام أو تمهيد للتشغيل: 
cdrom
 
Error: (03/27/2020 01:58:02 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 01:54:05 on ‎27/‎03/‎2020 was unexpected.
 
Error: (03/25/2020 08:38:50 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: ‏‏تم الوصول إلى نهاية المهلة (30000 مللي ثانية) أثناء انتظار استجابة معاملة من الخدمة wuauserv.
 
Error: (03/24/2020 04:17:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: ‏‏تم الوصول إلى نهاية المهلة (30000 مللي ثانية) أثناء انتظار استجابة معاملة من الخدمة Schedule.
 
Error: (03/24/2020 02:08:42 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070663: تحديث أمان لـ Microsoft Office 2007 suites (KB2825645).
 
Error: (03/24/2020 02:08:42 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: تحديث لتعليمات برنامج Microsoft Office OneNote 2007 رقم (KB963670).
 
 
Windows Defender:
===================================
Date: 2019-08-12 16:50:19.880
Description: 
Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted:Current
Error Code:0x80070003
Error description:??????? ??? ?????? ?????? ??? ?????? ??????. 
Signature version:0.0.0.0
Engine version:0.0.0.0
 
Date: 2018-07-04 19:26:09.454
Description: 
Windows Defender has encountered an error trying to update signatures.
New Signature Version:1.271.442.0
Previous Signature Version:1.269.1075.0
Update Source:User
Signature Type:AntiSpyware
Update Type:Delta
Current Engine Version:1.1.15000.2
Previous Engine Version:1.1.14901.4
Error code:0x80070666
Error description:???? ?????? ????? ????? ??? ?? ??? ??????. ????? ?????? ????? ??? ???????. ?????? ??????? ??????? ?? ??? ?????? ?? ??????? ?????? "?????/????? ???????" ??? "???? ??????". 
 
Date: 2018-07-04 19:26:09.454
Description: 
Windows Defender has encountered an error trying to update the engine.
New Engine Version:1.1.15000.2
Previous Engine Version:1.1.14901.4
Update Source:User
Error Code:0x80070666
Error description:???? ?????? ????? ????? ??? ?? ??? ??????. ????? ?????? ????? ??? ???????. ?????? ??????? ??????? ?? ??? ?????? ?? ??????? ?????? "?????/????? ???????" ??? "???? ??????". 
 
==================== Memory info =========================== 
 
BIOS: Hewlett-Packard F.02 12/04/2009
Motherboard: Hewlett-Packard 3660
Processor: Intel® Atom™ CPU N450 @ 1.66GHz
Percentage of memory in use: 92%
Total physical RAM: 2011.48 MB
Available physical RAM: 144.41 MB
Total Virtual: 4022.95 MB
Available Virtual: 1537.55 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:221.1 GB) (Free:138.75 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:11.49 GB) (Free:1.87 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32
 
\\?\Volume{0dd352f5-131c-11e0-99a7-806e6f6e6963}\ () (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS
 
==================== MBR & Partition Table ====================
 
==========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: 871A1FDD)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=221.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=11.5 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
 
==================== End of Addition.txt =======================

  • 0

#4
iMacg3

iMacg3

    GeekU PowerPC G3

  • GeekU Moderator
  • 1,899 posts
My apologies for the delay, currently reviewing your logs.
  • 0

#5
iMacg3

iMacg3

    GeekU PowerPC G3

  • GeekU Moderator
  • 1,899 posts
Hi tsvc15,

I don't see an Antivirus program running on your machine

Download and install an antivirus program, and make sure that you keep it updated
New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.
A good free antivirus is Microsoft Security Essentials

Note: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.

---------------------------------------------------
Did you set a proxy in Firefox?

FF NetworkProxy: Mozilla\Firefox\Profiles\ivvbeojz.default -> type", 0


---------------------------------------------------
Farbar Recovery Scan Tool - Fix
  • Highlight the contents of the below code box and press Ctrl + C on your keyboard:
    Start::
    CreateRestorePoint:
    CloseProcesses:
    Task: {2BD05BA6-988D-4BD3-A9CD-9A39F80AF524} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
    Task: {5B184694-64C3-4633-94C5-945B3FA561D6} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
    Task: {9F54B95F-5096-4803-AE61-E9B3AC5B616D} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
    Task: {D21F6024-191F-4454-BBBC-09A650DA2549} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
    SearchScopes: HKLM -> DefaultScope {95FBE619-19B8-4D4D-85FF-AC655C023F00} URL = 
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-21-3461133905-2381754433-3374124651-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://tbsearch.ask.com/redirect?client=ie&tb=PTV&o=15184&src=crm&q={searchTerms}&locale=en_US
    BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
    Toolbar: HKU\S-1-5-21-3461133905-2381754433-3374124651-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
    Toolbar: HKU\S-1-5-21-3461133905-2381754433-3374124651-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
    FF Plugin: @funwebproducts.com/Plugin -> C:\Program Files\FunWebProducts\Installr\1.bin\NPFunWeb.dll [No File]
    FirewallRules: [{C663071D-460E-4C21-A8AF-D6977B2B49B1}] => (Allow) C:\Program Files\Steam\Steam.exe No File
    FirewallRules: [{FC9D5C45-DA19-415A-A413-EB50309E73A0}] => (Allow) C:\Program Files\Steam\Steam.exe No File
    FirewallRules: [{998901DC-328C-42B7-9DDB-AD46317B8630}] => (Allow) C:\Program Files\Steam\bin\steamwebhelper.exe No File
    FirewallRules: [{662310F8-7794-4C58-B856-8A9AC76F1931}] => (Allow) C:\Program Files\Steam\bin\steamwebhelper.exe No File
    FirewallRules: [TCP Query User{67A38F2C-5FAC-4A00-A8FF-BBB3EDAC4F46}C:\users\user\appdata\local\popcorn time community\nw.exe] => (Block) C:\users\user\appdata\local\popcorn time community\nw.exe No File
    FirewallRules: [UDP Query User{2B7CE4C5-6B31-45AB-B4F0-04AA6A40A208}C:\users\user\appdata\local\popcorn time community\nw.exe] => (Block) C:\users\user\appdata\local\popcorn time community\nw.exe No File
    FirewallRules: [{93267959-D3CE-41E0-AA98-477DE8ABE4C4}] => (Allow) C:\Program Files\Ventrilo\Ventrilo.exe No File
    FirewallRules: [{63247B58-D3DD-440E-88E7-41F2BCD37296}] => (Allow) C:\Program Files\Ventrilo\Ventrilo.exe No File
    C:\Program Files\FunWebProducts
    VirusTotal: C:\dvmexp.idx
    End::
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
  • Double-click FRST.exe/FRST64.exe to run it.
  • Press the Fix button just once and wait.
    Note: No need to paste the script into FRST.
  • Restart the computer if prompted.
  • When the fix is complete FRST will generate a log in the same location it was run from (Fixlog.txt)
  • Please copy and paste its contents into your reply.

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP