Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Definitely infected


  • Please log in to reply
6 replies to this topic

#1 osubg1

osubg1

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 02 September 2016 - 11:51 PM

I have a laptop that I cannot use any browsers - each time I open, I get a bunch of ads - popups that say the computer is infected and to call a number, update flash, app4com.lear2upgradesafe2update.club, etc.  

 

I ran adwcleaner and cleaned-  but it did not remove or clean whatever it was.  I found this site and it looks like I need to follow up with quite a bit more.  

 

Help?

 

Thank you!

Andrew



BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:03 PM

Posted 03 September 2016 - 06:11 AM

Welcome to BC...

 

Good that you didn't call the criminal's number. I note you have run AdwCleaner. Please run another scan with it following the instructions below.

 

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

 

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).

  • Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • When MBAM is finished scanning it will display a screen that displays any malware that it has detected.
  • Click the Remove Selected button.
  • MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.

POST THE LOG FOR  REVIEW.

 

Download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
  • download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE:Sometimes if ESET finds no infections it will not create a log.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 osubg1

osubg1
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 03 September 2016 - 08:38 PM

Thanks for the quick response - here's the information you asked for.  Windows 10. 

 

Malwarebytes - there were three log files, Pre, After, and Protection log.  Here they are. 

 

PreScan

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 9/3/2016
Scan Time: 7:54 AM
Logfile: Before Scan.txt
Administrator: Yes
 
Version: 2.2.1.1043
Malware Database: v2016.09.03.04
Rootkit Database: v2016.08.15.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 10
CPU: x64
File System: NTFS
User: Jaime
 
Scan Type: Threat Scan
Result: Cancelled
Objects Scanned: 55048
Time Elapsed: 4 min, 23 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
END PreScan
 
AFTER Scan
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 9/3/2016
Scan Time: 8:00 AM
Logfile: AfterScan.txt
Administrator: Yes
 
Version: 2.2.1.1043
Malware Database: v2016.09.03.04
Rootkit Database: v2016.08.15.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 10
CPU: x64
File System: NTFS
User: Jaime
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 314336
Time Elapsed: 15 min, 14 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 1
Trojan.DNSChanger.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\INTERFACES\{ae73205c-ebe4-486b-b9ce-747d18ecf60d}|NameServer, 82.163.142.7 95.211.158.134, Quarantined, [10b00469f8a250e60daee512788bdd23]
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
End AfterScan
 
Protection Log
 
Malwarebytes Anti-Malware
www.malwarebytes.org
 
 
Protection, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Protection, Malware Protection, Starting, 
Protection, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Protection, Malware Protection, Started, 
Protection, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Protection, Malicious Website Protection, Starting, 
Protection, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Protection, Malicious Website Protection, Started, 
Update, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Manual, Remediation Database, 2016.2.12.1, 2016.8.31.1, 
Update, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Manual, Rootkit Database, 2016.2.8.1, 2016.8.15.1, 
Update, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Manual, IP Database, 2016.2.8.1, 2016.9.2.1, 
Update, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Manual, Domain Database, 2016.2.16.8, 2016.9.2.5, 
Update, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Manual, Malware Database, 2016.2.16.6, 2016.9.3.4, 
Protection, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Protection, Refresh, Starting, 
Protection, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Protection, Malicious Website Protection, Stopping, 
Protection, 9/3/2016 7:54 AM, SYSTEM, GEMINI, Protection, Malicious Website Protection, Stopped, 
Protection, 9/3/2016 7:55 AM, SYSTEM, GEMINI, Protection, Refresh, Success, 
Protection, 9/3/2016 7:55 AM, SYSTEM, GEMINI, Protection, Malicious Website Protection, Starting, 
Protection, 9/3/2016 7:55 AM, SYSTEM, GEMINI, Protection, Malicious Website Protection, Started, 
Scan, 9/3/2016 7:59 AM, SYSTEM, GEMINI, Context, Start:9/3/2016 7:54 AM, Duration:4 min 23 sec, Threat Scan, Cancelled, 0 Malware Detections, 0 Non-Malware Detections, 
Scan, 9/3/2016 9:24 AM, SYSTEM, GEMINI, Manual, Start:9/3/2016 8:00 AM, Duration:15 min 14 sec, Threat Scan, Completed, 1 Malware Detection, 0 Non-Malware Detections, 
Protection, 9/3/2016 9:25 AM, SYSTEM, GEMINI, Protection, Malware Protection, Starting, 
Protection, 9/3/2016 9:25 AM, SYSTEM, GEMINI, Protection, Malware Protection, Started, 
Protection, 9/3/2016 9:25 AM, SYSTEM, GEMINI, Protection, Malicious Website Protection, Starting, 
Protection, 9/3/2016 9:25 AM, SYSTEM, GEMINI, Protection, Malicious Website Protection, Started, 
 
(end)
END Protection Log

Here is the ADW Cleaner Log

 

# AdwCleaner v6.010 - Logfile created 03/09/2016 at 09:33:08
# Updated on 12/08/2016 by ToolsLib
# Database : 2016-09-03.1 [Server]
# Operating System : Windows 10 Home  (X64)
# Username : Jaime - GEMINI
# Running from : C:\Users\Jaime\Desktop\AdwCleaner.exe
# Mode: Clean
 
 
 
***** [ Services ] *****
 
 
 
***** [ Folders ] *****
 
[-] Folder deleted: C:\Users\Jaime\AppData\Local\Google\Chrome\User Data\Default\Extensions\nonjdcjchghhkdoolnlbekcfllmednbl
 
 
***** [ Files ] *****
 
[-] File deleted: C:\Users\Jaime\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nonjdcjchghhkdoolnlbekcfllmednbl_0.localstorage
 
 
***** [ DLL ] *****
 
 
 
***** [ WMI ] *****
 
 
 
***** [ Shortcuts ] *****
 
 
 
***** [ Scheduled Tasks ] *****
 
 
 
***** [ Registry ] *****
 
 
 
***** [ Web browsers ] *****
 
[-] [C:\Users\Jaime\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: nonjdcjchghhkdoolnlbekcfllmednbl
 
 
*************************
 
:: "Tracing" keys deleted
:: Winsock settings cleared
 
*************************
 
C:\AdwCleaner\AdwCleaner[C0].txt - [7881 Bytes] - [27/08/2016 16:32:04]
C:\AdwCleaner\AdwCleaner[C2].txt - [2663 Bytes] - [02/09/2016 22:21:39]
C:\AdwCleaner\AdwCleaner[C3].txt - [1281 Bytes] - [03/09/2016 09:33:08]
C:\AdwCleaner\AdwCleaner[S0].txt - [7453 Bytes] - [27/08/2016 16:30:42]
C:\AdwCleaner\AdwCleaner[S1].txt - [2747 Bytes] - [02/09/2016 22:17:32]
C:\AdwCleaner\AdwCleaner[S2].txt - [1412 Bytes] - [02/09/2016 22:28:14]
C:\AdwCleaner\AdwCleaner[S3].txt - [1793 Bytes] - [03/09/2016 09:32:19]
 
########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [1646 Bytes] ##########

Here is the JRT Post Log

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 10 Home x64 
Ran by Jaime (Administrator) on Sat 09/03/2016 at  9:35:47.46
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
File System: 0 
 
 
 
 
Registry: 3 
 
Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_81F130C0832A32B4DF329469CF840557 (Registry Value) 
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value) 
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2AFDC81F-6E12-407A-93A2-084EC490DBED} (Registry Key)
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 09/03/2016 at  9:38:36.73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


#4 osubg1

osubg1
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 03 September 2016 - 08:40 PM

Last, here's the ESET Log

 

C:\AdwCleaner\quarantine\files\qbjarbiihbrgdrvsvabquhwogkzovkvu\7a94b305-3043-0.d a variant of Win32/Adware.Adposhel.M application cleaned by deleting

I have not done anything else - I hesitate to start working on this laptop until I hear back. 

 

Thank you so much!!

Andrew


Edited by osubg1, 03 September 2016 - 08:42 PM.


#5 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:03 PM

Posted 03 September 2016 - 09:01 PM

Reset Google Chrome:

You can restore your browser settings in Chrome at any time. You might need to do this if apps or extensions you installed changed your settings without your knowledge. Your saved bookmarks and passwords won't be cleared or changed.

  1. Open Chrome.
  2. In the top right, click the icon you see: Menu or More
  3. Click Settings.
  4. At the bottom, click Show advanced settings.
  5. Under the section "Reset settings,” click Reset settings.
  6. In the box that appears, click Reset. ​

Post the three lists mentioned below using CCleaner.

Open CCleaner and click on Tools. Choose Startups. On that page you will see a list of Windows Startups and at the top tabs for each browser and Scheduled Tasks.

At the bottom right of that page you will see a button when clicked will allow you to Copy and Paste the list of Windows Startups and Scheduled Tasks into your next

post. Please do that.

 

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#6 osubg1

osubg1
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 03 September 2016 - 09:43 PM

Startup

 

Yes Task Adobe Acrobat Update Task Adobe Systems Incorporated C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
Yes Task GoogleUpdateTaskMachineCore1cf8b01c34bff4f Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Yes Task GoogleUpdateTaskMachineUA1cf6dede39d8702 Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Yes Task Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse McAfee, Inc. C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\54.0\mcdatrep.exe /script=mcnrdhck.lua /periodicRunCount=6
Yes Task Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse McAfee, Inc. C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\54.0\mcdatrep.exe /timeout=60000 /script=mcnrdhck.lua /hcmode=postdatupdate /datver=2728.0 /datupdatestatus=0
Yes Task IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 Intel Corporation "C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe" --automatic
Yes Task IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon Intel Corporation "C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe" --automatic
Yes Task McAfeeLogon McAfee, Inc. C:\PROGRA~1\COMMON~1\McAfee\Platform\McUICnt.exe /platui
Yes Task OneDrive Standalone Update Task Microsoft Corporation C:\Users\Jaime\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
No Task Optimize Start Menu Cache Files-S-1-5-21-2445665099-1912460187-624730875-1001
Yes Task Optimize Start Menu Cache Files-S-1-5-21-2445665099-1912460187-624730875-500
Yes Task Synaptics TouchPad Enhancements Synaptics Incorporated "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
 
 
Scheduled Tasks
 
Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
Yes HKCU:Run GoogleDriveSync "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
Yes HKCU:Run OneDrive Microsoft Corporation "C:\Users\Jaime\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
Yes HKCU:Run Skype Skype Technologies S.A. "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
Yes HKCU:RunOnce Uninstall C:\Users\Jaime\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64 Microsoft Corporation C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Jaime\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64"
Yes HKLM:Run APSDaemon Apple Inc. "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
Yes HKLM:Run CitrixReceiver "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
Yes HKLM:Run ConnectionCenter Citrix Systems, Inc. "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
Yes HKLM:Run Energy Manager Lenovo(beijing) Limited C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
Yes HKLM:Run IgfxTray Intel Corporation - pGFX "C:\windows\system32\igfxtray.exe"
Yes HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
Yes HKLM:Run Lenovo Utility Lenovo(beijing) Limited C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe
Yes HKLM:Run QuickTime Task Apple Inc. "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
Yes HKLM:Run Redirector Citrix Systems, Inc. "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /startup
Yes HKLM:Run RtHDVBg_Dolby Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
Yes HKLM:Run RtHDVBg_LENOVO_DOLBYDRAGON Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /LENOVO_DOLBYDRAGON
Yes HKLM:Run RtHDVBg_LENOVO_MICPKEY Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /LENOVO_MICPKEY
Yes HKLM:Run RtHDVCpl Realtek Semiconductor C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
Yes HKLM:Run RtsFT RTFTrack.exe
Yes HKLM:Run SynTPEnh Synaptics Incorporated %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
Yes HKLM:Run VirtualCloneDrive Elaborate Bytes AG "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
Yes Startup User MagicDisc.lnk C:\Program Files (x86)\MagicDisc\MagicDisc.exe
 

Installed

 

3D Builder Microsoft Corporation 7/20/2016 11.1.9.0

AccuWeather - Weather for Life AccuWeather 8/8/2016 10.0.278.0
Adobe Reader XI (11.0.17) Adobe Systems Incorporated 7/14/2016 436 MB 11.0.17
Alarms & Clock Microsoft Corporation 8/26/2016 10.1608.2312.0
App connector Microsoft Corporation 12/15/2015 1.3.3.0
Apple Application Support (32-bit) Apple Inc. 8/30/2015 127 MB 3.2
Apple Application Support (64-bit) Apple Inc. 8/30/2015 144 MB 3.2
Apple Mobile Device Support Apple Inc. 8/30/2015 42.6 MB 8.2.1.3
Apple Software Update Apple Inc. 1/14/2015 4.53 MB 2.1.3.127
Bonjour Apple Inc. 8/30/2015 3.23 MB 3.0.0.10
Calculator Microsoft Corporation 8/26/2016 10.1608.2213.0
Camera Microsoft Corporation 8/24/2016 2016.816.20.0
Camera Man LENOVO INC 12/15/2015 1.0.1929.30229
CCleaner Piriform 9/3/2016 18.3 MB 5.21
Citrix Receiver Citrix Systems, Inc. 12/15/2015 14.2.0.10
CyberLink PhotoDirector 3 CyberLink Corp. 2/11/2014 112 MB 3.0.1.4107
CyberLink PowerDirector 10 CyberLink Corp. 12/28/2015 282 MB 10.0.0.2810
Dolby Digital Plus Home Theater Dolby Laboratories Inc 2/11/2014 74.1 MB 7.3.2.2
DraftDominator Version 16.0j 8/26/2015 9.60 MB
Dragon Assistant Application en-US version 1.5.8 Nuance Communications, Inc. 2/11/2014 175 MB 1.5.8
Dragon Assistant Core Recognition Service version 1.1.10 Nuance Communications, Inc. 2/11/2014 175 MB 1.1.10
Dragon Assistant Installer version 1.5.8 Nuance Communications, Inc. 2/11/2014 175 MB 1.5.8
Dragon Assistant Language Data en-US version 1.1.3 Nuance Communications, Inc. 2/11/2014 175 MB 1.1.3
eBay eBay, Inc 12/15/2015 1.6.0.34
Energy Manager Lenovo 2/11/2014 85.7 MB 1.0.0.32
ESET Online Scanner v3 9/3/2016
Evernote Touch Evernote 1/17/2016 3.3.0.102
Facebook Facebook Inc 8/24/2016 62.557.41308.0
Get Office Microsoft Corporation 8/24/2016 17.7319.23511.0
Get Skype Skype 12/15/2015 3.2.1.0
Get Started Microsoft Corporation 9/3/2016 4.0.12.0
Google Chrome Google Inc. 9/3/2016 404 MB 53.0.2785.89
Google Earth Google 4/10/2014 181 MB 7.1.2.2041
Groove Music Microsoft Corporation 8/26/2016 3.6.23981.0
HP AiO Printer Remote HP Inc. 8/8/2016 60.1.156.0
Intel® Experience Center Desktop Software Intel 6/14/2016 23.2 MB 1.9.0.8
Intel® Management Engine Components Intel Corporation 2/11/2014 9.5.14.1724
Intel® Processor Graphics Intel Corporation 1/29/2016 20.19.15.4331
Intel® PROSet/Wireless Software for Bluetooth® Technology Intel Corporation 2/11/2014 76.9 MB 3.1.1309.0390
Intel® Rapid Storage Technology Intel Corporation 2/11/2014 12.8.1.1000
Intel® Smart Connect Technology Intel Corporation 2/11/2014 37.9 MB 4.2.40.2418
Intel® Update Manager Intel Corporation 10/18/2015 36.6 MB 3.1.1228
Intel® Experience Center INTEL CORP 12/15/2015 1.9.1.8
Intel® PROSet/Wireless Software Intel Corporation 12/28/2015 142 MB 17.14.0
iTunes Apple Inc. 8/30/2015 302 MB 12.2.2.25
Kindle AMZN Mobile LLC 12/15/2015 2.1.0.2
Lenovo Companion LENOVO INC. 8/9/2016 3.58.0.0
Lenovo EasyCamera Realtek Semiconductor Corp. 12/15/2015 6.2.9200.10249
Lenovo Motion Control PointGrab 2/11/2014 48.3 MB 2.0.0.0807
Lenovo OneKey Recovery CyberLink Corp. 12/28/2015 19.1 MB 8.0.0.2105
Lenovo Photos CEWE COLOR AG u Co. OHG 12/28/2015 228 MB 4.8.5
Lenovo Reach Stoneware, Inc. 2/11/2014 77.2 MB 1.1.0.166
Lenovo Support Lenovo, INC. 12/15/2015 2.0.5.0
Live TV FilmOn TV Inc. 12/15/2015 1.3.6.115
Magic ISO Maker v5.4 (build 0239) 12/15/2015
MagicDisc 2.5.74 12/15/2015
Mail and Calendar Microsoft Corporation 8/26/2016 17.7167.40721.0
Malwarebytes Anti-Malware version 2.2.1.1043 Malwarebytes 9/3/2016 56.7 MB 2.2.1.1043
Maps Microsoft Corporation 8/24/2016 5.1608.2310.0
McAfee LiveSafe McAfee, Inc. 9/3/2016 171 MB 15.0.166
Messaging + Skype Microsoft Corporation 4/19/2016 2.15.20002.0
Microsoft Silverlight Microsoft Corporation 6/23/2016 101 MB 5.1.50428.0
Microsoft Solitaire Collection Microsoft Studios 8/16/2016 3.11.7293.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 2/11/2014 9.94 MB 8.0.61001
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 2/11/2014 1.63 MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 8/30/2015 830 KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 2/11/2014 8.16 MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 2/11/2014 8.15 MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 8/30/2015 7.51 MB 9.0.30729.6161
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 Microsoft Corporation 8/30/2015 18.0 MB 10.0.40219
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 Microsoft Corporation 8/30/2015 21.6 MB 10.0.40219
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 Microsoft Corporation 1/13/2016 17.3 MB 11.0.61030.0
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Microsoft Corporation 12/28/2015 2.42 MB 10.0.50903
Microsoft Wi-Fi Microsoft Corporation 4/29/2016 1.1604.4.0
Money Microsoft Corporation 8/24/2016 4.13.47.0
Movies & TV Microsoft Corporation 8/26/2016 3.6.23941.0
MSN Food & Drink Microsoft Corporation 12/15/2015 3.0.4.336
MSN Health & Fitness Microsoft Corporation 12/15/2015 3.0.4.336
MSN Travel Microsoft Corporation 12/15/2015 3.0.4.336
News Microsoft Corporation 8/24/2016 4.13.47.0
Nitro Pro 8 Nitro 2/11/2014 559 MB 8.5.7.1
OneKey Recovery CyberLink Corp. 2/11/2014 19.1 MB 8.0.0.2105
OneNote Microsoft Corporation 9/3/2016 17.7341.57791.0
People Microsoft Corporation 7/21/2016 10.0.11902.0
Phone Microsoft Corporation 6/5/2016 2.17.27003.0
Phone Companion Microsoft Corporation 8/26/2016 10.1608.2211.0
Photos Microsoft Corporation 8/16/2016 16.722.10060.0
Picasa 3 Google, Inc. 12/15/2015 3.9
PowerDirector CyberLink Corp. 2/11/2014 283 MB 10.0.0.2810
QuickTime 7 Apple Inc. 8/30/2015 97.4 MB 7.76.80.95
rara music with Lenovo Rara Media Group, Ltd 12/15/2015 1.0.25.23
Reader Microsoft Corporation 8/9/2016 6.4.9926.18431
Realtek Card Reader Realtek Semiconductor Corp. 2/11/2014 13.5 MB 6.2.9200.21236
Realtek Ethernet Controller Driver Realtek 2/11/2014 3.08 MB 8.18.621.2013
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 12/28/2015 17.6 MB 6.0.1.7535
SAMSUNG USB Driver for Mobile Phones SAMSUNG Electronics Co., Ltd. 12/15/2015 42.9 MB 1.5.14.0
Skype™ 7.24 Skype Technologies S.A. 5/30/2016 155 MB 7.24.104
Sports Microsoft Corporation 8/24/2016 4.13.47.0
Store Microsoft Corporation 4/30/2016 11602.1.26.0
Sway Microsoft Corporation 8/12/2016 17.7341.45171.0
Synaptics Pointing Device Driver Synaptics Incorporated 12/15/2015 46.4 MB 19.0.9.5
Twitter Twitter Inc. 8/8/2016 5.2.0.0
UserGuide Lenovo 2/11/2014 11.0 MB 1.0.0.15
VirtualCloneDrive Elaborate Bytes 12/28/2015 2.07 MB 5.4.7.0
Voice Recorder Microsoft Corporation 8/26/2016 10.1608.2211.0
Weather Microsoft Corporation 8/24/2016 4.13.47.0
Windows Driver Package - Lenovo (ACPIVPC) System  (02/17/2013 9.52.0.776) Lenovo 12/15/2015 02/17/2013 9.52.0.776
Windows Driver Package - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) Lenovo 12/15/2015 07/25/2013 10.30.0.288
Windows Reading List Microsoft Corporation 6/20/2016 6.3.9654.21234
Windows Scan Microsoft Corporation 12/15/2015 6.3.9654.17133
Xbox Microsoft Corporation 8/27/2016 19.20.24006.0
Xbox 360 SmartGlass Microsoft Corporation 12/15/2015 1.4.3.0
Zinio Reader Zinio LLC 12/15/2015 2.1.0.317


#7 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:03 PM

Posted 04 September 2016 - 06:58 AM

Disable these Windows Startups: Use CCleaner by clicking on each item and choosing Disable on the right.

Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR

Yes HKLM:Run APSDaemon Apple Inc. "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
Yes HKLM:Run CitrixReceiver "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
Yes HKLM:Run IgfxTray Intel Corporation - pGFX "C:\windows\system32\igfxtray.exe"
Yes HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
Yes HKLM:Run QuickTime Task Apple Inc. "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
 

Uninstall these programs:

eBay eBay, Inc 12/15/2015 1.6.0.34 (Keep if you actually have a use for it)

ESET Online Scanner v3 9/3/2016

Picasa 3 Google, Inc. 12/15/2015 3.9 (No longer supported...but if you need it keep it)

QuickTime 7 Apple Inc. 8/30/2015 97.4 MB 7.76.80.95

 

reset the DNS resolver cache, perform the following steps:

  1. Hold down the Windows key and press “R” to bring up the Run dialog box.
  2. Type “ipconfig /flushdns” then press “Enter“.

 

Download 51a5f31352b88-icon_MBAR.pngMalwarebytes Anti-Rootkit (MBAR) to your desktop.

  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Double click on downloaded file. OK self extracting prompt.
  • MBAR will start. Click "Next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"

NOTE. If you see This version requires you to completely exit the Anti Malware application message right click on the Malwarebytes Anti-Malware icon in the system tray and click on Exit.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users