Browser Hijacked by Searchinterneat-a.akamaihd.net

Hi, this is for my father in law who has been infected by the browser hijacker Searchinterneat-a.akamaihd.net. I have been able to remove this from the Firefox and Microsoft Edge browsers but not on Google Chrome. I suspect it is lurking somewhere and will reinfect the first two browsers. I have advised him not to use Google Chrome for the moment. Thanks for the help. Below is the FRST scan results and attached is the addition text.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:20-11-2015
Ran by User (administrator) on USER-PC (21-11-2015 14:48:11)
Running from C:\Users\User\Desktop\Downloads
Loaded Profiles: User (Available Profiles: User & DefaultAppPool)
Platform: Microsoft Windows 10 Home (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\AdAwareService.exe
(Eastman Kodak Company) C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe
(Eastman Kodak Company) C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
(McAfee, Inc.) C:\Program Files\McAfee Online Backup\MOBKbackup.exe
(Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(SPEEDbit) C:\Program Files\SpeedBit Video Accelerator\VideoAcceleratorService.exe
(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.28.15\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wimserv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(McAfee, Inc.) C:\Program Files\McAfee Online Backup\MOBKbackup.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\AdAwareTray.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Farbar) C:\Users\User\Desktop\Downloads\FRST(1).exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12214528 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [InstaLAN] => C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [1501080 2010-09-14] (Affinegy, Inc.)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe [2804224 2012-10-08] (Eastman Kodak Company)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\AdAwareTray.exe [7992032 2015-08-27] ()
HKU\S-1-5-21-3204613035-2029300637-3654983870-1000\...\Run: [Google Update] => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-12] (Google Inc.)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
ShellIconOverlayIdentifiers: [MOBK] -> {3c3f3c1a-9153-7c05-f938-622e7003894d} => C:\Program Files\McAfee Online Backup\MOBKshell.dll [2010-04-13] (McAfee, Inc.)
ShellIconOverlayIdentifiers: [MOBK2] -> {e6ea1d7d-144e-b977-98c4-84c53c1a69d0} => C:\Program Files\McAfee Online Backup\MOBKshell.dll [2010-04-13] (McAfee, Inc.)
ShellIconOverlayIdentifiers: [MOBK3] -> {b4caf489-1eec-c617-49ad-8d7088598c06} => C:\Program Files\McAfee Online Backup\MOBKshell.dll [2010-04-13] (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Onscreen Keyboard.lnk [2013-03-18]
ShortcutTarget: Onscreen Keyboard.lnk -> C:\Program Files\Logitech\OnScreen Keyboard\LOnScreenKeyboard.exe (Logitech, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456 2008-12-12] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{063f60fc-e45f-444a-b805-5d4ef9bf1a74}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{69d6ec8c-1be1-4350-a4ed-f462c458d8a6}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3204613035-2029300637-3654983870-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://uk.msn.com/?ocid=iehp
HKU\S-1-5-21-3204613035-2029300637-3654983870-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google%20search/
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-3204613035-2029300637-3654983870-1000 -> {AD28848E-7770-4E36-A04D-89A5F5120B80} URL = hxxp://uk.search.yahoo.com/search?fr=mcafee&type=A011GB0&p={SearchTerms}
SearchScopes: HKU\S-1-5-21-3204613035-2029300637-3654983870-1000 -> {DF8DADF1-DEEB-44CF-856F-42EAE0FCF055} URL = hxxp://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bl-bir-dd__alt__ddc_dss_bd_com&p={searchTerms}
BHO: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-10-21] (Oracle Corporation)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-21] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3204613035-2029300637-3654983870-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\77fbvnrt.default-1447016909904
FF DefaultSearchEngine: Default
FF Homepage: hxxps://www.google.co.uk/
FF Session Restore: -> is enabled.
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-11] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1205146.dll [No File]
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-21] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-17] (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-17] (NVIDIA Corporation)
FF Plugin: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2014-03-15] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [No File]
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [No File]
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [No File]
FF Plugin: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll [2014-03-15] (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [No File]
FF Plugin: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll [2011-06-20] (RocketLife, LLP)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3204613035-2029300637-3654983870-1000: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\Users\User\AppData\Roaming\Visan\plugins\npRLSecurePluginLayer.dll [2011-02-03] (RocketLife, LLP)
FF Plugin HKU\S-1-5-21-3204613035-2029300637-3654983870-1000: @tools.google.com/Google Update;version=3 -> C:\Users\User\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin HKU\S-1-5-21-3204613035-2029300637-3654983870-1000: @tools.google.com/Google Update;version=9 -> C:\Users\User\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2014-03-15] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2014-03-15] (RealPlayer)
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\77fbvnrt.default-1447016909904\searchplugins\default.xml [2015-11-16]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml [2014-02-15]
FF Extension: NoSquint - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\77fbvnrt.default-1447016909904\extensions\nosquint@urandom.ca.xpi [2015-11-15]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found
FF HKLM\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2015-05-09] [not signed]
FF HKLM\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-08-08] [not signed]
FF HKLM\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found

Chrome:
=======
CHR RestoreOnStartup: Default -> "hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRghCeFwJUlpBFRgWIVoMTA1AR1QOeQgKVxQVQAwQJAoJB11BFA0FIk0FA1oDB0VXfV5bFElXTwhxJUpNDU0CaUBB"
CHR StartupUrls: Default -> "hxxps://www.google.co.uk/"
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-01]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Google Docs Offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-02]
CHR Extension: (Facebook AdBlock) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfpacabphcagfehdgnigmfnbjdampbaa [2015-06-29]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-31]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-01]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Slides) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-10-15]
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-10-15]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-15]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-15]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-15]
CHR Extension: (ImageZoom.org) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ddjmelnegdjkimdmgogofpjkakkogbmk [2015-10-15] [UpdateUrl: hxxps://crossrider.cotssl.net/plugin/chrome/update/15804.xml] <==== ATTENTION
CHR Extension: (Google Sheets) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-10-15]
CHR Extension: (Google Docs Offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-10-15]
CHR Extension: (eBay Shopping Assistant) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hbcennhacfaagdopikcegfcobcadeocj [2015-10-15]
CHR Extension: (Domain Error Assistant) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj [2015-10-15]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-10-15]
CHR Extension: (Skype Click to Call) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-10-15]
CHR Extension: (Slick Savings) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk [2015-10-15] [UpdateUrl: hxxp://www.mybrowserbar.com/update/wt/gc/coupons/update.xml] <==== ATTENTION
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-15]
CHR Extension: (Amazon Shopping Assistant by Spigot) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pfndaklgolladniicklehhancnlgocpp [2015-10-15] [UpdateUrl: hxxp://update.mybrowserbar.com/update/wt/gc/shoppingassistantamazon/update.xml] <==== ATTENTION
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-10-15]
CHR HKLM\...\Chrome\Extension: [edaibbiobngpbmeonadpbfafbkimjbdd] - C:\ProgramData\Logitech\LogiSmoothChromeExt.crx <not found>

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [571288 2010-09-14] (Affinegy, Inc.)
R2 BtSwitcherService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe [42712 2012-03-22] (Cambridge Silicon Radio Limited)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
R2 CSRBtAudioService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe [938712 2012-03-22] (Cambridge Silicon Radio Limited)
S2 CsrBtOBEXService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe [432336 2012-03-22] (Cambridge Silicon Radio Limited)
R2 CsrBtService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe [614088 2012-03-22] (Cambridge Silicon Radio Limited)
R2 Kodak AiO Network Discovery Service; C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe [395640 2014-05-06] (Eastman Kodak Company)
R2 Kodak AiO Status Monitor Service; C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [780152 2013-12-11] (Eastman Kodak Company)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.8.586.8535\AdAwareService.exe [659872 2015-08-27] ()
R2 MOBKbackup; C:\Program Files\McAfee Online Backup\MOBKbackup.exe [229688 2010-04-13] (McAfee, Inc.)
U2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14658848 2013-12-10] (NVIDIA Corporation)
R2 OneSyncSvc_Session19; C:\WINDOWS\system32\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
S3 PimIndexMaintenanceSvc_Session19; C:\WINDOWS\system32\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S3 UnistoreSvc_Session19; C:\WINDOWS\System32\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
S3 UserDataSvc_Session19; C:\WINDOWS\system32\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
R2 VideoAcceleratorService; C:\Program Files\SpeedBit Video Accelerator\VideoAcceleratorService.exe [281768 2014-03-15] (SPEEDbit)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [277760 2015-07-10] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23264 2015-07-10] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\WINDOWS\System32\drivers\athwn.sys [3205632 2015-07-10] (Qualcomm Atheros Communications, Inc.)
R3 csrusb; C:\WINDOWS\System32\Drivers\csrusb.sys [39616 2012-03-22] (Cambridge Silicon Radio Limited)
R3 csrusbfilter; C:\WINDOWS\System32\Drivers\csrusbfilter.sys [20168 2012-03-22] (Cambridge Silicon Radio Limited)
R3 LEqdUsb; C:\WINDOWS\System32\Drivers\LEqdUsb.Sys [42264 2014-03-19] (Logitech, Inc.)
R3 LHidEqd; C:\WINDOWS\System32\Drivers\LHidEqd.Sys [10136 2014-03-19] (Logitech, Inc.)
R3 LUsbFilt; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [28312 2014-03-19] (Logitech, Inc.)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad32v.sys [34080 2013-12-05] (NVIDIA Corporation)
R3 rt640x86; C:\WINDOWS\System32\drivers\rt640x86.sys [492032 2015-07-10] (Realtek )
S3 SRS_AE_Service; C:\WINDOWS\System32\drivers\SRS_AE_i386.sys [407368 2012-06-21] ()
R3 Trufos; C:\WINDOWS\System32\DRIVERS\Trufos.sys [408280 2015-01-22] (BitDefender S.R.L.)
S3 UdeCx; C:\WINDOWS\System32\drivers\udecx.sys [31744 2015-07-10] ()
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [37400 2015-07-10] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [245600 2015-07-10] (Microsoft Corporation)
R2 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [97632 2015-07-10] (Microsoft Corporation)
S3 WUDFWpdMtp; C:\WINDOWS\System32\drivers\WUDFRd.sys [161792 2015-07-10] (Microsoft Corporation)
U3 idsvc; no ImagePath
U5 REALPLAYERUPDATESVC; no ImagePath
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
U3 wpcsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-21 14:43 - 2015-11-21 14:43 - 00016148 _____ C:\WINDOWS\system32\USER-PC_User_HistoryPrediction.bin
2015-11-21 08:46 - 2015-11-21 08:47 - 00000000 ____D C:\Users\User\AppData\Local\{BBA95FE8-D3D0-48AD-9B78-A15D30F1C944}
2015-11-20 08:16 - 2015-11-20 08:16 - 00000000 ____D C:\Users\User\AppData\Local\{9C309F03-C7FA-49D3-9A4B-3ECA814A8716}
2015-11-19 15:36 - 2015-11-21 14:48 - 00000000 ____D C:\FRST
2015-11-19 11:17 - 2015-11-19 11:19 - 00000000 ____D C:\Users\User\Desktop\Windows Backup 19
2015-11-19 10:37 - 2015-11-19 10:37 - 00001167 _____ C:\Users\Public\Desktop\DriveImage XML.lnk
2015-11-19 10:37 - 2015-11-19 10:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Runtime Software
2015-11-19 10:37 - 2015-11-19 10:37 - 00000000 ____D C:\Program Files\Runtime Software
2015-11-19 09:17 - 2015-11-19 09:17 - 00000000 ____D C:\Users\User\AppData\Local\{D50D667B-FA2C-49F1-86B1-137D14095E1D}
2015-11-18 15:06 - 2015-11-18 15:06 - 00000000 ____D C:\Users\User\AppData\Local\{48886572-62BC-4D44-916E-A6C5018DDDEE}
2015-11-16 18:19 - 2015-11-16 18:19 - 00000000 ____D C:\Users\User\AppData\Local\{BE95EDCC-1327-4E1E-8BF3-C28112D23C7E}
2015-11-15 18:13 - 2015-11-15 18:13 - 00000143 _____ C:\Users\User\Desktop\for addaware.txt
2015-11-15 16:13 - 2015-11-15 16:13 - 00000000 ____D C:\Users\User\AppData\Local\{59C4CD7F-8D39-4D05-97D1-3EA116A46A46}
2015-11-15 12:51 - 2015-11-15 12:54 - 00000316 _____ C:\WINDOWS\Tasks\Chrome Cleanup Tool logs upload retry.job
2015-11-14 15:07 - 2015-11-14 15:07 - 00000000 ____D C:\Users\User\AppData\Local\{3F7ECD50-F2B1-485C-81FF-8569F94DC693}
2015-11-14 14:33 - 2015-11-14 15:04 - 00001822 _____ C:\Users\User\Desktop\chrome.exe - Shortcut.lnk
2015-11-14 12:59 - 2015-11-15 12:47 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2015-11-14 12:54 - 2015-11-14 14:19 - 00000227 _____ C:\Users\User\Desktop\virus article.txt
2015-11-13 09:13 - 2015-11-13 09:13 - 00000000 ____D C:\Users\Public\Documents\SPEEDbit
2015-11-13 09:10 - 2015-11-13 09:10 - 00000000 ____D C:\ProgramData\SPEEDbit
2015-11-13 09:09 - 2015-11-13 09:10 - 00000000 ____D C:\AdwCleaner
2015-11-12 10:14 - 2015-11-12 10:14 - 00000000 ____D C:\Users\User\AppData\Roaming\Lavasoft
2015-11-12 09:30 - 2015-11-15 16:49 - 00002415 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-11-12 09:30 - 2015-11-12 09:30 - 00000000 ____D C:\Users\User\AppData\Roaming\LavasoftStatistics
2015-11-12 09:30 - 2015-11-12 09:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-11-12 09:28 - 2015-11-12 09:28 - 00000000 ____D C:\Program Files\Lavasoft
2015-11-12 09:24 - 2015-11-12 09:24 - 00000000 ____D C:\Program Files\Common Files\Lavasoft
2015-11-12 09:23 - 2015-11-12 09:23 - 00000000 ____D C:\ProgramData\Lavasoft
2015-11-11 07:29 - 2015-11-05 04:34 - 06265696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-11-11 07:29 - 2015-11-05 04:34 - 00558944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2015-11-11 07:29 - 2015-11-05 04:34 - 00337752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2015-11-11 07:29 - 2015-11-05 04:32 - 00479072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2015-11-11 07:29 - 2015-11-05 04:30 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-11-11 07:29 - 2015-11-05 04:24 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-11-11 07:29 - 2015-11-05 04:23 - 00762888 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2015-11-11 07:29 - 2015-11-05 04:18 - 00539728 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2015-11-11 07:29 - 2015-11-05 04:14 - 00923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-11-11 07:29 - 2015-11-05 04:14 - 00024256 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-11-11 07:29 - 2015-11-05 04:13 - 00095072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2015-11-11 07:29 - 2015-11-05 03:49 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2015-11-11 07:29 - 2015-11-05 03:47 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-11-11 07:29 - 2015-11-05 03:42 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-11-11 07:29 - 2015-11-05 03:40 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-11-11 07:29 - 2015-11-05 03:40 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\system32\internetmail.dll
2015-11-11 07:29 - 2015-11-05 03:39 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2015-11-11 07:29 - 2015-11-05 03:35 - 18803712 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-11-11 07:29 - 2015-11-05 03:35 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2015-11-11 07:29 - 2015-11-05 03:35 - 00821760 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-11-11 07:29 - 2015-11-05 03:34 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2015-11-11 07:29 - 2015-11-05 03:33 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-11-11 07:29 - 2015-11-05 03:33 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-11-11 07:29 - 2015-11-05 03:32 - 00738304 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2015-11-11 07:29 - 2015-11-05 03:30 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-11-11 07:29 - 2015-11-05 03:30 - 00767488 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-11-11 07:29 - 2015-11-05 03:30 - 00546816 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2015-11-11 07:29 - 2015-11-05 03:29 - 00491008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-11-11 07:29 - 2015-11-05 03:28 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-11-11 07:29 - 2015-11-05 03:27 - 02985472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-11-11 07:29 - 2015-11-05 03:27 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2015-11-11 07:29 - 2015-11-05 03:27 - 01135104 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-11-11 07:29 - 2015-11-05 03:27 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-11-11 07:29 - 2015-11-05 03:24 - 01499136 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2015-11-11 07:29 - 2015-11-05 03:24 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2015-11-11 07:29 - 2015-11-05 03:23 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll
2015-11-11 07:14 - 2015-11-11 07:14 - 00000000 ____D C:\Users\User\AppData\Local\{D73807CE-B79F-4FC7-8D2C-2422DF9AC541}
2015-11-09 17:26 - 2015-11-09 17:26 - 00000000 ____D C:\Users\User\AppData\Local\{FD6BA3DC-E1E1-4EDF-9276-4E7FDF48E43E}
2015-11-09 07:28 - 2015-11-09 14:42 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-11-08 22:03 - 2015-11-08 22:04 - 00000000 ____D C:\Users\User\AppData\Local\{A37EB7CC-500B-46B5-9170-B392B31D5FAF}
2015-11-08 20:34 - 2015-11-08 20:34 - 00000000 ____D C:\Users\User\AppData\Local\{41F655D3-0F1B-4562-8A73-B2A29C64A93F}
2015-11-01 20:16 - 2015-11-01 20:16 - 00000000 ____D C:\Users\User\AppData\Roaming\How Inc
2015-11-01 20:14 - 2015-11-01 20:15 - 13923063 _____ (HOW Inc. ) C:\Users\User\Downloads\FYTDSetup.exe
2015-10-31 09:01 - 2015-10-31 09:01 - 00000000 ____D C:\Users\User\AppData\Local\{28628110-59AC-44D4-BB84-62C61A91EFE4}
2015-10-30 07:31 - 2015-11-20 11:13 - 00000000 ___HD C:\$WINDOWS.~BT
2015-10-30 07:07 - 2015-10-30 07:07 - 00000000 ____D C:\Users\User\AppData\Local\{019A976A-112C-4683-9DAA-9FA73F1B1AA3}
2015-10-29 07:13 - 2015-10-29 07:13 - 00000000 ____D C:\Users\User\AppData\Local\{5C99D60B-DC6D-476E-9ADC-31251EDCD4E9}
2015-10-27 07:56 - 2015-10-27 07:56 - 00000000 ____D C:\Users\User\AppData\Local\{5573CB98-9046-46EE-AD81-D6D83C6D9D38}
2015-10-26 16:02 - 2015-10-26 16:02 - 00000000 ____D C:\Users\User\AppData\Local\{EC60091F-52E1-4FA7-B68A-05E185B0FAF4}
2015-10-25 12:28 - 2015-10-25 12:28 - 00000000 ____D C:\Users\User\AppData\Local\{490C2646-A51D-4023-82F5-D271FD783A98}
2015-10-23 07:56 - 2015-10-23 07:56 - 00000000 ____D C:\Users\User\AppData\Local\{699C254B-D446-44B2-B82B-DA3F9D6FE8AB}
2015-10-22 07:27 - 2015-10-22 07:27 - 00001609 _____ C:\Users\User\Desktop\Microsoft Edge.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-21 14:43 - 2015-07-10 08:28 - 00000000 ____D C:\WINDOWS\system32\sru
2015-11-21 14:43 - 2013-08-01 10:04 - 00000095 _____ C:\Users\User\.accessibility.properties
2015-11-21 14:43 - 2013-01-07 16:23 - 00000906 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-21 12:25 - 2013-10-22 08:52 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-11-21 09:04 - 2015-08-12 07:10 - 00000920 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3204613035-2029300637-3654983870-1000UA.job
2015-11-21 08:44 - 2013-07-31 07:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-11-21 08:41 - 2013-01-07 16:23 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-21 08:37 - 2015-09-12 05:31 - 00000392 _____ C:\WINDOWS\Tasks\PrintProjects Communicator.job
2015-11-21 07:57 - 2010-12-10 21:40 - 00000000 ____D C:\ProgramData\Kodak
2015-11-20 17:16 - 2010-11-01 17:08 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2015-11-20 14:16 - 2015-07-10 08:28 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-11-20 11:16 - 2015-08-11 15:09 - 00000000 ___DC C:\WINDOWS\Panther
2015-11-20 10:24 - 2015-07-10 08:28 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2015-11-20 09:18 - 2011-07-17 07:37 - 00001242 _____ C:\Users\User\Desktop\My Pictures.lnk
2015-11-20 08:11 - 2015-07-10 08:28 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-11-16 12:27 - 2013-08-01 15:02 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-11-16 12:24 - 2010-11-06 08:30 - 143250520 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-11-15 16:51 - 2015-08-11 06:15 - 00984150 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-11-15 16:47 - 2015-08-11 06:13 - 00000000 ____D C:\ProgramData\NVIDIA
2015-11-15 16:47 - 2015-07-10 09:55 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-11-15 16:47 - 2015-07-10 06:59 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-11-15 06:49 - 2015-07-10 08:28 - 00000000 ____D C:\WINDOWS\rescache
2015-11-14 18:20 - 2015-09-22 16:24 - 00001082 _____ C:\Users\User\Desktop\Mozilla Firefox.lnk
2015-11-14 14:20 - 2015-08-11 06:10 - 00045906 _____ C:\WINDOWS\PFRO.log
2015-11-14 14:20 - 2010-12-13 20:17 - 00000000 ____D C:\Program Files\Google
2015-11-14 13:17 - 2010-12-13 20:16 - 00000000 ____D C:\Users\User\AppData\Local\Google
2015-11-13 09:11 - 2013-12-17 18:36 - 00001123 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-11-12 16:08 - 2011-07-29 11:35 - 00000449 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Google.website
2015-11-12 10:38 - 2015-07-10 08:28 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-11-12 10:08 - 2012-11-14 08:58 - 00000000 ____D C:\Program Files\ImageZoom.org
2015-11-11 08:39 - 2015-07-10 08:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-11-11 07:25 - 2015-04-15 08:26 - 05286088 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerInstaller.exe
2015-11-09 14:42 - 2014-05-20 17:23 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-11-08 22:04 - 2015-08-12 07:10 - 00000868 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3204613035-2029300637-3654983870-1000Core.job
2015-11-03 18:20 - 2015-07-10 08:29 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-11-03 18:20 - 2015-07-10 08:29 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-10-31 15:55 - 2015-09-12 12:34 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-29 07:13 - 2012-01-11 17:54 - 00001308 _____ C:\Users\User\Desktop\Windows Live Photo Gallery.lnk
2015-10-27 09:18 - 2015-08-11 06:42 - 00002384 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-10-27 09:18 - 2015-08-11 06:42 - 00000000 ___RD C:\Users\User\OneDrive

==================== Files in the root of some directories =======

2013-06-24 06:54 - 2013-06-24 07:01 - 0000169 _____ () C:\Users\User\AppData\Roaming\settings.xml
2014-02-11 17:26 - 2015-04-02 07:10 - 0006144 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-12-10 22:45 - 2012-10-27 15:47 - 0000230 _____ () C:\Users\User\AppData\Local\LaunchHomeCenter.log
2015-09-05 07:51 - 2015-09-05 07:52 - 0007605 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
2011-04-29 20:09 - 2011-04-29 20:10 - 0000000 _____ () C:\Users\User\AppData\Local\{52C83286-5375-4FB7-9C35-980B5CFE01ED}
2011-12-07 10:32 - 2011-12-07 10:32 - 0000000 _____ () C:\Users\User\AppData\Local\{BF7EA537-5AA1-411E-9B34-9FDF19F12AC6}
2011-12-03 16:42 - 2011-12-03 16:42 - 0000000 _____ () C:\Users\User\AppData\Local\{E8CFED8F-6734-4B34-8EFF-D2DCE9A6A3EC}
2010-11-06 09:27 - 2010-11-06 09:27 - 0000048 ____H () C:\ProgramData\ezsidmv.dat
2013-07-30 04:54 - 2013-07-30 04:28 - 5402320 _____ (PC Cleaners) C:\ProgramData\pclunst.exe
2014-01-11 09:41 - 2014-01-11 09:42 - 9006072 _____ (McAfee, Inc.) C:\ProgramData\TempMOBK-update-4ec82966293498cc5bd9350557ef54e8.exe
2011-12-09 17:20 - 2011-12-09 17:25 - 9734240 _____ (McAfee, Inc.) C:\ProgramData\TempMOBK-update-6f587c3c1a49f2fdf5254a3e5ed05791.exe

Files to move or delete:
====================
C:\ProgramData\pclunst.exe
C:\ProgramData\TempMOBK-update-4ec82966293498cc5bd9350557ef54e8.exe
C:\ProgramData\TempMOBK-update-6f587c3c1a49f2fdf5254a3e5ed05791.exe


Some files in TEMP:
====================
C:\Users\User\AppData\Local\Temp\jre-8u60-windows-au.exe
C:\Users\User\AppData\Local\Temp\jre-8u65-windows-au.exe
C:\Users\User\AppData\Local\Temp\lowproc.exe
C:\Users\User\AppData\Local\Temp\rnupdate0.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll
C:\Users\User\AppData\Local\Temp\stubhelper.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-11-20 08:21

==================== End of FRST.txt ============================

 

Hi Jprocks

 

My name is polskamachina and I would like to welcome you to the Malware Removal Forum. I will be helping you with your malware issues.

What follows below are some ground rules for this forum.

I will reply as soon as possible (typically within 24-48 hours). In turn, I ask that you please respond within 72 hours. If you know you will be away longer than that, please let me know. I am in California at GMT-8 hours (Pacific Standard Time). If I do not respond to you within 48 hours, feel free to send me a private message.

Some points for you to keep in mind:

• Do NOT run any tools unless instructed to do so.
• We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Do not attach logs or use code boxes, just copy and paste the text.
• I cannot see your computer. Periodically update me on the condition of your computer, and provide as much detail as you can in every post.
• Once things seem to be working again, please do not abandon the thread. I will give an "all-clean" message at the very end.
• NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planned. You can put them on a CD/DVD, external drive or a flash drive, anywhere except on the computer.
• NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. Please remember to copy the entire post so you do not miss any instructions.

Please give me some time to review your situation and I will get back to you with further instructions. Thank you for your patience.

 

polskamachina

Hi  Polskamachina,

 

Thanks for getting back. Noted your local time. To put you in the picture this is not for my PC but for my father in law. He is elderly and lives some five miles away from me. This mean I will receive the message here and then ASAP get to my father in laws house and perform the actions required. I have advised him not to run any tools as from now. He does not have unlimited broadband and runs his broadband off a satellite provider. He should not run out of broadband but thought I should let you know, also I should be able to respond within the 72 hour timeframe and shall let you know if not. Thanks for your help and looking forward to removal. Jason

Hi Jason

 

Thank your for explaining the challenges you face with the repairs of your father-in-law's computer. If you cannot keep up with the 72 hour time frame, just drop me a line and we'll adjust accordingly.

 

I will return soon with the first set of instructions.

 

polskamachina

No worries shall do just that Polskamachina and drop you a line in case the time frame looks a bit shaky In the meantime I shall leave you and wish you a...

 

Good morning and have a good day 

Hi Jason
 
Regarding your father-in-law's situation of limited bandwidth, it will probably be easier for your to download the tools onto a flash drive from your own computer. Then, take the flash drive to your father-in-law's home and copy them to his computer. Or, I see you have Teamviewer installed. You could perform the steps remotely to save the 5 mile trip.
 
Let's start the fixing:
 
Please download AdwCleaner by Xplode and save to your Desktop.

• Right-click and select Run As Administrator
• The tool will start to update the database, please wait a bit.
• Click on I agree button.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Logfile button...a logfile (AdwCleaner[S#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Next:
 
Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Next:
Please download Malwarebytes Anti-Malware and save it to your desktop.

• Double-click on the setup file (mbam-setup.exe), then click on Run to install.
• Malwarebytes will automatically open to its Dashboard. If you have never run this version, you should see a red note at the top indicating "A scan has never been run on your system"
  
  
  .
• Click on Update Now to download the current database definitions, then click the Scan Now >> button.
  .
• If you have run this version before, you should see a green note at the top indicating "Your system is fully protected".
• You will be prompted to update Malwarebytes...click on the Update Now button.
  
  
  .
• The THREAT SCAN will automatically begin.
  
  
  .
• When the scan has completed, the results will be displayed. Click on Quarantine All, then click on Apply Actions.
  
  
  .
• To complete any actions taken you will be prompted to restart your computer...click on Yes. Failure to reboot normally will prevent Malwarebytes from removing all the malware.
  
  
  .
• After rebooting the computer, copy and paste the mbam.log in your next reply.
• .
  To retrieve the Malwarebytes Anti-Malware 2.0 scan log information (Method 1)
  • Open Malwarebytes Anti-Malware.
  • Click the History Tab at the top and select Application Logs.
  • Select (check) the box next to Scan Log. Choose the most current scan.
  • Click the View button.
  • Click Copy to Clipboard at the bottom...come back to this thread, click Add Reply, then right-click and choose Paste.
  • Alternatively, you can click Export and save the log as a .txt file on your Desktop or another location.
  • Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  To retrieve the Malwarebytes Anti-Malware 2.0 scan log information (Method 2)
  • Open Malwarebytes Anti-Malware.
  • Click the Scan Tab at the top.
  • Click the View detailed log link on the right.
  • Click Copy to Clipboard at the bottom...come back to this thread, click Add Reply, then right-click and choose Paste.
  • Alternatively, you can click Export and save the log as a .txt file on your Desktop or another location.
  • Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  Logs are named by the date of scan in the following format: mbam-log-yyyy-mm-dd and automatically saved to the following location:
   C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-yyyy-mm-dd
  
  In summary, I will need from you the following logs copied and pasted into your next reply to me:
  • AdwCleaner
  • JRT
  • Malwarebytes Anti-Malware
  Let me know if you have any questions.
   
  polskamachina

Hi Polskamachina,

 

Just to keep you in the loop I shall endeavour to get to my father in law's house today. 

 

Thanks Jason

Hi Polskamachina, 

 

Below are the results of the scans. I am not sure but kind of thinking the first one (AdwCleaner) looks a bit empty??? I am sure you will let me know. Also I noticed in the second one (JRT) this statement relating to the Mozilla Firefox Extension NoSquint:-

 

Deleted the following from C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\77fbvnrt.default-1447016909904\prefs.js

# AdwCleaner v5.022 - Logfile created 26/11/2015 at 14:37:41

Hi Jason
 
Right-click AdwCleaner and select Run As Administrator

• The tool will start to update the database, please wait a bit.
• Click on the Scan button.
• AdwCleaner will begin to scan your computer like it did before.
• After the scan has finished, this time click on the Cleaning button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[C#].txt) will open automatically (where the largest value of # represents the most recent report).
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

Next:
 
We need to run a fix with FRST:

• Please download the attached fixlist.txt file and save it to the same location as FRST (your Desktop\Downloads\ folder)
  Note: It's important that both files, FRST.exe and fixlist.txt are in the same location or the fix will not work.
• Run FRST.exe and press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally, then let the tool complete its run.
• When finished, FRST will generate a log, Fixlog.txt in the same location from which the tool was run. Please copy and paste it into your next reply to me.

Next:

If at all possible could we keep Nosquint (If indeed it has been deleted) as my mother in law suffers from Macular and NoSquint helps no end.

Yes, you may keep NoSquint. The link to install it is here.

• In summary I will need from you:
• AdwCleaner log
• fixlog.txt
• Verification that you were able to reinstall NoSquint
• How is the computer performing now?

Let me know if you have any questions.
 
polskamachina

Attached Files

•  fixlist.txt   2.03KB   4 downloads

Hi Polskamachina,

 

This is the error message I receive when I try to download the attached fixlist.txt

 

Sorry, you don't have permission for that!

 

With the following page.

 

http://www.bleepingcomputer.com/forums/index.php?app=core&module=attach&section=attach&attach_id=173461

 

Thanks Jason

Hi Jason

 

Sorry about the unreachable link. Let's try this workaround:

 

Copy and paste the text below into Notepad. Make sure you get everything in that box copied and that the longer lines do not get chopped up into two shorter lines when viewing in Notepad.

CHR RestoreOnStartup: Default -> "hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRghCeFwJUlpBFRgWIVoMTA1AR1QOeQgKVxQVQAwQJAoJB11BFA0FIk0FA1oDB0VXfV5bFElXTwhxJUpNDU0CaUBB"
CHR Extension: (Slick Savings) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk [2015-10-15] [UpdateUrl: hxxp://www.mybrowserbar.com/update/wt/gc/coupons/update.xml] <==== ATTENTION
CHR Extension: (Amazon Shopping Assistant by Spigot) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pfndaklgolladniicklehhancnlgocpp [2015-10-15] [UpdateUrl: hxxp://update.mybrowserbar.com/update/wt/gc/shoppingassistantamazon/update.xml] <==== ATTENTION
Task: {1EB1C95A-E6FD-4DE0-9022-860670E80061} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {2CB6A9F9-3363-4F28-8AEB-243C68354272} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {3E747AFC-4CDD-42A2-8A48-E6689E5FC473} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {4A1C016D-4AF0-4120-8861-D20FDA5B6D95} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {526820A7-F1BA-4C72-A9D4-F494F769B9BF} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {7E5A2D24-87F2-4219-A8B9-73FA6669E23E} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {8E81EF27-4E01-4CB2-9168-3F6C600C0FC4} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {A2C1735F-FD6E-4775-8B08-C9A010A2ECC2} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {A7F19648-B61F-45CF-83E4-A88AD37DE230} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {B880DFDC-437F-4B5C-88B6-7E4158CA1BA1} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {BA3DA305-27E0-498D-9822-5A39515D279C} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION

• Save the file as fixlist.txt it to the same location as FRST (your Desktop\Downloads\ folder)
  Note: It's important that both files, FRST.exe and fixlist.txt are in the same location or the fix will not work.
• Run FRST.exe and press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally, then let the tool complete its run.
• When finished, FRST will generate a log, Fixlog.txt in the same location from which the tool was run. Please copy and paste it into your next reply to me.

Let me know if you have any questions.

 

polskamachina

Hi Polskamachina,

 

Hope your weekend going good?

 

Here is the log from the scan.

 

fixlist content:
*****************
CHR RestoreOnStartup: Default ->
"hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRghCeFwJUlpBFRgWIVoMTA1AR1QOeQgKVxQVQAwQJAoJB11BFA0FIk0FA1oDB0VXfV5bFElXTwhxJUpNDU0CaUBB"
CHR Extension: (Slick Savings) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk [2015-10-15] [UpdateUrl: hxxp://www.mybrowserbar.com/update/wt/gc/coupons/update.xml] <==== ATTENTION
CHR Extension: (Amazon Shopping Assistant by Spigot) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pfndaklgolladniicklehhancnlgocpp [2015-10-15] [UpdateUrl: hxxp://update.mybrowserbar.com/update/wt/gc/shoppingassistantamazon/update.xml] <==== ATTENTION
Task: {1EB1C95A-E6FD-4DE0-9022-860670E80061} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {2CB6A9F9-3363-4F28-8AEB-243C68354272} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {3E747AFC-4CDD-42A2-8A48-E6689E5FC473} -
\Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {4A1C016D-4AF0-4120-8861-D20FDA5B6D95} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {526820A7-F1BA-4C72-A9D4-F494F769B9BF} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {7E5A2D24-87F2-4219-A8B9-73FA6669E23E} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {8E81EF27-4E01-4CB2-9168-3F6C600C0FC4} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {A2C1735F-FD6E-4775-8B08-C9A010A2ECC2} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {A7F19648-B61F-45CF-83E4-A88AD37DE230} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {B880DFDC-437F-4B5C-88B6-7E4158CA1BA1} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <====
ATTENTION
Task: {BA3DA305-27E0-498D-9822-5A39515D279C} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
*****************

RestoreOnStartup => not found.
"hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRghCeFwJUlpBFRgWIVoMTA1AR1QOeQgKVxQVQAwQJAoJB11BFA0FIk0FA1oDB0VXfV5bFElXTwhxJUpNDU0CaUBB" => Error: No automatic fix found for this entry.
C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk <==== ATTENTION => not found.
C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pfndaklgolladniicklehhancnlgocpp <==== ATTENTION => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1EB1C95A-E6FD-4DE0-9022-860670E80061}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EB1C95A-E6FD-4DE0-9022-860670E80061}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2CB6A9F9-3363-4F28-8AEB-243C68354272}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2CB6A9F9-3363-4F28-8AEB-243C68354272}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\Task: {3E747AFC-4CDD-42A2-8A48-E6689E5FC473} - => key not found. 
\Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4A1C016D-4AF0-4120-8861-D20FDA5B6D95}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4A1C016D-4AF0-4120-8861-D20FDA5B6D95}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{526820A7-F1BA-4C72-A9D4-F494F769B9BF}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{526820A7-F1BA-4C72-A9D4-F494F769B9BF}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7E5A2D24-87F2-4219-A8B9-73FA6669E23E}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7E5A2D24-87F2-4219-A8B9-73FA6669E23E}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8E81EF27-4E01-4CB2-9168-3F6C600C0FC4}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8E81EF27-4E01-4CB2-9168-3F6C600C0FC4}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A2C1735F-FD6E-4775-8B08-C9A010A2ECC2}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A2C1735F-FD6E-4775-8B08-C9A010A2ECC2}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A7F19648-B61F-45CF-83E4-A88AD37DE230}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A7F19648-B61F-45CF-83E4-A88AD37DE230}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B880DFDC-437F-4B5C-88B6-7E4158CA1BA1}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B880DFDC-437F-4B5C-88B6-7E4158CA1BA1}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully.
ATTENTION => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BA3DA305-27E0-498D-9822-5A39515D279C}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA3DA305-27E0-498D-9822-5A39515D279C}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully.

==== End of Fixlog 14:21:39 ====

 

Current state of play with PC is....just the same sorry, as in Chrome on start up still reverts back to searchinterneat-aakamaihdnet/

 

Firefox is running OK from what I can see with NoSquint reinstalled.

 

Edge is running OK from what I can see.

 

Speak/type soon Jason

Hi Jason

 

My weekend is going well. Lots of family came to visit for the Thanksgiving holiday. Thanks for asking.

 

Getting back to your computer issues, I think there was a problem pasting that first long line into the fixlist.txt. It wrapped into the next line. Let me check with the gurus above me about that and also why you weren't able to download the original attachment I sent you.

 

In the meantime, can you please post the contents of your AdwCleaner log in your next reply to me?

A copy of all cleaning logs are named AdwCleaner[C#].txt) and are saved in the C:\AdwCleaner folder which was created when running the tool.

 

polskamachina

Edited by polskamachina, 28 November 2015 - 10:34 PM.

Oopse my error Happy Thanksgiving as well... Shall hopefully get the log to you later today

Edited by Jprocks, 29 November 2015 - 03:25 AM.

Hi Polskamachina,

 

Just to keep you in the loop I spoke to my father in law yesterday as he came to dinner, I asked him if he could get the log but when I mentioned going to the folder his face crumbled and said "Oh no I wont be able to do that...." I decided it was not the best idea. Also my wife is starting work today on a three day trial so It may not be till Thursday till I get this log to you. If by chance I can get it quicker I shall post it here. Could use TeamViewer however I think my father in law might freak at somebody taking control of his PC from afar.... Have a good day Polskamachina, from Jason