Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 10 issues infection


  • Please log in to reply
12 replies to this topic

#1 waltgokey

waltgokey

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:48 PM

Posted 19 June 2016 - 07:34 AM

Good morning 

 

Can someone please assist

 

I suspect i am infected. I am running Windows 10.

 

We have done a Refresh, but it does not seem to have fixed the issue. We have run SFC /Scannow and the same

 

When i click on opening an EXE file, it is asking me what Application i want to use to open this file

 

please see my ADW CLeaner logs

 

 

# AdwCleaner v5.200 - Logfile created 19/06/2016 at 05:29:47
# Updated 14/06/2016 by ToolsLib
# Database : 2016-06-19.1 [Server]
# Operating system : Windows 10 Enterprise  (X64)
# Username : walter gokey - DESKTOP-1NC43GN
# Running from : C:\Users\walter gokey\Downloads\AdwCleaner.exe
# Option : Scan
 
***** [ Services ] *****
 
Service Found : TheScreenSnapshotService
 
***** [ Folders ] *****
 
Folder Found : C:\ProgramData\TweakBit
Folder Found : C:\ProgramData\Application Data\TweakBit
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit
Folder Found : C:\Users\Public\Documents\Guid
Folder Found : C:\Program Files (x86)\ScreenSnapshotTool
Folder Found : C:\Program Files (x86)\TweakBit
Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\ScreenSnapshotTool
Folder Found : C:\Users\walter gokey\AppData\Roaming\ScreenSnapshotTool
Folder Found : C:\Program Files\ByteFence
Folder Found : C:\WINDOWS\SysNative\Tasks\TweakBit
Folder Found : C:\WINDOWS\SysNative\Tasks\TweakBit
 
***** [ Files ] *****
 
File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk
File Found : C:\Users\walter gokey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_easymaillogin.dl.myway.com_0.localstorage
File Found : C:\Users\walter gokey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_easymaillogin.dl.myway.com_0.localstorage-journal
File Found : C:\Users\walter gokey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_easymaillogin.dl.tb.ask.com_0.localstorage
File Found : C:\Users\walter gokey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_easymaillogin.dl.tb.ask.com_0.localstorage-journal
 
***** [ DLL ] *****
 
 
***** [ WMI ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
Key Found : HKCU\Software\darwendlm
Key Found : HKCU\Software\PRODUCTSETUP
Key Found : HKCU\Software\csastats
Key Found : HKLM\SOFTWARE\ByteFence
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence
Key Found : [x64] HKLM\SOFTWARE\ByteFence
Key Found : [x64] HKLM\SOFTWARE\ScreenSnapshotTool
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61FFE1F9-137D-4c31-A181-3415FCAA5946}
Key Found : HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\Software\darwendlm
Key Found : HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\Software\PRODUCTSETUP
Key Found : HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\Software\csastats
Data Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Data Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope] - {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Data Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope] - {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
***** [ Web browsers ] *****
 
[C:\Users\walter gokey\AppData\Local\Chromium\User Data\Default\Web data] [Search Provider] Found : yahoo! powered
[C:\Users\walter gokey\AppData\Local\Chromium\User Data\Default\Secure Preferences] [Startup_URLs] Found : hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D7%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise&uref=chmm
[C:\Users\walter gokey\AppData\Local\Chromium\User Data\Default\Secure Preferences] [Homepage] Found : hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise&uref=chmm
 
*************************
 
C:\AdwCleaner\AdwCleaner[S1].txt - [5328 bytes] - [19/06/2016 05:29:47]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5401 bytes] ##########
 


BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,260 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:48 PM

Posted 19 June 2016 - 08:57 AM

Perform a clean uninstall of Chromium...that means uninstalling everything including Bookmarks.

Be sure to put check mark in the box next to Also delete your browser data?

RemoveWindowsA.JPG

 

If you want to install Google Chrome...use this link: Chrome

 

Rerun AdwCleaner and be sure to choose Clean when the scan has finished. It is likely that a reboot will be required to complete the cleaning.

Post the new scan log.

 

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

 

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).

  • Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • When MBAM is finished scanning it will display a screen that displays any malware that it has detected.
  • Click the Remove Selected button.
  • MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.

POST THE LOG FOR  REVIEW.

 

  • download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE:Sometimes if ESET finds no infections it will not create a log.

Edited by buddy215, 19 June 2016 - 09:28 AM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 waltgokey

waltgokey
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:48 PM

Posted 20 June 2016 - 11:12 AM

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 10 Enterprise x64
Ran by walter gokey (Administrator) on Mon 06/20/2016 at 6:49:15.49
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 3

Successfully deleted: C:\ProgramData\tweakbit (Folder)
Successfully deleted: C:\users\Public\Documents\guid (Folder)
Successfully deleted: C:\Users\walter gokey\Start Menu\Programs\free window registry repair (Folder)



Registry: 4

Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\0211151466267385mcinstcleanup (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F4B8786-5502-4803-8EBC-F652A1153BB6} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F4B8786-5502-4803-8EBC-F652A1153BB6} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{4BAAC1B8-0800-42C9-8FA6-08B211F356B8} (Registry Value)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 06/20/2016 at 6:51:14.16
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ESET says, no virus found

#4 buddy215

buddy215

  • Moderator
  • 13,260 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:48 PM

Posted 20 June 2016 - 11:48 AM

What about the MBAM scan results and the AdwCleaner scan results?

Please post those.

 

After posting the above....do this:

 

Post the three lists mentioned below using CCleaner.

Open CCleaner and click on Tools. Choose Startups. On that page you will see a list of Windows Startups and at the top tabs for each browser and Scheduled Tasks.

At the bottom right of that page you will see a button when clicked will allow you to Copy and Paste the list of Windows Startups and Scheduled Tasks into your next

post. Please do that.

 

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#5 waltgokey

waltgokey
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:48 PM

Posted 20 June 2016 - 04:39 PM

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 6/20/2016
Scan Time: 6:32 AM
Logfile:
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.06.20.03
Rootkit Database: v2016.05.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: walter gokey

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 284772
Time Elapsed: 8 min, 38 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 3
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\FixMyPC.exe, 6228, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4]
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\ScreenShotServ.exe, 2044, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d]
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\ScreenSnapshot.exe, 3216, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d]

Modules: 21
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\GoogleAnalyticsHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\TaskSchedulerHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ATPopupsHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ATUpdatersHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\AxBrowsers.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\AxComponentsRTL.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\AxComponentsVCL.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\CommonForms.Site.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\DebugHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Localizer.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ProductHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\RegistryCleanerHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\RescueCenterHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\rtl160.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\SettingsHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\SystemInformationHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\vcl160.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\vclimg160.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPDR.dll, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPNet.dll, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPTask.dll, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],

Registry Keys: 31
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\CLSID\{93469602-4134-4012-A6BC-D46FF1C67100}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\TYPELIB\{F2C6F7D1-ED32-49E5-9919-00DB85710300}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\INTERFACE\{6855F0CE-00B1-483F-8633-33B650EE4300}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6855F0CE-00B1-483F-8633-33B650EE4300}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6855F0CE-00B1-483F-8633-33B650EE4300}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{F2C6F7D1-ED32-49E5-9919-00DB85710300}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{F2C6F7D1-ED32-49E5-9919-00DB85710300}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\TMAgentCOM.TMAgent, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TMAgentCOM.TMAgent, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TMAgentCOM.TMAgent, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\APPID\{93469602-4134-4012-A6BC-D46FF1C67100}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{93469602-4134-4012-A6BC-D46FF1C67100}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{93469602-4134-4012-A6BC-D46FF1C67100}, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.ScreenSnapShotTool, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{61FFE1F9-137D-4c31-A181-3415FCAA5946}, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TheScreenSnapshotService, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [5fd459a67227a393df9c26b49a69e51b],
PUP.Optional.TweakBit, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{28D725DF-C30C-4BD9-87D2-F4C0383ACAAB}, Delete-on-Reboot, [4fe48877d7c2cc6a135427ce669df808],
PUP.Optional.TweakBit, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{66351A31-27FF-4895-B535-ECC041FC8DED}, Delete-on-Reboot, [72c1b04f82177eb81354f6ffe41f8e72],
PUP.Optional.TweakBit, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\TWEAKBIT\FIXMYPC\Start FixMyPC оn logon, Delete-on-Reboot, [a093f10ea8f1e3535c0c985d907335cb],
PUP.Optional.TweakBit, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\TWEAKBIT\FIXMYPC\Time for deal, Delete-on-Reboot, [fc3752adf1a8cc6a0b5d7580b94a659b],
PUP.Optional.ScreenSnapShotTool, HKLM\SOFTWARE\SCREENSNAPSHOTTOOL, Quarantined, [45ee52ad3069e74f900515a5b05337c9],
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [949f12ed0099171f44379b3f7c877b85],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\TWEAKBIT\ATPopups, Quarantined, [4be857a8792016204af3596b62a039c7],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\TWEAKBIT\ATUpdaters, Quarantined, [75bede21a4f50d29fee94d64eb18b24e],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\TWEAKBIT\FixMyPC, Quarantined, [8fa4ae51fe9b6fc7f2f6e7caf40fa759],
PUP.Optional.TweakBit, HKLM\SOFTWARE\WOW6432NODE\TWEAKBIT\Google Analytics Package, Quarantined, [70c324db861330067376e8c9e41f9e62],
PUP.Optional.InstallCore, HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\SOFTWARE\csastats, Quarantined, [fc377e817d1ce155d04b8f64699a916f],
PUP.Optional.WinYahoo, HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BFREPORT, Quarantined, [4ee523dcfd9c5adca136ae46de25cf31],
PUP.Optional.ProductSetup, HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\SOFTWARE\PRODUCTSETUP, Quarantined, [65cedd22e5b448eefe1e2287dd2640c0],
PUP.Optional.WinYahoo, HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Chromium, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],

Registry Values: 8
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, https://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f[5fd459a67227a393df9c26b49a69e51b]D4%26b[5fd459a67227a393df9c26b49a69e51b]DIE%26cc[5fd459a67227a393df9c26b49a69e51b]Dus%26pa[5fd459a67227a393df9c26b49a69e51b]DWincy%26cd[5fd459a67227a393df9c26b49a69e51b]D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr[5fd459a67227a393df9c26b49a69e51b]D516290276%26a[5fd459a67227a393df9c26b49a69e51b]Dwbf_dwndlm_16_24%26os_ver[5fd459a67227a393df9c26b49a69e51b]D10.0%26os[5fd459a67227a393df9c26b49a69e51b]DWindowsQuarantinedB10QuarantinedBEnterprise&p={searchTerms}, %4, %5
PUP.Optional.TweakBit, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{28D725DF-C30C-4BD9-87D2-F4C0383ACAAB}|Path, \TweakBit\FixMyPC\Start FixMyPC оn logon, Delete-on-Reboot, [4fe48877d7c2cc6a135427ce669df808]
PUP.Optional.TweakBit, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{66351A31-27FF-4895-B535-ECC041FC8DED}|Path, \TweakBit\FixMyPC\Time for deal, Delete-on-Reboot, [72c1b04f82177eb81354f6ffe41f8e72]
PUP.Optional.ScreenSnapShotTool, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{61FFE1F9-137D-4c31-A181-3415FCAA5946}|DisplayIcon, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\ScreenSnapshot.exe, Quarantined, [171cc7385445d95d254e9324f013817f]
PUP.Optional.ScreenSnapShotTool, HKLM\SOFTWARE\SCREENSNAPSHOTTOOL|PartnerID, Installchannel2|us|IBD|Bundle, Quarantined, [45ee52ad3069e74f900515a5b05337c9]
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, https://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f[949f12ed0099171f44379b3f7c877b85]D4%26b[949f12ed0099171f44379b3f7c877b85]DIE%26cc[949f12ed0099171f44379b3f7c877b85]Dus%26pa[949f12ed0099171f44379b3f7c877b85]DWincy%26cd[949f12ed0099171f44379b3f7c877b85]D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr[949f12ed0099171f44379b3f7c877b85]D516290276%26a[949f12ed0099171f44379b3f7c877b85]Dwbf_dwndlm_16_24%26os_ver[949f12ed0099171f44379b3f7c877b85]D10.0%26os[949f12ed0099171f44379b3f7c877b85]DWindowsQuarantinedB10QuarantinedBEnterprise&p={searchTerms}, %4, %5
PUP.Optional.WinYahoo, HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BFREPORT|filename, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\uninstall.exe, Quarantined, [4ee523dcfd9c5adca136ae46de25cf31]
PUP.Optional.ProductSetup, HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\SOFTWARE\PRODUCTSETUP|tb, 0W1Q2Q1R1T1L1Y1M1P2W1Y1G, Quarantined, [65cedd22e5b448eefe1e2287dd2640c0]

Registry Data: 1
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=fBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]D1%26bBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]DIE%26ccBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]Dus%26paBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]DWincy%26cdBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26crBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]D516290276%26aBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]Dwbf_dwndlm_16_24%26os_verBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]D10.0%26osBad: (https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise),Replaced,[51e22ad52079ce6870847af58d7731cf]DWindowsGood: (www.google.com)B10Good: (www.google.com)BEnterprise, %4, %5

Folders: 20
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Data, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit\FixMyPC, Quarantined, [cf64639c10898bab3ea3d1e0cd365da3],
PUP.Optional.TweakBit, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit, Quarantined, [cf64639c10898bab3ea3d1e0cd365da3],
PUP.Optional.ScreenSnapShotTool, C:\Users\walter gokey\AppData\Roaming\ScreenSnapshotTool\dump, Quarantined, [4de62fd0eeabb680d7961f98dd268080],
PUP.Optional.ScreenSnapShotTool, C:\Users\walter gokey\AppData\Roaming\ScreenSnapshotTool, Quarantined, [4de62fd0eeabb680d7961f98dd268080],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPData, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.TweakBit, C:\ProgramData\TweakBit\FixMyPC, Quarantined, [250e6b94d6c360d6a26632862ed439c7],
PUP.Optional.TweakBit, C:\ProgramData\TweakBit\FixMyPC\1.x, Quarantined, [250e6b94d6c360d6a26632862ed439c7],
PUP.Optional.TweakBit, C:\ProgramData\TweakBit\FixMyPC\1.x\Data, Quarantined, [250e6b94d6c360d6a26632862ed439c7],
PUP.Optional.TweakBit, C:\ProgramData\TweakBit\FixMyPC\1.x\Logs, Quarantined, [250e6b94d6c360d6a26632862ed439c7],
PUP.Optional.ScreenSnapShotTool, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ScreenSnapshotTool, Quarantined, [be75ab5446536ec812bb7c40de249c64],
PUP.Optional.ScreenSnapShotTool, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ScreenSnapshotTool\dump, Quarantined, [be75ab5446536ec812bb7c40de249c64],
PUP.Optional.ScreenSnapshot, C:\Users\Public\Documents\Guid\Common\I18N\IPCSUpdateCache\ScreenSnapshot, Quarantined, [5ad9cc33e1b847ef83e900bf639fe31d],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],

Files: 116
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\unins000.msg, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\GoogleAnalyticsHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ServiceManagerHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\TaskSchedulerHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ATPopupsHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ATUpdatersHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\AxBrowsers.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\AxComponentsRTL.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\AxComponentsVCL.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\CommonForms.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\CommonForms.Routine.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\CommonForms.Site.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\DebugHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\DiskCleanerHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\DiskDefragHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\DiskWipeHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Downloader.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\EULA.rtf, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\FixMyPC.exe, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\FixMyPC.url, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\GASender.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\InternetOptimizerHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Localizer.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ProductHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\rdboot32.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\rdboot64.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\RegistryCleanerHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\RegistryDefrag.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\RegistryDefragHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ReportHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\RescueCenter.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\RescueCenterForm.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\RescueCenterHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\rtl160.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\SendDebugLog.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\SettingsHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\ShellExtension.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\SpywareCheckerHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\sqlite3.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\StartupManager.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\StartupManagerHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\SystemInformationHelper.dll, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\TaskManager.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\TaskManagerHelper.Agent.x64.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\TaskManagerHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\TweakManager.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\TweakManagerHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\unins000.dat, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\unins000.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\UninstallManager.exe, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\UninstallManagerHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\vcl160.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\vclie160.bpl, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\vclimg160.bpl, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\VolumesHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\WizardHelper.dll, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Data\main.ini, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang\deu.lng, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang\enu.lng, Delete-on-Reboot, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang\esp.lng, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang\fra.lng, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang\installer_deu.ini, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang\installer_enu.ini, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang\installer_esp.ini, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\Program Files (x86)\TweakBit\FixMyPC\Lang\installer_fra.ini, Quarantined, [34ff817ee4b58fa7da06862b7e854cb4],
PUP.Optional.TweakBit, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit\FixMyPC\TweakBit FixMyPC.lnk, Quarantined, [cf64639c10898bab3ea3d1e0cd365da3],
PUP.Optional.TweakBit, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit\FixMyPC\TweakBit FixMyPC on the Web.url, Quarantined, [cf64639c10898bab3ea3d1e0cd365da3],
PUP.Optional.ScreenSnapShotTool, C:\Users\walter gokey\AppData\Roaming\ScreenSnapshotTool\dump\BugReportConfig.ini, Quarantined, [4de62fd0eeabb680d7961f98dd268080],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\CrashReportModuleConf.ini, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\CrashReport.exe, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\CrashUL.exe, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPConfig.ini, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPDR.dll, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPHelp.dll, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPKernel.dll, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPNet.dll, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPTask.dll, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\InstallHelper.exe, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\Language.json, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\Report.exe, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\ScreenShotServ.exe, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\ScreenSnapshot.exe, Delete-on-Reboot, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.ScreenSnapShotTool, C:\Program Files (x86)\ScreenSnapshotTool\1.1.0.11130\EVPData\History.dat, Quarantined, [a39052add1c8c57185e97b3c11f2837d],
PUP.Optional.WinYahoo, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk, Quarantined, [1f145ea13d5c87af60bff6e318eb5ea2],
PUP.Optional.TweakBit, C:\Windows\System32\Tasks\TweakBit\FixMyPC\Start FixMyPC оn logon, Quarantined, [eb489b64217871c599ccb3427c8721df],
PUP.Optional.TweakBit, C:\Windows\System32\Tasks\TweakBit\FixMyPC\Time for deal, Quarantined, [ed466c931a7f76c0a3c2609558ab2ad6],
PUP.Optional.TweakBit, C:\ProgramData\TweakBit\FixMyPC\1.x\Data\dlc.dat, Quarantined, [250e6b94d6c360d6a26632862ed439c7],
PUP.Optional.TweakBit, C:\ProgramData\TweakBit\FixMyPC\1.x\Data\statistics.dat, Quarantined, [250e6b94d6c360d6a26632862ed439c7],
PUP.Optional.TweakBit, C:\ProgramData\TweakBit\FixMyPC\1.x\Logs\FixMyPC.log, Quarantined, [250e6b94d6c360d6a26632862ed439c7],
PUP.Optional.ScreenSnapShotTool, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ScreenSnapshotTool\dump\BugReportConfig.ini, Quarantined, [be75ab5446536ec812bb7c40de249c64],
PUP.Optional.ScreenSnapshot, C:\Users\Public\Documents\Guid\Common\I18N\IPCSUpdateCache\ScreenSnapshot\3216396857657152, Quarantined, [5ad9cc33e1b847ef83e900bf639fe31d],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\HowToRemove.html, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\chromium-min.jpg, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\control panel-min-min.JPG, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\down.png, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\ff menu.JPG, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\ff search engine-min.png, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\hp-min ff.png, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\hp-min ie.png, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\search engine.gif, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\setup pages.gif, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\sp-min.png, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\start-min.jpg, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\HowToRemove\up.png, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\bapi.dat, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\config.dat, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\cose, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\info.dat, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\install.log, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\nela, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\side, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\Sqlite3.dll, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\STTL.DAT, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\TTL.DAT, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\uninst.dat, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],
PUP.Optional.WinYahoo, C:\Users\walter gokey\AppData\Local\{E60AD056-C2A2-BCEE-AF3A-99068B52659E}\uninstall.exe, Quarantined, [bf7414eb1c7d82b46aa3078c996b6c94],

Physical Sectors: 0
(No malicious items detected)


(end)
CC Start up

Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
Yes HKCU:Run Chromium The Chromium Authors "c:\users\walter gokey\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
Yes HKCU:Run OneDrive Microsoft Corporation "C:\Users\walter gokey\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
Yes HKLM:Run RtHDVBg Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /MAXX5REC
Yes HKLM:Run RTHDVCPL Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
Yes Startup Common Malwarebytes Anti-Ransomware.lnk Malwarebytes C:\Program Files\Malwarebytes\Anti-Ransomware\mbarw.exe
Yes Startup Common McAfee Security Scan Plus.lnk McAfee, Inc. C:\Program Files (x86)\McAfee Security Scan\3.11.266\SSScheduler.exe
CC sheduled

Yes Task Adobe Flash Player PPAPI Notifier Adobe Systems Incorporated C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_pepper.exe -check pepperplugin
Yes Task Adobe Flash Player Updater Adobe Systems Incorporated C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Yes Task RtHDVBg_PushButton Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /IM
Yes Task Yahoo! Powered dosim Microsoft Corporation C:\WINDOWS\system32\wscript.exe "C:\ProgramData\{8F484A2B-050A-C0ED-83CC-5EAF198ED561}\loca.txt" "687474703a2f2f7761676e672e636f6d" "433a5c50726f6772616d446174615c7b38463438344132422d303530412d433045442d383343432d3545414631393845443536317d5c636974696e69" "433a5c50726f6772616d446174615c7b38463438344132422d303530412d433045442d383343432d3545414631393845443536317d5c63656e61736f6c" "//B" "//E:jscript" "--IsErIk"
Yes Task {67750CFC-5FC7-1896-4D9C-203D71FA6FA0} C:\Users\WALTER~1\AppData\Local\{E60AD~1\UNINST~1.EXE /Check

#6 waltgokey

waltgokey
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:48 PM

Posted 20 June 2016 - 04:43 PM

# AdwCleaner v5.200 - Logfile created 20/06/2016 at 14:41:46
# Updated 14/06/2016 by ToolsLib
# Database : 2016-06-20.3 [Server]
# Operating system : Windows 10 Enterprise (X64)
# Username : walter gokey - DESKTOP-1NC43GN
# Running from : C:\Users\walter gokey\Downloads\AdwCleaner.exe
# Option : Scan
# Support : https://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware
Folder Found : C:\Program Files\ByteFence
Folder Found : C:\WINDOWS\SysNative\Tasks\TweakBit
Folder Found : C:\WINDOWS\SysNative\Tasks\TweakBit

***** [ Files ] *****


***** [ DLL ] *****


***** [ WMI ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\darwendlm
Key Found : HKLM\SOFTWARE\ByteFence
Key Found : HKLM\SOFTWARE\TWEAKBIT
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence
Key Found : [x64] HKLM\SOFTWARE\ByteFence
Key Found : HKU\S-1-5-21-2024428084-3600757561-2017388792-1001\Software\darwendlm
Key Found : HKU\S-1-5-21-2024428084-3600757561-2017388792-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\darwendlm

***** [ Web browsers ] *****

[C:\Users\walter gokey\AppData\Local\Chromium\User Data\Default\Secure Preferences] [Startup_URLs] Found : hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D7%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise&uref=chmm
[C:\Users\walter gokey\AppData\Local\Chromium\User Data\Default\Secure Preferences] [Homepage] Found : hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise&uref=chmm

*************************

C:\AdwCleaner\AdwCleaner[S1].txt - [5504 bytes] - [19/06/2016 05:29:47]
C:\AdwCleaner\AdwCleaner[S2].txt - [2733 bytes] - [20/06/2016 14:41:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [2806 bytes] ##########

#7 buddy215

buddy215

  • Moderator
  • 13,260 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:48 PM

Posted 20 June 2016 - 07:10 PM

You did not click on Clean after AdwCleaner scan was completed. You must do that in order for AdwCleaner to delete the adware

it found. Please Rerun AdwCleaner and post the new log.

 

You posted two of the Three lists I asked for. Please post the list of Installed Programs usingCCleaner.

 

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.

 

Run another scan using MBAM to be sure it removed all that it found and it often finds more on a second scan. Please

post the new MBAM log.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#8 waltgokey

waltgokey
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:48 PM

Posted 21 June 2016 - 04:39 PM

# AdwCleaner v5.200 - Logfile created 21/06/2016 at 14:30:59
# Updated 14/06/2016 by ToolsLib
# Database : 2016-06-21.2 [Server]
# Operating system : Windows 10 Enterprise (X64)
# Username : walter gokey - DESKTOP-1NC43GN
# Running from : C:\Users\walter gokey\Downloads\AdwCleaner.exe
# Option : Clean
# Support : https://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware
[-] Folder Deleted : C:\Program Files\ByteFence
[-] Folder Deleted : C:\WINDOWS\SysNative\Tasks\TweakBit
[#] Folder Deleted : C:\WINDOWS\SysNative\Tasks\TweakBit

***** [ Files ] *****


***** [ DLLs ] *****


***** [ WMI ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\darwendlm
[-] Key Deleted : HKLM\SOFTWARE\ByteFence
[-] Key Deleted : HKLM\SOFTWARE\TWEAKBIT
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence
[-] Key Deleted : [x64] HKLM\SOFTWARE\ByteFence

***** [ Web browsers ] *****

[-] [C:\Users\walter gokey\AppData\Local\Chromium\User Data\Default\Secure Preferences] [Startup_URLs] Deleted : hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D7%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise&uref=chmm
[-] [C:\Users\walter gokey\AppData\Local\Chromium\User Data\Default\Secure Preferences] [Homepage] Deleted : hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dwndlm_16_24&param1=1&param2=f%3D1%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutBtDyEyByEyByE0FyDzyzytB0Bzz0AtDtN0D0Tzu0StCyCtBzytN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StCyC0DyBtAyC0CtCtGyCtCtBtBtGyD0D0AyBtGyByEzytCtG0FzytAtCyCyE0EyB0AyD0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0C0BtDtDyCyCzytGzy0ByDtBtGyEtCtBzztGzz0ByBtDtGyDyE0AtBtB0EtD0BtB0BtA0F2QtN0A0LzuyE%26cr%3D516290276%26a%3Dwbf_dwndlm_16_24%26os_ver%3D10.0%26os%3DWindows%2B10%2BEnterprise&uref=chmm

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2608 bytes] - [21/06/2016 14:30:59]
C:\AdwCleaner\AdwCleaner[S1].txt - [5504 bytes] - [19/06/2016 05:29:47]
C:\AdwCleaner\AdwCleaner[S2].txt - [2889 bytes] - [20/06/2016 14:41:46]
C:\AdwCleaner\AdwCleaner[S3].txt - [2838 bytes] - [21/06/2016 14:30:02]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2900 bytes] ##########

#9 waltgokey

waltgokey
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:48 PM

Posted 21 June 2016 - 04:43 PM

CC Cleaner Install File

3D Builder Microsoft Corporation 6/18/2016 11.1.8.0
Adobe Flash Player 22 PPAPI Adobe Systems Incorporated 6/18/2016 19.5 MB 22.0.0.192
Alarms & Clock Microsoft Corporation 6/18/2016 10.1605.1472.0
App connector Microsoft Corporation 6/18/2016 1.3.3.0
Calculator Microsoft Corporation 6/18/2016 10.1601.49020.0
Camera Microsoft Corporation 6/18/2016 2016.404.120.0
CCleaner Piriform 6/20/2016 5.18
ESET Online Scanner v3 6/20/2016
Free Window Registry Repair 6/18/2016
Get Office Microsoft Corporation 6/18/2016 17.7031.23501.0
Get Skype Skype 6/18/2016 3.2.1.0
Get Started Microsoft Corporation 6/18/2016 3.5.11.0
Google Chrome Google Inc. 6/18/2016 402 MB 51.0.2704.103
Groove Music Microsoft Corporation 6/21/2016 3.6.22051.0
Intel Security True Key Intel Security 6/18/2016 4.2.131.1
Mail and Calendar Microsoft Corporation 6/21/2016 17.6965.40901.0
Malwarebytes Anti-Malware version 2.2.1.1043 Malwarebytes 6/20/2016 66.9 MB 2.2.1.1043
Malwarebytes Anti-Ransomware version 0.9.15.416 Malwarebytes 6/19/2016 69.5 MB 0.9.15.416
Maps Microsoft Corporation 6/21/2016 5.1606.1670.0
McAfee Security Scan Plus McAfee, Inc. 6/18/2016 10.2 MB 3.11.266.3
Messaging + Skype Microsoft Corporation 6/18/2016 2.15.20002.0
Microsoft Solitaire Collection Microsoft Studios 6/18/2016 3.9.5250.0
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 Microsoft Corporation 6/18/2016 20.5 MB 12.0.30501.0
Microsoft Wi-Fi Microsoft Corporation 6/18/2016 1.1604.4.0
Money Microsoft Corporation 6/18/2016 4.9.76.0
Movies & TV Microsoft Corporation 6/18/2016 3.6.20961.0
News Microsoft Corporation 6/18/2016 4.9.76.0
OneNote Microsoft Corporation 6/18/2016 17.6965.57891.0
People Microsoft Corporation 6/18/2016 10.0.10811.0
Phone Microsoft Corporation 6/18/2016 2.17.27003.0
Phone Companion Microsoft Corporation 6/18/2016 10.1602.3010.0
Photos Microsoft Corporation 6/18/2016 16.526.11220.0
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 6/19/2016 38.2 MB 6.0.1.7544
Sports Microsoft Corporation 6/18/2016 4.9.76.0
Store Microsoft Corporation 6/18/2016 11602.1.26.0
Sway Microsoft Corporation 6/18/2016 17.7070.45221.0
TeamViewer 11 TeamViewer 6/19/2016 61.4 MB 11.0.59518
Voice Recorder Microsoft Corporation 6/18/2016 10.1605.1471.0
Weather Microsoft Corporation 6/18/2016 4.9.76.0
Xbox Microsoft Corporation 6/18/2016 15.18.14017.0

#10 waltgokey

waltgokey
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:48 PM

Posted 21 June 2016 - 04:54 PM

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 6/21/2016
Scan Time: 2:44 PM
Logfile: mwresult.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.06.21.07
Rootkit Database: v2016.05.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: walter gokey

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 285377
Time Elapsed: 8 min, 18 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

#11 waltgokey

waltgokey
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:48 PM

Posted 21 June 2016 - 04:58 PM

Uninsstall Tab

3D Builder Microsoft Corporation 6/18/2016 11.1.8.0
Adobe Flash Player 22 PPAPI Adobe Systems Incorporated 6/18/2016 19.5 MB 22.0.0.192
Alarms & Clock Microsoft Corporation 6/18/2016 10.1605.1472.0
App connector Microsoft Corporation 6/18/2016 1.3.3.0
Calculator Microsoft Corporation 6/18/2016 10.1601.49020.0
Camera Microsoft Corporation 6/18/2016 2016.404.120.0
CCleaner Piriform 6/20/2016 5.18
ESET Online Scanner v3 6/20/2016
Free Window Registry Repair 6/18/2016
Get Office Microsoft Corporation 6/18/2016 17.7031.23501.0
Get Skype Skype 6/18/2016 3.2.1.0
Get Started Microsoft Corporation 6/18/2016 3.5.11.0
Google Chrome Google Inc. 6/18/2016 402 MB 51.0.2704.103
Groove Music Microsoft Corporation 6/21/2016 3.6.22051.0
Intel Security True Key Intel Security 6/18/2016 4.2.131.1
Mail and Calendar Microsoft Corporation 6/21/2016 17.6965.40901.0
Malwarebytes Anti-Malware version 2.2.1.1043 Malwarebytes 6/20/2016 66.9 MB 2.2.1.1043
Malwarebytes Anti-Ransomware version 0.9.15.416 Malwarebytes 6/19/2016 69.5 MB 0.9.15.416
Maps Microsoft Corporation 6/21/2016 5.1606.1670.0
McAfee Security Scan Plus McAfee, Inc. 6/18/2016 10.2 MB 3.11.266.3
Messaging + Skype Microsoft Corporation 6/18/2016 2.15.20002.0
Microsoft Solitaire Collection Microsoft Studios 6/18/2016 3.9.5250.0
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 Microsoft Corporation 6/18/2016 20.5 MB 12.0.30501.0
Microsoft Wi-Fi Microsoft Corporation 6/18/2016 1.1604.4.0
Money Microsoft Corporation 6/18/2016 4.9.76.0
Movies & TV Microsoft Corporation 6/18/2016 3.6.20961.0
News Microsoft Corporation 6/18/2016 4.9.76.0
OneNote Microsoft Corporation 6/18/2016 17.6965.57891.0
People Microsoft Corporation 6/18/2016 10.0.10811.0
Phone Microsoft Corporation 6/18/2016 2.17.27003.0
Phone Companion Microsoft Corporation 6/18/2016 10.1602.3010.0
Photos Microsoft Corporation 6/18/2016 16.526.11220.0
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 6/19/2016 38.2 MB 6.0.1.7544
Sports Microsoft Corporation 6/18/2016 4.9.76.0
Store Microsoft Corporation 6/18/2016 11602.1.26.0
Sway Microsoft Corporation 6/18/2016 17.7070.45221.0
TeamViewer 11 TeamViewer 6/19/2016 61.4 MB 11.0.59518
Voice Recorder Microsoft Corporation 6/18/2016 10.1605.1471.0
Weather Microsoft Corporation 6/18/2016 4.9.76.0
Xbox Microsoft Corporation 6/18/2016 15.18.14017.0
Install

3D Builder Microsoft Corporation 6/18/2016 11.1.8.0
Adobe Flash Player 22 PPAPI Adobe Systems Incorporated 6/18/2016 19.5 MB 22.0.0.192
Alarms & Clock Microsoft Corporation 6/18/2016 10.1605.1472.0
App connector Microsoft Corporation 6/18/2016 1.3.3.0
Calculator Microsoft Corporation 6/18/2016 10.1601.49020.0
Camera Microsoft Corporation 6/18/2016 2016.404.120.0
CCleaner Piriform 6/20/2016 5.18
ESET Online Scanner v3 6/20/2016
Free Window Registry Repair 6/18/2016
Get Office Microsoft Corporation 6/18/2016 17.7031.23501.0
Get Skype Skype 6/18/2016 3.2.1.0
Get Started Microsoft Corporation 6/18/2016 3.5.11.0
Google Chrome Google Inc. 6/18/2016 402 MB 51.0.2704.103
Groove Music Microsoft Corporation 6/21/2016 3.6.22051.0
Intel Security True Key Intel Security 6/18/2016 4.2.131.1
Mail and Calendar Microsoft Corporation 6/21/2016 17.6965.40901.0
Malwarebytes Anti-Malware version 2.2.1.1043 Malwarebytes 6/20/2016 66.9 MB 2.2.1.1043
Malwarebytes Anti-Ransomware version 0.9.15.416 Malwarebytes 6/19/2016 69.5 MB 0.9.15.416
Maps Microsoft Corporation 6/21/2016 5.1606.1670.0
McAfee Security Scan Plus McAfee, Inc. 6/18/2016 10.2 MB 3.11.266.3
Messaging + Skype Microsoft Corporation 6/18/2016 2.15.20002.0
Microsoft Solitaire Collection Microsoft Studios 6/18/2016 3.9.5250.0
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 Microsoft Corporation 6/18/2016 20.5 MB 12.0.30501.0
Microsoft Wi-Fi Microsoft Corporation 6/18/2016 1.1604.4.0
Money Microsoft Corporation 6/18/2016 4.9.76.0
Movies & TV Microsoft Corporation 6/18/2016 3.6.20961.0
News Microsoft Corporation 6/18/2016 4.9.76.0
OneNote Microsoft Corporation 6/18/2016 17.6965.57891.0
People Microsoft Corporation 6/18/2016 10.0.10811.0
Phone Microsoft Corporation 6/18/2016 2.17.27003.0
Phone Companion Microsoft Corporation 6/18/2016 10.1602.3010.0
Photos Microsoft Corporation 6/18/2016 16.526.11220.0
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 6/19/2016 38.2 MB 6.0.1.7544
Sports Microsoft Corporation 6/18/2016 4.9.76.0
Store Microsoft Corporation 6/18/2016 11602.1.26.0
Sway Microsoft Corporation 6/18/2016 17.7070.45221.0
TeamViewer 11 TeamViewer 6/19/2016 61.4 MB 11.0.59518
Voice Recorder Microsoft Corporation 6/18/2016 10.1605.1471.0
Weather Microsoft Corporation 6/18/2016 4.9.76.0
Xbox Microsoft Corporation 6/18/2016 15.18.14017.0
Scheduled

Yes Task Adobe Flash Player PPAPI Notifier Adobe Systems Incorporated C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_pepper.exe -check pepperplugin
Yes Task Adobe Flash Player Updater Adobe Systems Incorporated C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Yes Task RtHDVBg_PushButton Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /IM
Yes Task Yahoo! Powered dosim Microsoft Corporation C:\WINDOWS\system32\wscript.exe "C:\ProgramData\{8F484A2B-050A-C0ED-83CC-5EAF198ED561}\loca.txt" "687474703a2f2f7761676e672e636f6d" "433a5c50726f6772616d446174615c7b38463438344132422d303530412d433045442d383343432d3545414631393845443536317d5c636974696e69" "433a5c50726f6772616d446174615c7b38463438344132422d303530412d433045442d383343432d3545414631393845443536317d5c63656e61736f6c" "//B" "//E:jscript" "--IsErIk"
Yes Task {67750CFC-5FC7-1896-4D9C-203D71FA6FA0} C:\Users\WALTER~1\AppData\Local\{E60AD~1\UNINST~1.EXE /Check

#12 buddy215

buddy215

  • Moderator
  • 13,260 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:48 PM

Posted 21 June 2016 - 07:14 PM

Uninstall These Programs:

ESET Online Scanner v3 6/20/2016

Free Window Registry Repair 6/18/2016

McAfee Security Scan Plus McAfee, Inc. 6/18/2016 10.2 MB 3.11.266.3

 

If you didn't intentionally install this program or you don't need it....uninstall it.

TeamViewer 11 TeamViewer 6/19/2016 61.4 MB 11.0.59518

 

 

Disable these Scheduled Tasks: Use CCleaner by clicking on each item and choosing Disable on the right.

Yes Task Adobe Flash Player PPAPI Notifier Adobe Systems Incorporated C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_pepper.exe -check pepperplugin

Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

 

Delete these Scheduled Tasks: Use CCleaner by clicking on it and then choose Delete on the right.

Yes Task Yahoo! Powered dosim Microsoft Corporation C:\WINDOWS\system32\wscript.exe "C:\ProgramData\{8F484A2B-050A-C0ED-83CC-5EAF198ED561}\loca.txt" "687474703a2f2f7761676e672e636f6d" "433a5c50726f6772616d446174615c7b38463438344132422d303530412d433045442d383343432d3545414631393845443536317d5c636974696e69" "433a5c50726f6772616d446174615c7b38463438344132422d303530412d433045442d383343432d3545414631393845443536317d5c63656e61736f6c" "//B" "//E:jscript" "--IsErIk"
Yes Task {67750CFC-5FC7-1896-4D9C-203D71FA6FA0} C:\Users\WALTER~1\AppData\Local\{E60AD~1\UNINST~1.EXE /Check

 

Delete this Windows Startup: Use CCleaner by clicking on it and then choose Delete on the right. (It's possible this startup was removed when you uninstalled Chromium. )

Yes HKCU:Run Chromium The Chromium Authors "c:\users\walter gokey\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session

 

Disable these Windows Startups: Use CCleaner by clicking on each item and then choose Disable on the right.

Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR

Yes Startup Common McAfee Security Scan Plus.lnk McAfee, Inc. C:\Program Files (x86)\McAfee Security Scan\3.11.266\SSScheduler.exe
CC sheduled

 

After performing the above....please tell me what problem(s) exist.... if any.


Edited by buddy215, 22 June 2016 - 08:32 AM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#13 buddy215

buddy215

  • Moderator
  • 13,260 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:48 PM

Posted 22 June 2016 - 08:33 AM

Note that I edited the Delete these Scheduled Tasks and Delete this Windows Startup....


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users