Please Help Me Guys. I am a computer novice so desperately in need of guidance..

I was scammed in the fake Microsoft phonecall scam and googled Acer support and allowed them remote access to my brand new then Acer Aspire ES1-512 . That was nearly a year ago. I've not had any Windows services active since,no windows 
defender,no pop up blocker,they changed allmy security settings and removed any chance of a sytem restore, they deleted all points, I can't boot from cd as they've got shadow copies, infact most of the Acer products, Abdocs they are using that amoungst many other apps,ports, fake anti-virus software if I am lucky enough to install, I have no admin rights I've actually completely wiped everything, reset it my laptop to factory settings over 10 times . Each time all files and folders reappear.I have noticed a few suspicious looking files and folders WINDOWS OLD and they've completely ruined and deleted all my security settings and disabled Windows Defender, pop up blocker, smart screen filter everything. I have 2 network adapters possibly even 3 and I have only just been able to finally log onto our home router settings page I have noticed a Linux devicese , which I researched and it seems the and a lot of suspicious events been happening and looks like people logging onto our home router and they've done something to allow them open port access. It looks like I've got numerous network adapters operating I do not know what's real and what isn't, we have a BT broadband Hub4 router and the other is their realtek family stepping stone I think or a Qualcomm adapter, I need some help to remove the fake softare they have on my laptop and like I say they are using a lot of the Acer products to trick me I cannot even access my cd/dvd drive as they have installed something that monitors everything. I am disgusted with this, I contacted you time and time again when this first happened for help. It was Acer support I googled after their fake support phonecall and the top Freephone num was theirs somehow. Then they are accessing my filles ,folders,photos,banking details, emails,personal information all under Acer products/guises They even installed a complete fake whole OneDrive. I need some help with identifying the methods and fake Microsoft and Acer things so I can get Microsoft Key Authentification and try to be able to do a safe boot from disc to access win def offline or any other anti-malware cds I have to remove them. I am not the best on pcs and a newbie really. I haven't had any way shape or form in the way of HELP from Acer or Microsoft who these people claimed to be from when I fell for the 'support phonecall informing me of your pc's been seriously compromised They have files on here where when I boot up my laptop they have access before me even though I enter the password, autorun files backdoor this backdoor that so many exe and executeable files and I have no permissions to do anthing, HELP ME PLEASE>>> I have managed to upgrade to Windows 10 on last facory reset and have downloaded FRST and ran that and have a log if it will help me posting that? Iwould be so grateful as this laptop was 6 days old when I fell for the scam and gave these people access via Logmeinrescue and my laptop has barely worked and been on a 'limited internet connection ever since, they have changed a lot of settings to allow them to access everything in offline mode also. PLEASE HELPPPP..

Hello Browny69, and welcome to BC!

My name is bloopie and I'll be helping you with your problems as best I can!

A few things to keep in mind while we are working together:

• Please tell me if you have your original Windows CD/DVD available.
• Please copy and paste all logs here unless otherwise instructed.
• If you are unsure about any of the steps I provide, just post what you can and I will guide you!
• Please do not run any other tools without my instruction to do so!
• Upon completing the steps below I will review your topic an do my best to resolve your issues.

====================

Okay by the way you've described the situation, you've already handed off the keys to your entire computer! I hope that's not the case in reality, but that's what it sounds like! We're going to have to delve a bit deeper to be sure though.

You've mentioned "backdoors" as well...the only way to be 100%, and totally sure your machine is safe when there have been open backdoors, is to reformat and reinstall Windows. Do you have an original Windows disc handy and your product key code you got with your laptop? That would be the fastest and safest method to be sure your system is clean! If you have this available, then please let me know!

==========

But if that is not a possibility, then we must firstly remove any visible malware from the system. You mention you have downloaded and ran FRST, then I would like you to copy and paste that log for review. I have already moved this topic to the Malware Removal Logs forum so that you can post the FRST.txt log. Also, please post the Addition.txt file that also gets created when the tool runs the first time.

Note: If you do not have the Addition.txt file, you will have to scan again, but be sure to check the Addition.txt checkbox on the FRST splash screen this time, before scanning.

bloopie

Hi Bloopie thank you . I am in the process of running the scan now. I will post results after it is done. Can I further mention that after I realised that I'd been scammed and made a huge mistake giving this Indian man complete control; over my Acer Aspire E 15 (ES 512) notebook/laptop twice for a period of well over 2 hours. I only twigged when he starts asking me for the bank details of a friend who I said was paying the bill on my behalf and by then the damage was already done. I noticed my and printers a fax machine and a printer, none of which was mine so I'd delete them only for them to reappear the next day or the next time I turned mt laptop on. Since upgrading to windows 10 after my last factory reset I noticed that they was back in and on my laptop yet again, only this time they seem to have installed not the fax and printer in my devices and printers but these devices have come from nowhere and I believe they are something to do with these hackers. A VGA webcam USB composite device Universal series Manufactur (standard USB controller) Location Port_#0004.Hub_#002 This device is disabled by me Code 22. Also a Bluetooth USB Module Manufactur Qualcomm Atheros Communications, location Port_#0001.Hub_#0003 says the device is USB\VID_04CA&PID_300B\7&20e6a1b6&0&1 says device install requested, device migrated bluetooth radio? Also Generic PnP Monitor Properties C\:WINDOWS\system32DRIVERS\monitorsys file version 10.0.10586.0fth2_release.151029-(700) Location On Intel® HD Graphics and a HDTV (Intel® DisplayAudio) Device description Audio endpoint Device SWD\MMDEVAPI\{0.0.00000000}.{fc669e87-IC45-4ae7-9fa2-ca99ec06625b} states device type audio input and output. I have been using an app on my Samsung Galaxy S5mini android phone wifi monitor and network tools and utilities are alerting me to unknown devices connecting to my wifi, the main one is this is udhcp-1-19-4-VD-Linux-3-1-1x-50-56... Mac : 50:56:bf:82:62:ae says it's Samsung Electronics but it isn't my phone and there's another Samsung which may be my lodgers but I am not certain as it has a massive long  name and numbers in the title of it. Also it says Wayne.home (192.168.1.67) MAC: ac:b5:7d:3c:78:4c Name Liteon Technology Corporationwhen I think this is referring to my laptop but I thought it would say Acer technology or something like that, and it is states it is an untrusted device. Please can you help me with any guidance on how to secure my BT Home Hub 4 as I noticed a lot of TCP events in the events log of my router also. Thanks I am posting that scan results now with this.

Hello again,

 

Thanks for the log and the information!   Okay, we've got some work to do on this machine, but don't worry...we'll get you cleaned up, and we'll harden the Operating System as well. 

 

It would be wise to NOT use the machine except for running tools that I ask you to. Best also is to keep the system unplugged from the internet (or turn off your wireless card unless you need the internet to download/run tools that I ask you to download for the cleaning process).

 

==========

 

I see several AV solutions running simultaneously (AVG, Avast, McAfee) ...this is actually not making you any safer so we'll have to remove two of those. Which antivirus program would you like to keep? I would suggest keeping Avast, but you may keep another if that's your preference. Just let me know, and I will add in instructions for removing the others.

 

====================

 

But before we can continue, I still don't see the "Addition.txt" file that I asked for! Please copy and paste that into your next reply for my review.

 

Also, you're running FRST with just about all the boxes checked...I don't need all of them checked, but it's okay for the time being. If you ran FRST will all boxes checked, then you should have Addition.txt and Shortcut.txt in your Downloads folder where you ran FRST. Please post the Addition.txt (and the Shortcut.txt if you have it already) in your next reply so we can see where we're at. Then I will craft the next set of instructions for you. Just keep in mind that the logs take time to analyze, so bear with me okay?

 

I try to respond at least once per day, but that doesn't always happen because I work full-time outside of Bleeping Computer...

 

====================

 

You seem pretty worried, and I completely understand that...but try not to be...I will stay with you until the end!

 

...And as long as you can follow my instructions properly, then we shouldn't have too much trouble cleaning up the system.

 

==========

 

...As well as what I asked for in this post, please also tell me how the system is running at this point (performance-wise). Is it running normally, fast, or slow?

 

Thanks again,

 

bloopie

Additional scan result of Farbar Recovery Scan Tool (x64) Version:07-02-2016
Ran by Wayne (2016-02-10 18:59:31)
Running from C:\Users\Wayne\Downloads
Windows 10 Home (X64) (2016-01-26 06:29:26)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-92368520-1442784187-673530786-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-92368520-1442784187-673530786-503 - Limited - Disabled)
Guest (S-1-5-21-92368520-1442784187-673530786-501 - Limited - Disabled)
Wayne (S-1-5-21-92368520-1442784187-673530786-1001 - Administrator - Enabled) => C:\Users\Wayne

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: AVG AntiVirus Free Edition (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 15.14 (x64) (HKLM\...\7-Zip) (Version: 15.14 - Igor Pavlov)
abDocs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.09.2001 - Acer Incorporated)
abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.00.3002 - Acer Incorporated)
abMedia (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.09.2003.0 - Acer Incorporated)
Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Acer Incorporated)
Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8109 - Acer Incorporated)
Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.09.2002 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8105 - Acer Incorporated)
Acer Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.01.3016.0 - Acer Incorporated)
Acer Quick Access (HKLM\...\{E3678E72-78E3-4F91-A9FB-913876FF6DA2}) (Version: 2.00.3005 - Acer Incorporated)
Acer User Experience Improvement Program App Monitor Plugin (HKLM\...\{978724F6-1863-4DD5-9E66-FB77F5AB5613}) (Version: 1.02.3005 - Acer Incorporated)
Acer User Experience Improvement Program Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 1.02.3005 - Acer Incorporated)
Acer Video Player (HKLM-x32\...\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2005.0 - Acer Incorporated)
AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.15.2000.1 - Acer Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{7FA9ECCF-A2DE-4DA1-BFF3-81260DBDA68F}) (Version: 4.1.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{691F30EB-9009-475A-B8A9-E1BF39598FD5}) (Version: 4.1.2 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 11.1.2253 - AVAST Software)
AVG (HKLM\...\AvgZen) (Version: 1.31.1.48846 - AVG Technologies)
AVG (Version: 16.31.7357 - AVG Technologies) Hidden
AVG 2016 (Version: 16.0.4522 - AVG Technologies) Hidden
AVG Protection (HKLM\...\AVG) (Version: 2016.31.7357 - AVG Technologies)
AVG Zen (Version: 1.31.9 - AVG Technologies) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
BT Desktop Help (HKLM-x32\...\BT Desktop Help) (Version: - )
BT Toolbar (HKLM-x32\...\bttb) (Version: 1.0.0.43 - )
Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3019 - Acer Incorporated)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.6.5931 - CDBurnerXP)
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4917 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.4220 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.4609.02 - CyberLink Corp.)
FMW 1 (Version: 1.52.1 - AVG Technologies) Hidden
Foxit PhantomPDF (HKLM-x32\...\{D4DF5498-C95C-4A02-9951-725FB2D7BC0D}) (Version: 6.0.121.624 - Foxit Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 48.0.2564.103 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
Host App Service (HKU\S-1-5-21-92368520-1442784187-673530786-1001\...\SweetLabs_AP) (Version: 0.269.7.840 - Pokki)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Intel® Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
iTunes (HKLM\...\{FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E}) (Version: 12.3.2.35 - Apple Inc.)
Malwarebytes Anti-Exploit version 1.8.1.1189 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.8.1.1189 - Malwarebytes)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
McAfee LiveSafe Internet Security (HKLM-x32\...\MSC) (Version: 14.0.6136 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{d491dd9d-2eda-4d75-b504-1a201436e7fd}) (Version: 11.0.61030.0 - Microsoft Corporation)
NTREGOPT 1.1j (HKLM-x32\...\NTREGOPT_is1) (Version: - Lars Hederer)
Panda USB Vaccine 1.0.1.16 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version: - Panda Security)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Pokki Start Menu (HKU\S-1-5-21-92368520-1442784187-673530786-1001\...\SweetLabs_Start_Menu) (Version: 0.269.7.840 - Pokki)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.322 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.33 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.39059 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7288 - Realtek Semiconductor Corp.)
Security Task Manager 2.1e (HKLM-x32\...\Security Task Manager) (Version: 2.1e - Neuber Software)
Spotify (HKLM-x32\...\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB)
Tweaking.com - Windows Repair (HKLM-x32\...\Tweaking.com - Windows Repair) (Version: 3.8.1 - Tweaking.com)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WinPatrol (HKLM-x32\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 33.1.2015.0 - Ruiware)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-92368520-1442784187-673530786-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Wayne\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-92368520-1442784187-673530786-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0C74ADD0-DC61-4429-B58C-9E7685A2BE20} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {0FB757AE-1128-4E56-84C7-8BB7A044CBC3} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [2015-11-25] ()
Task: {206C25F9-DB73-4871-B534-176CEBF950D6} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2015-07-09] (Acer Incorporated)
Task: {282FEF79-A2F2-4FF9-99CA-F6DFD281BB62} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-08] (AVAST Software)
Task: {28339B1A-9F14-4697-ADEE-93645FBACEB2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {2B0497FE-96B3-4514-8D82-BC4E7923621A} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {2F2C6CC5-89DE-4E27-8CC8-FDBDE469611D} - System32\Tasks\SweetLabs App Platform => C:\Users\Wayne\AppData\Local\SweetLabs App Platform\Engine\ServiceHostAppUpdater.exe [2015-12-11] (Pokki)
Task: {31D15DCB-AF60-41DD-A781-689E78526147} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe [2015-11-03] (McAfee, Inc.)
Task: {36E37510-4E6D-450A-B28C-934D7651B02B} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2016-01-19] (Acer)
Task: {3C28888F-D9BD-41D4-A178-237A219EC4F9} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {4262439E-5284-4DBB-9FA5-085F245643D3} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {58FE6455-027F-49D1-9D26-FE8F60B5A09C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {5C35C9DF-95F4-4551-B8B0-BFAE569C326A} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2014-06-12] (Acer Incorporated)
Task: {5ECE2C10-24BD-4E93-A1DF-24ACD4BC1C49} - System32\Tasks\Quick Access Quick Launcher => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2015-07-09] (Acer Incorporated)
Task: {86BB18D0-8E2A-4B8A-94FB-650491D63458} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [2015-07-09] (Acer Incorporated)
Task: {86FA2463-0D0E-4D19-99F5-C6A4CBD6439B} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {912C7231-F29B-41BD-A46A-6E786135E82A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {9A6C33AC-86AF-4DC7-BE60-6420A5528500} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [2015-03-11] (Tweaking.com)
Task: {9B225D04-7D76-435D-8AA5-56B887B0C34C} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-12] (TODO: <Company name>)
Task: {9FDAB37D-A6ED-4382-B5AD-7F39B582E07E} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2014-09-10] (Acer Incorporate)
Task: {A13FB884-D0E5-43EA-8E03-251E1765EC0D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-27] (Google Inc.)
Task: {AE3D9228-670C-4BDA-84CB-CE0D957C74FC} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\mcafee\platform\McUICnt.exe [2015-11-02] (McAfee, Inc.)
Task: {BE56584A-D1F2-4D11-841C-824BC2D05995} - System32\Tasks\abDocsDllLoader => C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe [2015-11-23] ()
Task: {D0CD59C6-4855-4FCB-BAB5-F11C80A9DDC8} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2010-06-01] ()
Task: {D190BC50-3A79-4889-9243-354F1FDF914A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-27] (Google Inc.)
Task: {EAC09DE7-2A5E-44A2-8B23-972EF6D16B9A} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-02-07] (Microsoft Corporation)
Task: {F7EE8C42-6257-46A6-999B-5DD59D83206D} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [2016-01-14] (Acer Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\Public\Desktop\Booking.com.lnk -> C:\Program Files\Booking.COM\StartURL.exe () -> hxxp://www.booking.com/index.html?aid=379334
ShortcutWithArgument: C:\Users\Public\Desktop\Dropbox.lnk -> C:\Program Files\Dropbox\StartURL.exe () -> hxxps://www.dropbox.com/partners/acer2014/download

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 07:18 - 2015-10-30 07:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2014-07-25 09:34 - 2012-04-24 10:43 - 00254512 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2016-01-26 05:18 - 2016-01-26 05:18 - 02653816 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-01-26 05:18 - 2016-01-26 05:18 - 02653816 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-02-02 19:21 - 2016-02-02 19:22 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-01-26 05:18 - 2016-01-26 05:18 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-01-26 05:18 - 2016-01-26 05:18 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-01-26 05:18 - 2016-01-26 05:18 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-01-26 05:18 - 2016-01-26 05:18 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-01-26 05:18 - 2016-01-26 05:18 - 00936960 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-01-27 19:22 - 2016-01-16 05:10 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-01-27 19:22 - 2016-01-16 05:13 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-11-23 18:44 - 2015-11-23 18:44 - 01769312 _____ () C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe
2015-11-23 18:44 - 2015-11-23 18:44 - 00091488 _____ () C:\Program Files (x86)\Acer\abDocs\abDocsDllLoader.exe
2015-11-25 11:03 - 2015-11-25 11:03 - 04644256 _____ () C:\Program Files (x86)\Acer\Care Center\ACCStd.exe
2016-02-08 14:55 - 2016-02-08 14:55 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-02-08 14:55 - 2016-02-08 14:55 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-02-08 15:01 - 2016-02-08 15:01 - 02819072 _____ () C:\Program Files\AVAST Software\Avast\defs\16020802\algo.dll
2016-02-08 14:55 - 2016-02-08 14:55 - 00480760 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2013-11-07 17:58 - 2013-11-07 17:58 - 00244736 _____ () C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\node_modules\motive-activex-wrapper\build\Release\NodeActiveXWrapper.node
2013-11-07 17:58 - 2013-11-07 17:58 - 00271360 _____ () C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\node_modules\motive-osbridge\build\Release\MotiveOSBridgeNodeModule.node
2013-11-07 17:57 - 2013-11-07 17:57 - 00237056 _____ () C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\node_modules\motive-xmpps\build\Release\MotiveXMPPSNode.node
2013-04-24 07:55 - 2013-04-24 07:55 - 01581056 _____ () C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\node_modules\libxmljs\build\Release\xmljs.node
2013-04-18 16:55 - 2013-04-18 16:55 - 00068608 _____ () C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\node_modules\dnode\node_modules\weak\build\Release\weakref.node
2016-02-02 19:21 - 2016-02-02 19:22 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-02-02 19:21 - 2016-02-02 19:22 - 22330368 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2016-02-08 14:55 - 2016-02-08 14:55 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-12-03 15:21 - 2015-12-03 15:21 - 00202456 _____ () C:\Program Files (x86)\Acer\abMedia\curllib.dll
2015-12-03 15:23 - 2015-12-03 15:23 - 00654000 _____ () C:\Program Files (x86)\Acer\abMedia\sqlite3.dll
2015-12-03 15:23 - 2015-12-03 15:23 - 00641240 _____ () C:\Program Files (x86)\Acer\abMedia\tag.dll
2015-12-03 15:23 - 2015-12-03 15:23 - 00119000 _____ () C:\Program Files (x86)\Acer\abMedia\OpenLDAP.dll
2016-02-04 13:00 - 2016-02-04 13:00 - 00015064 _____ () C:\WINDOWS\assembly\GAC_MSIL\MyService\1.0.0.1__2dfa3f50f0bed57d\MyService.dll
2016-01-14 17:12 - 2016-01-14 17:12 - 00013016 _____ () C:\Program Files (x86)\Acer\AOP Framework\ServiceInterface.dll
2016-01-14 17:11 - 2016-01-14 17:11 - 00277856 _____ () C:\Program Files (x86)\Acer\AOP Framework\libcurl.dll
2015-11-23 18:44 - 2015-11-23 18:44 - 00277856 _____ () C:\Program Files (x86)\Acer\abDocs\libcurl.dll
2015-04-28 20:15 - 2015-04-28 20:15 - 00569856 _____ () C:\Users\Wayne\AppData\Local\SweetLabs App Platform\Engine\ppGoogleNaClPluginChrome.dll
2015-04-28 20:15 - 2015-04-28 20:15 - 01400846 _____ () C:\Users\Wayne\AppData\Local\SweetLabs App Platform\Engine\avcodec-54.dll
2015-04-28 20:15 - 2015-04-28 20:15 - 00151054 _____ () C:\Users\Wayne\AppData\Local\SweetLabs App Platform\Engine\avutil-51.dll
2015-04-28 20:15 - 2015-04-28 20:15 - 00222734 _____ () C:\Users\Wayne\AppData\Local\SweetLabs App Platform\Engine\avformat-54.dll
2016-02-04 02:35 - 2016-02-03 07:27 - 01632584 _____ () C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.103\libglesv2.dll
2016-02-04 02:35 - 2016-02-03 07:27 - 00087880 _____ () C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.103\libegl.dll
2016-02-04 02:35 - 2016-02-03 07:27 - 16799048 _____ () C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.103\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaioi2ce.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-92368520-1442784187-673530786-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\Web\Wallpaper\acer01.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
MpsSvc => Firewall Service is not running.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: mcbootdelaystartsvc => 2
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "btbb_McciTrayApp"
HKLM\...\StartupApproved\Run32: => "AvgUi"
HKLM\...\StartupApproved\Run32: => "AVG_UI"
HKU\S-1-5-21-92368520-1442784187-673530786-1001\...\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [TCP Query User{AE76A30A-6E90-4B3F-A89A-9B3EB7F878CA}C:\program files (x86)\acer\abmedia\dmcdaemon.exe] => (Block) C:\program files (x86)\acer\abmedia\dmcdaemon.exe
FirewallRules: [UDP Query User{456D2FDF-7F39-408F-8677-5AFAB968184F}C:\program files (x86)\acer\abmedia\dmcdaemon.exe] => (Block) C:\program files (x86)\acer\abmedia\dmcdaemon.exe

==================== Restore Points =========================

26-01-2016 09:27:09 Windows Update
28-01-2016 02:08:07 Installed Realtek Ethernet Controller Driver
01-02-2016 22:54:16 Removed abDocs Office AddIn
03-02-2016 03:15:00 dismomuntonwards
06-02-2016 18:34:36 Adblock Plus for IE
07-02-2016 19:50:02 Adblock Plus for IE
09-02-2016 17:53:55 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
Check "winmgmt" service or repair WMI.


==================== Faulty Device Manager Devices =============

Name: USB Composite Device
Description: USB Composite Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service: usbccgp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/10/2016 06:49:13 PM) (Source: PerfNet) (EventID: 2005) (User: )
Description:

Error: (02/10/2016 06:49:07 PM) (Source: MSDTC Client 2) (EventID: 4104) (User: )
Description: 0x8007085A

Error: (02/10/2016 06:40:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: McSvHost.exe, version: 5.0.6060.0, time stamp: 0x563809af
Faulting module name: mcmscshm.dll, version: 14.0.6136.0, time stamp: 0x56609d81
Exception code: 0xc0000005
Fault offset: 0x0000000000078a20
Faulting process ID: 0x630
Faulting application start time: 0xMcSvHost.exe0
Faulting application path: McSvHost.exe1
Faulting module path: McSvHost.exe2
Report ID: McSvHost.exe3
Faulting package full name: McSvHost.exe4
Faulting package-relative application ID: McSvHost.exe5

Error: (02/10/2016 06:35:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: McSvHost.exe, version: 5.0.6060.0, time stamp: 0x563809af
Faulting module name: mcmscshm.dll, version: 14.0.6136.0, time stamp: 0x56609d81
Exception code: 0xc0000005
Fault offset: 0x0000000000078a20
Faulting process ID: 0x26a0
Faulting application start time: 0xMcSvHost.exe0
Faulting application path: McSvHost.exe1
Faulting module path: McSvHost.exe2
Report ID: McSvHost.exe3
Faulting package full name: McSvHost.exe4
Faulting package-relative application ID: McSvHost.exe5

Error: (02/10/2016 06:30:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: McSvHost.exe, version: 5.0.6060.0, time stamp: 0x563809af
Faulting module name: mcmscshm.dll, version: 14.0.6136.0, time stamp: 0x56609d81
Exception code: 0xc0000005
Fault offset: 0x0000000000078a20
Faulting process ID: 0x132c
Faulting application start time: 0xMcSvHost.exe0
Faulting application path: McSvHost.exe1
Faulting module path: McSvHost.exe2
Report ID: McSvHost.exe3
Faulting package full name: McSvHost.exe4
Faulting package-relative application ID: McSvHost.exe5

Error: (02/10/2016 12:47:37 PM) (Source: PerfNet) (EventID: 2005) (User: )
Description:

Error: (02/10/2016 12:47:34 PM) (Source: MSDTC Client 2) (EventID: 4104) (User: )
Description: 0x8007085A

Error: (02/10/2016 12:03:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 11431547

Error: (02/10/2016 12:03:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 11431547

Error: (02/10/2016 12:03:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (02/10/2016 07:02:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 07:02:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 07:00:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 07:00:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 06:59:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 06:59:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 06:59:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 06:59:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 06:59:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079

Error: (02/10/2016 06:59:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The DNS Client service failed to start due to the following error:
%%1079


CodeIntegrity:
===================================
Date: 2016-02-10 18:54:37.173
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 18:54:37.043
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 12:03:54.825
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 12:03:54.780
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 08:50:51.012
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 08:50:50.965
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 01:51:52.692
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 01:51:52.567
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 00:52:07.723
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-10 00:52:07.527
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\AVG\Av\avgidsagent.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: Intel® Celeron® CPU N2840 @ 2.16GHz
Percentage of memory in use: 59%
Total physical RAM: 3977.98 MB
Available physical RAM: 1609 MB
Total Virtual: 7817.98 MB
Available Virtual: 4969.11 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:450.6 GB) (Free:378.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 5E02E400)

Partition: GPT.

==================== End of Addition.txt ============================

Edited by bloopie, 11 February 2016 - 06:07 PM.
removed extra copies of FRST.txt and pasted correct log

Hello again,

Okay, thanks for that!

Although bear in mind, you must be very mindful to read my instructions carefully!! I asked how the computer was running, and to copy and paste the Addition.txt log. Running my instructions incorrectly could lead to your system crashing when we get to the more sensitive tools...so please be careful!

 

Please copy and paste all logs (do not attach them) unless otherwise instructed.

Now, let's continue with the below steps:

Step

Please remove any AVG product that is currently installed on your machine using Programs and Features. Here is a quick way to get there:

Hold the "Windows" key and press "R" to open the runbox, and type in appwiz.cpl and press Enter. This should open Programs and Features (aka the Add/Remove Programs list).

If for any reason, you're unable to remove AVG products, then download and run the AVG Removal Tool found HERE (You will need the 64-bit version). If you need to use the Removal Tool, please be sure to reboot the computer after running it!
 
==========

Step

I see you have MalwareBytes Antimalware (aka MBAM) installed. Please update the program first, then run a Threat Scan (removing ANYTHING it finds), and post the resultant log in your next reply.
 
==========

Step

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• The tool will start to update the database, please wait a bit.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[C#].txt) will open automatically (where the largest value of # represents the most recent report).
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

==========

Step

Please download Junkware Removal Tool to your Desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

====================

In your next reply, please include the following:

• Let me know if you were successful removing the AVG products!
• Paste the MBAM log
• Paste the AdwCleaner cleaning log
• Paste the JRT log

And please let me know how the computer is running now!! Any problems with any steps?

 

bloopie

Hello again,
 

so should I run that JRT now and delete what AV's I don't want or need from my download folder. I will stick with what you say about keeping Avast yes? What else should I delete? Thanks

No, you don't delete from the download folder...those are just installer files and are harmless. You will be uninstalling AVG (not deleting it) from Programs and Features. ...I left all the instructions in order, in Post# 7 above.  You'll be uninstalling AVG, then running MBAM, then AdwCleaner, then JRT...all in that order.
 
I structured that post into steps so that you can follow each step one-by-one. Do you see that? (I just edited the post to make the text size a bit bigger so you can find them easier).
 
Please re-read post #7 above and begin with Step   there. If you don't understand Step 1, please let me know and I will explain it.
 
Otherwise, continue until you've followed all four steps in post #7, posted all the logs I requested, and answered the questions from that post.
 
==========
 
If you don't understand a step in that post, please let me know before you continue and I will explain it, okay?

 

 

bloopie

Hi Bloopie sorry for the late reply I have not been in the same house with the laptop until now. Right I have uninstalled by AVG anti-virus free edition and AVG Zen via the route you said using the windows key + R and typing what you told me to type. It restarted only on the first removal of the AVG free anti-virus and I am sitting in front of the laptop now. Do you still need any txt or the shortcut txt copying and pasting? The reason I attached them instead of copying and pasting the last couple it told me they were too long to post? I am running the MBAM tool now but it looks as if my free version has run out? It is actually doing a threat scan as we speak, I am unsure of what should've been ticked or not though previous to the start of the scan so I clicked on PUPS treat as malware? I gratefully await your next instructions. Please bare with me though, like I mentioned I really am a pc novice and only know the very basics. Thanks

Bloopie there was 2 things found during the threat scan you did say remove the threats and then save the scan results didn't you? I hope I have done it right because it looks as if it isn't showing the threats detected and deleted by me? PLease say I haven't gone wrong?