Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

anti virus detects all .exe files as virus


  • Please log in to reply
22 replies to this topic

#1 Perfekt369

Perfekt369

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:15 PM

Posted 01 February 2017 - 10:30 AM

Hi all.

Ever since yesterday my ESET smart security anti virus has been detecting most of my .exe files as viruses. Even things such as Adobe or Audacity and even all my games. I tried restoring them from the quarantine but it keeps detecting. I'm afraid it might be some kind of a virus that causes this problem. Please any help is appreciated I don't wanna reset my pc and lose all my data. I'm guessing it did have something to do with me using someone's flash drive and that caused a virus infection.

By the way I'm using a windows 10


Edited by hamluis, 01 February 2017 - 11:12 AM.
Moved from Introductions to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:45 AM

Posted 01 February 2017 - 09:10 PM

Welcome aboard p22002758.gif

 

p22002970.gif Download Security Check from here or here and save it to your Desktop.

  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

p22002970.gif Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


p22002970.gif Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices (do NOT change any settings here)
  • List Users, Partitions and Memory size
  • List Restore Points

Click Go and post the result.

p22002970.gif Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-1878.1878-3.5.1.2522.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
  • The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.


p22002970.gifDownload 51a5f31352b88-icon_MBAR.pngMalwarebytes Anti-Rootkit (MBAR) to your desktop.
  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Double click on downloaded file. OK self extracting prompt.
  • MBAR will start. Click "Next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"


NOTE. If you see This version requires you to completely exit the Anti Malware application message right click on the Malwarebytes Anti-Malware icon in the system tray and click on Exit.

p22002970.gif Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.


If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.

NOTE Do NOT wrap your logs in "quote" or "code" brackets.
Do NOT use spoilers.
Do NOT edit your reply to post additional logs. Create new reply. I'll not get any email notifications about edits so I won't know you posted something new.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 Perfekt369

Perfekt369
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:15 PM

Posted 06 March 2017 - 01:24 PM

Hi. So sorry for the late reply. Are you still available ? Also should I delete the current antivirus on my pc in order to install the ones you recommended ??

 

Welcome aboard p22002758.gif

 

p22002970.gif Download Security Check from here or here and save it to your Desktop.

  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

p22002970.gif Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


p22002970.gif Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices (do NOT change any settings here)
  • List Users, Partitions and Memory size
  • List Restore Points

Click Go and post the result.

p22002970.gif Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-1878.1878-3.5.1.2522.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
  • The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.


p22002970.gifDownload 51a5f31352b88-icon_MBAR.pngMalwarebytes Anti-Rootkit (MBAR) to your desktop.
  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Double click on downloaded file. OK self extracting prompt.
  • MBAR will start. Click "Next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"


NOTE. If you see This version requires you to completely exit the Anti Malware application message right click on the Malwarebytes Anti-Malware icon in the system tray and click on Exit.

p22002970.gif Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.


If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.

NOTE Do NOT wrap your logs in "quote" or "code" brackets.
Do NOT use spoilers.
Do NOT edit your reply to post additional logs. Create new reply. I'll not get any email notifications about edits so I won't know you posted something new.

 

Welcome aboard p22002758.gif

 

p22002970.gif Download Security Check from here or here and save it to your Desktop.

  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

p22002970.gif Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


p22002970.gif Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices (do NOT change any settings here)
  • List Users, Partitions and Memory size
  • List Restore Points

Click Go and post the result.

p22002970.gif Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-1878.1878-3.5.1.2522.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
  • The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.


p22002970.gifDownload 51a5f31352b88-icon_MBAR.pngMalwarebytes Anti-Rootkit (MBAR) to your desktop.
  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Double click on downloaded file. OK self extracting prompt.
  • MBAR will start. Click "Next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"


NOTE. If you see This version requires you to completely exit the Anti Malware application message right click on the Malwarebytes Anti-Malware icon in the system tray and click on Exit.

p22002970.gif Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.


If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.

NOTE Do NOT wrap your logs in "quote" or "code" brackets.
Do NOT use spoilers.
Do NOT edit your reply to post additional logs. Create new reply. I'll not get any email notifications about edits so I won't know you posted something new.

 

.


Edited by Perfekt369, 06 March 2017 - 01:25 PM.


#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:45 AM

Posted 06 March 2017 - 05:51 PM

Please don't quote my reply because it creates unnecessary clutter.

Thank you :)

 

Don't remove anything. Just follow my instructions.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#5 Perfekt369

Perfekt369
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:15 PM

Posted 12 March 2017 - 12:55 PM

Ok sorry I'm new to the website lol ok gonna do all those things now I'll post real soon



#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:45 AM

Posted 12 March 2017 - 08:03 PM

OK :)


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#7 Perfekt369

Perfekt369
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:15 PM

Posted 13 March 2017 - 02:57 PM

Hi I did everything you suggested except there was no way I could install malware anti rootkit some problem with this 7zip archive.
Also I didn't exactly delete all the threats detected by malwarebytes due to some of the files looked like system files which may have been dangerous to keep. I should also add that I have no idea if the windows im using is genuine or not(probably not lol) and if the detected files are part of a game file, is there a way to clean the threat without removing the game ? and thanks for the help in advance.
 
SecurityCheck Results
 
 Results of screen317's Security Check version 1.014 --- 12/23/15  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
 Windows Firewall Disabled!  
ESET Smart Security 9.0.318.0   
Windows Defender                
 Antivirus out of date!  
`````````Anti-malware/Other Utilities Check:````````` 
 Visual Studio Extensions for Windows Library for JavaScript 
 Java version 32-bit out of Date! 
 Adobe Reader 10.1.4 Adobe Reader out of Date!  
 Google Chrome (56.0.2924.87) 
 Google Chrome (SetupMetrics...) 
````````Process Check: objlist.exe by Laurent````````  
 ESET NOD32 Antivirus egui.exe  
 ESET NOD32 Antivirus ekrn.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log`````````````````````` 
 
Farbar Results
 
Farbar Service Scanner Version: 27-01-2016
Ran by Phoenix (administrator) on 13-03-2017 at 19:35:49
Running from "C:\Users\user\Downloads"
Microsoft Windows 10 Pro  (X64)
Boot Mode: Normal
****************************************************************
 
Internet Services:
============
 
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
 
 
Windows Firewall:
=============
 
Firewall Disabled Policy: 
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0
 
 
System Restore:
============
 
System Restore Policy: 
========================
 
 
Security Center:
============
 
 
Windows Update:
============
 
Windows Autoupdate Disabled Policy: 
============================
 
 
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
 
 
Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
 
 
Other Services:
==============
 
 
File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
 
 
**** End of log ****
 
Results of MiniToolBox
 
MiniToolBox by Farbar  Version: 17-06-2016
Ran by Phoenix (administrator) on 13-03-2017 at 19:38:21
Running from "C:\Users\user\Downloads"
Microsoft Windows 10 Pro  (X64)
Model: Aspire V3-575G Manufacturer: Acer
Boot Mode: Normal
***************************************************************************
 
========================= IE Proxy Settings: ============================== 
 
Proxy is not enabled.
No Proxy Server is set.
========================= Hosts content: =================================
127.0.0.1 player.kmpmedia.net
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 125.252.224.90 
127.0.0.1 125.252.224.91
127.0.0.1 hl2rcv.adobe.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
 
There are 169 entries.
 
========================= IP Configuration: ================================
 
Qualcomm Atheros QCA61x4A Wireless Network Adapter = Wi-Fi 2 (Connected)
Realtek PCIe GBE Family Controller = Ethernet 2 (Media disconnected)
Anchorfree HSS VPN Adapter = Ethernet 3 (Media disconnected)
 
 
# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4
 
reset
set global
 
 
popd
# End of IPv4 configuration
 
 
 
Windows IP Configuration
 
   Host Name . . . . . . . . . . . . : Phoenix
   Primary Dns Suffix  . . . . . . . : 
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
 
Ethernet adapter Ethernet 2:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller #2
   Physical Address. . . . . . . . . : 54-AB-3A-39-A1-18
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Wireless LAN adapter Local Area Connection* 2:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : 32-52-CB-31-05-8B
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Wireless LAN adapter Wi-Fi 2:
 
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Qualcomm Atheros QCA61x4A Wireless Network Adapter
   Physical Address. . . . . . . . . : 30-52-CB-31-05-8B
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::f139:9b6:a6a0:1da3%13(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.1.40(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Monday, March 13, 2017 7:13:19 PM
   Lease Expires . . . . . . . . . . : Thursday, March 16, 2017 7:13:24 PM
   Default Gateway . . . . . . . . . : fe80::92ef:68ff:fe76:8090%13
                                       192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 103830219
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-B3-7C-5E-54-AB-3A-39-A5-7D
   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
Ethernet adapter Ethernet 3:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Anchorfree HSS VPN Adapter
   Physical Address. . . . . . . . . : 00-FF-0C-F3-31-40
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter isatap.{FB45C3AD-1EC7-44CB-AAB7-25D99C275ED6}:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter Teredo Tunneling Pseudo-Interface:
 
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6abd:4a7:cd5a:fa11:29d4(Preferred) 
   Link-local IPv6 Address . . . . . : fe80::4a7:cd5a:fa11:29d4%8(Preferred) 
   Default Gateway . . . . . . . . . : ::
   DHCPv6 IAID . . . . . . . . . . . : 553648128
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-B3-7C-5E-54-AB-3A-39-A5-7D
   NetBIOS over Tcpip. . . . . . . . : Disabled
Server:  UnKnown
Address:  192.168.1.1
 
Name:    google.com
Addresses:  2a00:1450:400e:806::200e
 172.217.17.110
 
 
Pinging google.com [172.217.17.110] with 32 bytes of data:
Reply from 172.217.17.110: bytes=32 time=162ms TTL=45
Reply from 172.217.17.110: bytes=32 time=141ms TTL=45
 
Ping statistics for 172.217.17.110:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 141ms, Maximum = 162ms, Average = 151ms
Server:  UnKnown
Address:  192.168.1.1
 
Name:    yahoo.com
Addresses:  2001:4998:44:204::a7
 2001:4998:c:a06::2:4008
 2001:4998:58:c02::a9
 98.138.253.109
 98.139.183.24
 206.190.36.45
 
 
Pinging yahoo.com [206.190.36.45] with 32 bytes of data:
Reply from 206.190.36.45: bytes=32 time=274ms TTL=44
Reply from 206.190.36.45: bytes=32 time=271ms TTL=44
 
Ping statistics for 206.190.36.45:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 271ms, Maximum = 274ms, Average = 272ms
 
Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
 
Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
  6...54 ab 3a 39 a1 18 ......Realtek PCIe GBE Family Controller #2
  3...32 52 cb 31 05 8b ......Microsoft Wi-Fi Direct Virtual Adapter
 13...30 52 cb 31 05 8b ......Qualcomm Atheros QCA61x4A Wireless Network Adapter
  2...00 ff 0c f3 31 40 ......Anchorfree HSS VPN Adapter
  1...........................Software Loopback Interface 1
  4...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  8...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
===========================================================================
 
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.40     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link      192.168.1.40    281
     192.168.1.40  255.255.255.255         On-link      192.168.1.40    281
    192.168.1.255  255.255.255.255         On-link      192.168.1.40    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.1.40    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.1.40    281
===========================================================================
Persistent Routes:
  None
 
IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 13    281 ::/0                     fe80::92ef:68ff:fe76:8090
  8    306 ::/0                     On-link
  1    306 ::1/128                  On-link
  8    306 2001::/32                On-link
  8    306 2001:0:9d38:6abd:4a7:cd5a:fa11:29d4/128
                                    On-link
 13    281 fe80::/64                On-link
  8    306 fe80::/64                On-link
  8    306 fe80::4a7:cd5a:fa11:29d4/128
                                    On-link
 13    281 fe80::f139:9b6:a6a0:1da3/128
                                    On-link
  1    306 ff00::/8                 On-link
 13    281 ff00::/8                 On-link
  8    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================
 
Catalog5 01 C:\Windows\SysWOW64\napinsp.dll [54784] (Microsoft Corporation)
Catalog5 02 C:\Windows\SysWOW64\pnrpnsp.dll [70144] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [70144] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\NLAapi.dll [64000] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [23552] (Microsoft Corporation)
Catalog5 07 C:\Windows\SysWOW64\wshbth.dll [51200] (Microsoft Corporation)
Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 11 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
Catalog9 12 C:\Windows\SysWOW64\mswsock.dll [306528] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\napinsp.dll [67072] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [87040] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [87040] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [79872] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [31744] (Microsoft Corporation)
x64-Catalog5 07 C:\Windows\System32\wshbth.dll [62976] (Microsoft Corporation)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 11 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
x64-Catalog9 12 C:\Windows\System32\mswsock.dll [363872] (Microsoft Corporation)
 
========================= Event log errors: ===============================
 
Application errors:
==================
Error: (03/13/2017 07:12:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: PHOENIX)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (03/13/2017 07:02:45 PM) (Source: System Restore) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\srtasks.exe ExecuteScheduledSPPCreation; Description = Scheduled Checkpoint; Error = 0x80070422).
 
Error: (03/13/2017 05:35:22 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: PHOENIX)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (03/13/2017 05:31:08 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: PHOENIX)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (03/12/2017 09:26:03 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: PHOENIX)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147024865 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (03/12/2017 09:26:03 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: PHOENIX)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (03/12/2017 04:26:58 AM) (Source: Application Error) (User: )
Description: Faulting application name: WWE2K16.exe, version: 1.0.0.0, time stamp: 0x56dee903
Faulting module name: ntdll.dll, version: 10.0.10240.17184, time stamp: 0x580ee916
Exception code: 0xc0000005
Fault offset: 0x0000000000035b6b
Faulting process id: 0x1228
Faulting application start time: 0xWWE2K16.exe0
Faulting application path: WWE2K16.exe1
Faulting module path: WWE2K16.exe2
Report Id: WWE2K16.exe3
Faulting package full name: WWE2K16.exe4
Faulting package-relative application ID: WWE2K16.exe5
 
Error: (03/12/2017 02:05:35 AM) (Source: Application Error) (User: )
Description: Faulting application name: WWE2K16.exe, version: 1.0.0.0, time stamp: 0x56dee903
Faulting module name: nvwgf2umx.dll, version: 10.18.13.6822, time stamp: 0x573e67a3
Exception code: 0xc0000005
Fault offset: 0x000000000093b2fb
Faulting process id: 0x1fa0
Faulting application start time: 0xWWE2K16.exe0
Faulting application path: WWE2K16.exe1
Faulting module path: WWE2K16.exe2
Report Id: WWE2K16.exe3
Faulting package full name: WWE2K16.exe4
Faulting package-relative application ID: WWE2K16.exe5
 
Error: (03/12/2017 01:54:04 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: PHOENIX)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (03/12/2017 01:46:45 AM) (Source: Application Error) (User: )
Description: Faulting application name: WWE2K16.exe, version: 1.0.0.0, time stamp: 0x56dee903
Faulting module name: WWE2K16.exe, version: 1.0.0.0, time stamp: 0x56dee903
Exception code: 0xc0000005
Fault offset: 0x0000000000c6bc53
Faulting process id: 0x288
Faulting application start time: 0xWWE2K16.exe0
Faulting application path: WWE2K16.exe1
Faulting module path: WWE2K16.exe2
Report Id: WWE2K16.exe3
Faulting package full name: WWE2K16.exe4
Faulting package-relative application ID: WWE2K16.exe5
 
 
System errors:
=============
Error: (03/13/2017 07:12:13 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: {5DC4F9AD-3A2B-4DF4-AC39-3FF5A19FCF4C}
 
Error: (03/13/2017 07:12:13 PM) (Source: DCOM) (User: PHOENIX)
Description: CortanaUI.AppXtpp90jhw9p0njjb85kvhxpppgrqfp117.mca
 
Error: (03/13/2017 07:12:13 PM) (Source: Service Control Manager) (User: )
Description: The Sync Host_Session1 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
 
Error: (03/13/2017 06:17:09 PM) (Source: TPM) (User: NT AUTHORITY)
Description: The device driver for the Trusted Platform Module (TPM) encountered a non-recoverable error in the TPM hardware, which prevents TPM services (such as data encryption) from being used. For further help, please contact the computer manufacturer.
 
Error: (03/13/2017 06:17:26 PM) (Source: BugCheck) (User: )
Description: 0x000001d2 (0x0000000005030000, 0x00000000009860b2, 0x00000000409860b2, 0x000000000040e788)C:\Windows\MEMORY.DMP031317-12843-01
 
Error: (03/13/2017 06:17:19 PM) (Source: EventLog) (User: )
Description: The previous system shutdown at 6:04:03 PM on ‎3/‎13/‎2017 was unexpected.
 
Error: (03/13/2017 04:55:26 PM) (Source: TPM) (User: )
Description: The device driver for the Trusted Platform Module (TPM) encountered a non-recoverable error in the TPM hardware, which prevents TPM services (such as data encryption) from being used. For further help, please contact the computer manufacturer.
 
Error: (03/13/2017 05:35:22 AM) (Source: DCOM) (User: PHOENIX)
Description: CortanaUI.AppXn73w0hsq3g4wx1h9fhf7q02vw2wta6qc.mca
 
Error: (03/13/2017 05:33:51 AM) (Source: TPM) (User: )
Description: The device driver for the Trusted Platform Module (TPM) encountered a non-recoverable error in the TPM hardware, which prevents TPM services (such as data encryption) from being used. For further help, please contact the computer manufacturer.
 
Error: (03/13/2017 05:31:08 AM) (Source: DCOM) (User: PHOENIX)
Description: CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mca
 
 
Microsoft Office Sessions:
=========================
Error: (03/13/2017 07:12:13 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: PHOENIX)
Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2144927141
 
Error: (03/13/2017 07:02:45 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\srtasks.exe ExecuteScheduledSPPCreationScheduled Checkpoint0x80070422
 
Error: (03/13/2017 05:35:22 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: PHOENIX)
Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2144927141
 
Error: (03/13/2017 05:31:08 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: PHOENIX)
Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2144927141
 
Error: (03/12/2017 09:26:03 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: PHOENIX)
Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2147024865
 
Error: (03/12/2017 09:26:03 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: PHOENIX)
Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2144927141
 
Error: (03/12/2017 04:26:58 AM) (Source: Application Error)(User: )
Description: WWE2K16.exe1.0.0.056dee903ntdll.dll10.0.10240.17184580ee916c00000050000000000035b6b122801d29ab7e36e7f57E:\Games\WWE 2K16\WWE2K16.exeC:\Windows\SYSTEM32\ntdll.dllced3d77c-f952-4e2d-863b-94b2a694d0e3
 
Error: (03/12/2017 02:05:35 AM) (Source: Application Error)(User: )
Description: WWE2K16.exe1.0.0.056dee903nvwgf2umx.dll10.18.13.6822573e67a3c0000005000000000093b2fb1fa001d29ab6bd8210a7E:\Games\WWE 2K16\WWE2K16.exeC:\Windows\SYSTEM32\nvwgf2umx.dll54fbb570-b3f5-4a64-a181-03912dd10ff0
 
Error: (03/12/2017 01:54:04 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: PHOENIX)
Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2144927141
 
Error: (03/12/2017 01:46:45 AM) (Source: Application Error)(User: )
Description: WWE2K16.exe1.0.0.056dee903WWE2K16.exe1.0.0.056dee903c00000050000000000c6bc5328801d29ab51012f098E:\Games\WWE 2K16\WWE2K16.exeE:\Games\WWE 2K16\WWE2K16.exe068561be-1c91-4e6f-a558-a9fce54cb1b8
 
 
=========================== Installed Programs ============================
 
µTorrent (HKCU\...\uTorrent) (Version: 3.4.9.43295 - BitTorrent Inc.)
Acer Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3019 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.7.0.270 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Master Collection (HKLM-x32\...\{E8AD3069-9EB7-4BA8-8BFE-83F4E69355C0}) (Version: 6 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Photoshop CC (HKLM-x32\...\{2D99B50E-431D-4AA8-85C1-172A6F8BCF09}) (Version: 14.0 - Adobe Systems Incorporated)
Adobe Premiere Pro CC 2015.3 (HKLM-x32\...\PPRO_10_3_0) (Version: 10.3.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{8C49F61F-FCA6-A096-3E92-71128D8425ED}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.12 - Michael Tippach)
Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)
Batman - The Telltale Series (HKLM-x32\...\Batman - The Telltale Series_R.G. Mechanics_is1) (Version:  - R.G. Mechanics, spider91)
Blend for Visual Studio 2012 (HKLM-x32\...\{57F20F04-014D-453F-B6A3-AE9485C4DFAB}) (Version: 5.0.30709.0 - Microsoft Corporation) Hidden
Blend for Visual Studio 2012 ENU resources (HKLM-x32\...\{532DBCC8-9468-435C-AEF6-30B7F50735A2}) (Version: 5.0.30709.0 - Microsoft Corporation) Hidden
Burger Shop 2 1.00 (HKLM-x32\...\Burger Shop 2 1.00) (Version:  - )
Camtasia Studio 8 (HKLM-x32\...\{AF33D0D2-2627-4AC8-8473-FDBB7892129C}) (Version: 8.6.0.2079 - TechSmith Corporation)
Counter-Strike Global Offensive No-Steam (HKLM-x32\...\Counter-Strike Global Offensive_is1) (Version: 1.34.7.2 - Valve Software)
Cradle of Persia 1.00 (HKLM-x32\...\Cradle of Persia 1.00) (Version:  - )
Crusader Kings II Conclave (HKLM-x32\...\Crusader Kings II Conclave_is1) (Version:  - )
DAMN NFO Viewer 2.10.0031 RC3 (HKLM-x32\...\{DA5E6A2D-DEAA-4152-A43A-FDBDE29AA724}) (Version: 2.10.0031 - DAMN)
Dark Souls III (HKLM-x32\...\Dark Souls III_is1) (Version:  - )
DMC Devi May Cry Complete Edition version 1.0.0.0 (HKLM-x32\...\DMC Devi May Cry Complete Edition_is1) (Version: 1.0.0.0 - Capcom)
Dotfuscator and Analytics Community Edition (HKLM-x32\...\{372D17F6-A54E-4A01-B264-1314890FFE61}) (Version: 5.5.4521.29298 - PreEmptive Solutions) Hidden
DriverSetupUtility (HKLM\...\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}) (Version: 1.00.3011 - Acer Incorporated)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version: 6.8.5.1160 - Steinberg Media Technologies GmbH)
Entity Framework Designer for Visual Studio 2012 - enu (HKLM-x32\...\{0A1A1D48-DB23-443A-BC7B-49255D138020}) (Version: 11.1.20702.00 - Microsoft Corporation)
ESET Smart Security (HKLM\...\{11994064-51F2-45DF-A83E-539B4BFE3F5A}) (Version: 9.0.318.0 - ESET, spol. s r.o.)
FFmpeg v0.6.2 for Audacity (HKLM-x32\...\FFmpeg for Audacity_is1) (Version:  - )
FL Studio (HKLM-x32\...\FL Studio10.0.9) (Version: 10.0.9 - Gerdoo)
FL Studio 10 (HKLM-x32\...\FL Studio 10) (Version:  - Image-Line)
FL Studio 12 (HKLM-x32\...\FL Studio 12) (Version:  - Image-Line)
FL Studio ASIO (HKLM-x32\...\FL Studio ASIO) (Version:  - Image-Line)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.32.7 - Google Inc.) Hidden
Grim Tales 12 Graywitch CE 1.0 (HKLM-x32\...\Grim Tales 12 Graywitch CE_is1) (Version: 1.0 - Big Fish Games)
Hotspot Shield 6.5.2 (HKLM-x32\...\{3421ebee-874e-4668-9a74-fec88239d649}) (Version: 6.5.2.10372 - AnchorFree Inc.)
Hotspot Shield 6.5.2 (HKLM-x32\...\{AF599C42-A2E5-4251-B7EE-4925B177CBA7}) (Version: 6.5.2.10372 - AnchorFree Inc.) Hidden
Hotspot Shield 6.5.2 (HKLM-x32\...\HotspotShield) (Version: 6.5.2 - AnchorFree Inc.) Hidden
IIS 8.0 Express (HKLM\...\{7BF61FA9-BDFB-4563-98AD-FCB0DA28CCC7}) (Version: 8.0.1557 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{9f4f4a9b-eec5-4906-92fe-d1f43ccf5c8d}.sdb) (Version:  - )
IIS Express Application Compatibility Database for x86 (HKLM\...\{fdfba1f3-74ae-4255-9c10-a0f552b4610f}.sdb) (Version:  - )
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line)
IMVU Avatar Chat Software (HKCU\...\IMVU Avatar chat client software BETA) (Version:  - )
Intel® C++ Redistributables for Windows* on Intel® 64 (HKLM-x32\...\{D2437C5C-2D8C-40D2-8059-689AD7239FA3}) (Version: 11.1.048 - Intel Corporation)
Intel® Chipset Device Software (HKLM-x32\...\{c6cff78a-cccb-49d5-be68-ae0ec5f0d48a}) (Version: 10.1.1.8 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1163 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 21.20.16.4534 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.2.1088 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Itibiti RTC (HKLM-x32\...\{730E03E4-350E-48E5-9D3E-4329903D454D}) (Version: 0.0.1 - Itibiti Inc) Hidden
KMPFaster (HKLM-x32\...\KMPFaster_is1) (Version: 2.4.1.1066 - MyGoya)
KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 4.0.3.1 - PandoraTV)
KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version:  - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
LocalESPC (HKLM-x32\...\{BDBE5D2A-AAB7-77BD-7A0E-5006665CE7C6}) (Version: 8.59.25584 - Microsoft Corporation) Hidden
LocalESPCui for en-us (HKLM-x32\...\{B5DA9D49-9BD8-0F2F-52FC-C7E66BC8D944}) (Version: 8.59.25584 - Microsoft) Hidden
Marvel Ultimate Alliance 2 (HKLM-x32\...\Marvel Ultimate Alliance 2_is1) (Version:  - )
Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{5CBFF3F3-2D40-34EE-BCA5-A95BC19E400D}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{1948E039-EC79-4591-951D-9867A8C14C90}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft ASP.NET MVC 3 (HKLM-x32\...\{D32EF103-4016-4C15-BCB0-700C0A7A2309}) (Version: 3.0.50813.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft ASP.NET Web Pages (HKLM-x32\...\{631471BE-DEAB-454B-A9AC-CE3EB42C28B3}) (Version: 1.0.20105.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE (HKLM-x32\...\{F112F66E-25CA-42DD-983C-6118EB38F606}) (Version: 3.0.89.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}) (Version: 3.0.19.0 - Microsoft Corporation)
Microsoft Help Viewer 2.0 (HKLM-x32\...\Microsoft Help Viewer 2.0) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50709.0 - Microsoft Corporation)
Microsoft Silverlight 4 SDK (HKLM-x32\...\{189AEA94-DAFB-487A-8CEE-F9D3DDE0A748}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft Silverlight 5 SDK (HKLM-x32\...\{E1FBB3D4-ADB0-4949-B101-855DA061C735}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{9D573E71-1077-4C7E-B4DB-4E22A5D2B48B}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM\...\{36E619BC-A234-4EC3-849B-779A7C865A45}) (Version: 11.0.2316.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM-x32\...\{FBA6F90E-36EC-4FC9-9B25-3834E3BD46A8}) (Version: 11.0.2316.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{13D558FE-A863-402C-B115-160007277033}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects  (HKLM-x32\...\{DA1C1761-5F4F-4332-AB9D-29EDF3F8EA0A}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects  (x64) (HKLM\...\{FA0A244E-F3C2-4589-B42A-3D522DE79A42}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL Compiler Service  (HKLM\...\{BEB0F91E-F2EA-48A1-B938-7857ABF2A93D}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{0E8670B8-3965-4930-ADA6-570348B67153}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL Language Service  (HKLM-x32\...\{6D6D43E5-218C-4B05-92D3-2240810F4760}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - enu (11.1.20627.00) (HKLM-x32\...\{FA804794-2CCB-4301-954F-2C2894698876}) (Version: 11.1.20627.00 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - enu (11.1.20627.00) (HKLM-x32\...\{790E9425-8570-493F-9AE7-81AFC9E46930}) (Version: 11.1.20627.00 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{A47FD1BF-A815-4A76-BE65-53A15BD5D25D}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (x64) (HKLM\...\{4701DEDE-1888-49E0-BAE5-857875924CA2}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (HKLM-x32\...\{E2082604-4BA5-44BB-BBFB-AF0F3CB8C6AB}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (x64) (HKLM\...\{F1949145-EB64-4DE7-9D81-E6D27937146C}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (HKLM-x32\...\{299C0434-4F4E-341F-A916-4E07AEB35E79}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Ultimate 2012 (HKLM-x32\...\{9600393b-6ede-469b-a522-689fce1461d1}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Web Deploy dbSqlPackage Provider - enu (HKLM-x32\...\{E4C33F5B-1B2F-466E-957E-B274F08151A0}) (Version: 10.3.20225.0 - Microsoft Corporation)
Microsoft Web Platform Installer 4.0 (HKLM\...\{E2B8249D-895C-4685-8C83-00F3B1A13028}) (Version: 4.0.1622 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
NVIDIA GeForce Experience 2.11.3.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.3.5 - NVIDIA Corporation)
NVIDIA Graphics Driver 368.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 368.22 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}) (Version: 9.12.0613 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
PDF Settings CC (HKLM-x32\...\{1FBAE18D-4DE4-47AA-83EC-D1B046F262DC}) (Version: 12.0 - Adobe Systems Incorporated) Hidden
PDF Settings CS6 (HKLM-x32\...\{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}) (Version: 11.0 - Adobe Systems Incorporated) Hidden
PreEmptive Analytics Visual Studio Components (HKLM-x32\...\{2C76E3DA-BA76-4FAD-B1B1-72B46D639028}) (Version: 1.0.2180.1 - PreEmptive Solutions) Hidden
Prerequisites for SSDT  (HKLM-x32\...\{9169C939-ED01-446A-BD0C-29873BAF4E48}) (Version: 11.0.2100.60 - Microsoft Corporation)
Qualcomm Atheros QCA9377 Wireless LAN & Bluetooth Installer (HKLM-x32\...\{3241744A-BA36-41F0-B4AA-EF3946D00632}) (Version: 11.0.0.067 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10125.31214 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7553 - Realtek Semiconductor Corp.)
Rise of Nations Extended Edition version 1.0.8.0 (HKLM-x32\...\Rise of Nations Extended Edition_is1) (Version: 1.0.8.0 - AsreBazi)
Rise of the Tomb Raider (HKLM-x32\...\{45F08513-973A-4C18-93FD-8E12B1908390}_is1) (Version:  - Square Enix)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.5.8 - Rockstar Games)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0016-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0018-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0019-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001A-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001B-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C814F7D9-CE9D-45AA-BA7C-88BDD0E1EB7C}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{77A8B979-11B0-4774-8003-574EE8A4BC22}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001F-0C0A-1000-0000000FF1CE}_Office14.PROPLUS_{05916788-991E-417B-A8F3-77F90A2B8271}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-002C-0409-1000-0000000FF1CE}_Office14.PROPLUS_{D4D48631-AC28-4250-B882-C956555B0B1D}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F3FAAB68-7697-4B1F-A23A-72312565AEAB}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0043-0409-1000-0000000FF1CE}_Office14.PROPLUS_{944EFCFD-823D-4C0A-9B01-CD76EEAEA1F3}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0044-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-006E-0409-1000-0000000FF1CE}_Office14.PROPLUS_{58B1AD3E-54D7-42DC-AF42-218AA7C1ED8B}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-00A1-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-00BA-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0115-0409-1000-0000000FF1CE}_Office14.PROPLUS_{58B1AD3E-54D7-42DC-AF42-218AA7C1ED8B}) (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0117-0409-1000-0000000FF1CE}_Office14.PROPLUS_{C7BC6847-623D-4D8F-B87C-82215F0752BA}) (Version:  - Microsoft) Hidden
SHIELD Streaming (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController) (Version: 2.11.3.5 - NVIDIA Corporation) Hidden
Simcity version 10.1.0.0 (HKLM-x32\...\Simcity_is1) (Version: 10.1.0.0 - Mr DJ)
Sonic Lost World (HKLM-x32\...\Sonic Lost World_is1) (Version:  - )
Spider-Man® - Web of Shadows™ 1.1 Patch (HKLM-x32\...\InstallShield_{9208F706-6528-4591-A997-F41395FBD8A7}) (Version:  - ) Hidden
Spider-Man™ - Web of Shadows 1.1 Patch (HKLM-x32\...\{9208F706-6528-4591-A997-F41395FBD8A7}) (Version: 1.1 - Activision) Hidden
Star Wars The Force Unleashed version 1.0.0.0 (HKLM-x32\...\Star Wars The Force Unleashed_is1) (Version: 1.0.0.0 - AsreBazi)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Steinberg Cubase LE AI Elements 8 64bit (HKLM\...\{C801D1E6-30E3-46BE-368D-0106B42CCE17}) (Version: 8.0.20 - Steinberg Media Technologies GmbH)
Steinberg Groove Agent SE 64bit (HKLM\...\{A5AB0D21-21BD-4DB8-F097-02E8FC8C486A}) (Version: 4.2.0 - Steinberg Media Technologies GmbH)
Steinberg HALion Sonic SE 64bit (HKLM\...\{B99C316B-C135-43B5-8E77-2BC5E241F964}) (Version: 2.0.2 - Steinberg Media Technologies GmbH)
Steinberg Upload Manager (HKLM-x32\...\{88BBBD8F-4C19-4809-B84B-7A8F8238B48D}) (Version: 1.0.1 - Steinberg Media Technologies GmbH)
Telegram Desktop version 1.0 (HKCU\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 1.0 - Telegram Messenger LLP)
TeraCopy Pro 2.3 (HKLM\...\TeraCopy_is1) (Version: 2.3 - Parand ® Software Group)
The Sims 4 Get Together Addon Pack (HKLM-x32\...\VGhlU2ltczQ=_is1) (Version: 1 - )
The Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.0.732.20 - Electronic Arts Inc.)
Tomb Raider Anniversary version 2.0 (HKLM-x32\...\Tomb Raider Anniversary_is1) (Version: 2.0 - Parnianpc.com)
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
UpdateAssistant (HKLM-x32\...\{4E67FF7F-C24E-4279-9AB2-C26D57B53742}) (Version: 1.3.0.0 - Microsoft Corporation) Hidden
Vulkan Run Time Libraries 1.0.11.1 (HKLM\...\VulkanRT1.0.11.1) (Version: 1.0.11.1 - LunarG, Inc.)
WCF Data Services 5.0 (for OData v3) Primary Components (HKLM-x32\...\{0BCC836F-0B28-4090-B58A-64883BAA3B2F}) (Version: 5.0.50628.0 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2012 (HKLM-x32\...\{148878BD-A2A5-4CF1-A103-2BA632F41953}) (Version: 5.0.50710.0 - Microsoft Corporation) Hidden
WCF RIA Services V1.0 SP2 (HKLM-x32\...\{3A523AF9-D32F-4C85-8388-0335731F3405}) (Version: 4.1.61829.0 - Microsoft Corporation)
Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17364 - Microsoft Corporation)
Windows Support Tools (HKLM-x32\...\{8398B542-3CC4-44D9-83DF-696CCE70124B}) (Version: 5.1.2510.0 - Microsoft Corporation)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wise Program Uninstaller 1.93 (HKLM-x32\...\Wise Program Uninstaller_is1) (Version: 1.93 - WiseCleaner.com, Inc.)
WWE 2K16 (HKLM-x32\...\WWE 2K16_is1) (Version:  - )
 
========================= Devices: ================================
 
 
========================= Memory info: ===================================
 
Percentage of memory in use: 17%
Total physical RAM: 16250.68 MB
Available physical RAM: 13452.77 MB
Total Virtual: 18682.68 MB
Available Virtual: 16240.87 MB
 
========================= Partitions: =====================================
 
1 Drive c: () (Fixed) (Total:146 GB) (Free:19.27 GB) NTFS
2 Drive e: () (Fixed) (Total:390.62 GB) (Free:131.73 GB) NTFS
3 Drive f: () (Fixed) (Total:394.4 GB) (Free:184.41 GB) NTFS
 
========================= Users: ========================================
 
User accounts for \\PHOENIX
 
Administrator            DefaultAccount           Guest                    
Phoenix                  Semag                    
 
========================= Restore Points ==================================
 
 
**** End of log ****
 
Results of Malwarebytes
 
Malwarebytes
www.malwarebytes.com
 
-Log Details-
Scan Date: 3/13/17
Scan Time: 8:02 PM
Logfile: Malware.txt
Administrator: Yes
 
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.75
Update Package Version: 1.0.1394
License: Trial
 
-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: PHOENIX\Phoenix
 
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 550357
Time Elapsed: 10 min, 30 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 3
PUP.Optional.InstallMonster, HKLM\SOFTWARE\CLASSES\Adobe Photoshop CC 2016 Final Crack With _32 _038_ 64 Bit_.DynamicNS, No Action By User, [137], [324473],1.0.1394
PUP.Optional.InstallMonster, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}, No Action By User, [137], [324473],1.0.1394
PUP.Optional.InstallMonster, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}, No Action By User, [137], [324473],1.0.1394
 
Registry Value: 2
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|APPINIT_DLLS, No Action By User, [96], [-1],0.0.0
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|APPINIT_DLLS, No Action By User, [96], [-1],0.0.0
 
Registry Data: 1
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER|UPDATESDISABLENOTIFY, No Action By User, [19618], [293296],1.0.1394
 
Data Stream: 0
(No malicious items detected)
 
Folder: 11
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\settings\partner, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\settings\common, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\content_script, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\_metadata, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\settings, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\common, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\newtab, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\revert, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\logo, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\MHOBIGPCKNIKLFGLNKHHOCLHCHNAJPBN, No Action By User, [640], [302503],1.0.1394
 
File: 28
Backdoor.Agent.DC, C:\PROGRAMDATA\WINHOST\WINHOST.EXE, No Action By User, [890], [196224],1.0.1394
PUP.Optional.Linkury.ACMB1, C:\USERS\USER\APPDATA\ROAMING\INSTALLATIONCONFIGURATION.XML, No Action By User, [96], [302554],1.0.1394
Trojan.MalPack.Gen, C:\EHTRHF.PIF, No Action By User, [8700], [78353],1.0.1394
HackTool.IdleKMS, C:\PROGRAM FILES\KMSPICO\AUTOPICO.EXE, No Action By User, [3017], [104595],1.0.1394
Trojan.MalPack.Gen, C:\TFBPQB.EXE, No Action By User, [8700], [78353],1.0.1394
Trojan.MalPack.Gen, C:\KDEYT.EXE, No Action By User, [8700], [78353],1.0.1394
Adware.InstallMonster, C:\USERS\USER\DOWNLOADS\ADOBE PHOTOSHOP CC 2016 FINAL CRACK WITH _32 _038_ 64 BIT_.RAR, No Action By User, [182], [122463],1.0.1394
RiskWare.Tool.CK, C:\WINDOWS\KMSERVICE.EXE, No Action By User, [339], [133383],1.0.1394
PUP.Optional.MySearch, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_search.mysearch.com_0.localstorage, No Action By User, [640], [258608],1.0.1394
PUP.Optional.MySearch, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_search.mysearch.com_0.localstorage-journal, No Action By User, [640], [258608],1.0.1394
PUP.Optional.MySearch, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\MHOBIGPCKNIKLFGLNKHHOCLHCHNAJPBN\28.3_0\MANIFEST.JSON, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\common\browseraction.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\common\config.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\common\feed.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\common\utils.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\common\winner.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\content_script\overlayer.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\logo\logo_128x.png, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\logo\logo_16x.png, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\logo\logo_19x.png, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\logo\logo_48x.png, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\newtab\newtab.html, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\revert\index.css, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\revert\index.html, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\revert\index.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\settings\common\redirect.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\settings\partner\Reporting.js, No Action By User, [640], [302503],1.0.1394
PUP.Optional.MySearch, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobigpckniklfglnkhhoclhchnajpbn\28.3_0\_metadata\verified_contents.json, No Action By User, [640], [302503],1.0.1394
 
Physical Sector: 0
(No malicious items detected)
 
 
(end)
 
rKill Results
 
Rkill 2.8.4 by Lawrence Abrams (Grinler)
Copyright 2008-2017 BleepingComputer.com
More Information about Rkill can be found at this link:
 
Program started at: 03/13/2017 11:14:57 PM in x64 mode.
Windows Version: Windows 10 Pro 
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * No malware processes found to kill.
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * Windows Defender Disabled
 
   [HKLM\SOFTWARE\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001
 
 * Windows Firewall Disabled
 
   [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
   "EnableFirewall" = dword:00000000
 
Checking Windows Service Integrity: 
 
 * swenum => \SystemRoot\System32\DriverStore\FileRepository\swenum.inf_amd64_2a699e44676b7781\swenum.sys [Incorrect ImagePath]
 
Searching for Missing Digital Signatures: 
 
 * No issues found.
 
Checking HOSTS File: 
 
 * Cannot edit the HOSTS file.
 * Permissions Fixed. Administrators can now edit the HOSTS file.
 
 * HOSTS file entries found: 
 
  127.0.0.1 player.kmpmedia.net
  127.0.0.1 activate.adobe.com
  127.0.0.1 practivate.adobe.com
  127.0.0.1 ereg.adobe.com
  127.0.0.1 activate.wip3.adobe.com
  127.0.0.1 wip3.adobe.com
  127.0.0.1 3dns-3.adobe.com
  127.0.0.1 3dns-2.adobe.com
  127.0.0.1 adobe-dns.adobe.com
  127.0.0.1 adobe-dns-2.adobe.com
  127.0.0.1 adobe-dns-3.adobe.com
  127.0.0.1 ereg.wip3.adobe.com
  127.0.0.1 activate-sea.adobe.com
  127.0.0.1 wwis-dubc1-vip60.adobe.com
  127.0.0.1 activate-sjc0.adobe.com
  127.0.0.1 adobe.activate.com
  127.0.0.1 adobeereg.com
  127.0.0.1 www.adobeereg.com
  127.0.0.1 125.252.224.90 
  127.0.0.1 125.252.224.91
 
  20 out of 200 HOSTS entries shown.
  Please review HOSTS file for further entries.
 
Program finished at: 03/13/2017 11:15:47 PM
Execution time: 0 hours(s), 0 minute(s), and 49 seconds(s)


#8 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:45 AM

Posted 13 March 2017 - 11:00 PM

I need you to re-run MBAM and to remove ALL found threats.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#9 Perfekt369

Perfekt369
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:15 PM

Posted 17 March 2017 - 10:14 AM

Hey ! So I ran another full scan on the pc with MalewareBytes and removed around 46 threats. At the moment my ESET anti virus doesn't detect much of those .exe as viruses and the ones he does are just either some setup files and some other uninstall files which I either clean or ignore because uninstall files always show some signs of infection. Even though I did a mistake in the cleaning process and now I've lost all my files in my documents but the vurus looks to be gone. I cannot thank you enough sir !! Much love and many blessings.



#10 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:45 AM

Posted 17 March 2017 - 10:15 PM

We're not quite done yet. Good news though.

I'd like to see that MBAM log first.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#11 Perfekt369

Perfekt369
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:15 PM

Posted 19 March 2017 - 06:01 PM

Hey I will have to run it again due to not saving the log. I ran another scan with my ESET smart security and still found 49 threats and only managed to remove 46(MalewareBytes de ja vu again) I think I'm beginning to see 3 primary threats and the rest just minors. I'm growing tired of this so I just need to ask you if there's a way I can reset my windows without getting rid of a few certain apps ? If not for 3 or 4 of programs installed I would've already done a reset by now (the reason is that those programs are large in file so downloading them would be impossible for me) I'll also be trying a KasperSky later and that's my last option. I just don't get it my pc isn't showing the classic signs of infection like high cpu usage and the pc being slowed down.



#12 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:45 AM

Posted 19 March 2017 - 08:43 PM

If you don't want to reset your computer please follow my previous reply.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#13 Perfekt369

Perfekt369
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:15 PM

Posted 20 March 2017 - 03:16 PM

Hi. So I did run another scan now with MalewareBytes and here's the result

 

Malwarebytes
www.malwarebytes.com
 
-Log Details-
Scan Date: 3/20/17
Scan Time: 10:29 PM
Logfile: soeda.txt
Administrator: Yes
 
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.75
Update Package Version: 1.0.1394
License: Trial
 
-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: PHOENIX\Phoenix
 
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 555159
Time Elapsed: 12 min, 50 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 0
(No malicious items detected)
 
Registry Value: 0
(No malicious items detected)
 
Registry Data: 1
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER|UPDATESDISABLENOTIFY, Replaced, [19618], [293296],1.0.1394
 
Data Stream: 0
(No malicious items detected)
 
Folder: 0
(No malicious items detected)
 
File: 0
(No malicious items detected)
 
Physical Sector: 0
(No malicious items detected)
 
 
(end)
 
Afterwards I did a threat scan(in the scan section of MalewareBytes) and this is the result
 
Malwarebytes
www.malwarebytes.com
 
-Log Details-
Scan Date: 3/20/17
Scan Time: 10:51 PM
Logfile: afterScnNo.txt
Administrator: Yes
 
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.75
Update Package Version: 1.0.1394
License: Trial
 
-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: PHOENIX\Phoenix
 
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 555185
Time Elapsed: 6 min, 36 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 0
(No malicious items detected)
 
Registry Value: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Data Stream: 0
(No malicious items detected)
 
Folder: 0
(No malicious items detected)
 
File: 0
(No malicious items detected)
 
Physical Sector: 0
(No malicious items detected)
 
 
(end)
 
Side note: I did do a scan with ESET smart security earlier(before the malewareBytes scan) and all though it was interrupted because I accidentally stopped it but here are the results
 
Log
Scan Log
Version of virus signature database: 15049 (20170307)
Date: 3/20/2017  Time: 2:09:01 AM
Scanned disks, folders and files: Operating memory;C:\Boot sector;E:\Boot sector;F:\Boot sector;C:\;E:\;F:\
Boot sector of disk C: - error opening [4]
Boot sector of disk E: - error opening [4]
Boot sector of disk F: - error opening [4]
C:\$WINDOWS.~BT\Sources\Panther\diagerr.xml - error opening [4]
C:\$WINDOWS.~BT\Sources\Panther\diagwrn.xml - error opening [4]
C:\$WINDOWS.~BT\Sources\Panther\setupact.log - error opening [4]
C:\$WINDOWS.~BT\Sources\Panther\setuperr.log - error opening [4]
C:\$WINDOWS.~BT\Sources\Panther\windlp.state-old.xml - error opening [4]
C:\$WINDOWS.~BT\Sources\Panther\windlp.state.xml - error opening [4]
C:\hiberfil.sys - error opening [4]
C:\pagefile.sys - error opening [4]
C:\Program Files\Common Files\Adobe\dynamiclinkmediaserver\7.0\32\Adobe QT32 Server.exe - Win32/Sality.NBA virus - error while cleaning
C:\Program Files\Common Files\Adobe\dynamiclinkmediaserver\7.0\32\ImporterREDServer.exe - Win32/Sality.NBA virus - error while cleaning
C:\Program Files\NVIDIA Corporation\Installer2\DISPLAY.DRIVER.{6B5F6E56-D395-4F72-A698-C47B3A2F35EA}\NvContainerSetup.exe ¯ 7ZSD - is OK
C:\Program Files (x86)\Hotspot Shield\config\ptm.cfg - error opening [4]
C:\Program Files (x86)\Hotspot Shield\HssWPR\wpr.conf - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\21ab292c5869721d3eac5a71f92ff348_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\245ae702d641d71fd312a7ccecb4e73a_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2aa6b266c4ce8bceb38621b9c91cb1e0_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3d7c5b2d652ca38bc865cf824627c92e_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\535b351356431e5819771f3286da9180_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6c1327c7bb0b3d857e9f836ffe0ef65f_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\879e1bc43b05ca9fe17057ff21eb0ab5_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b885473d400108ae49e5eb4578ea94d5_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e0d56a45c291a491a96df63b4ae26b6e_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e8069c15a6a4cbd2b85bba18bb7d9faa_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\ProgramData\Microsoft\User Account Pictures\Administrator.dat - error opening [4]
C:\ProgramData\Microsoft\User Account Pictures\defaultuser0.dat - error opening [4]
C:\ProgramData\Microsoft\User Account Pictures\Games.dat - error opening [4]
C:\ProgramData\Microsoft\User Account Pictures\PhoenixX.dat - error opening [4]
C:\ProgramData\Microsoft\User Account Pictures\Semag.dat - error opening [4]
C:\swapfile.sys - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\21ab292c5869721d3eac5a71f92ff348_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\245ae702d641d71fd312a7ccecb4e73a_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\2aa6b266c4ce8bceb38621b9c91cb1e0_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\3d7c5b2d652ca38bc865cf824627c92e_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\535b351356431e5819771f3286da9180_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\6c1327c7bb0b3d857e9f836ffe0ef65f_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\879e1bc43b05ca9fe17057ff21eb0ab5_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\b885473d400108ae49e5eb4578ea94d5_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\e0d56a45c291a491a96df63b4ae26b6e_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\e8069c15a6a4cbd2b85bba18bb7d9faa_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_a2f578b4-cad9-44b9-b2e4-7af3cd1a688e - error opening [4]
C:\Users\All Users\Microsoft\User Account Pictures\Administrator.dat - error opening [4]
C:\Users\All Users\Microsoft\User Account Pictures\defaultuser0.dat - error opening [4]
C:\Users\All Users\Microsoft\User Account Pictures\Games.dat - error opening [4]
C:\Users\All Users\Microsoft\User Account Pictures\PhoenixX.dat - error opening [4]
C:\Users\All Users\Microsoft\User Account Pictures\Semag.dat - error opening [4]
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\0KO6W34W\vpaid-ssp-vast[1].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\0KO6W34W\vpaid-ssp-vast[2].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\0KO6W34W\vpaid-ssp-vastC3LZEQM1.swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\0KO6W34W\vpaid-ssp-vastH69RRCNU.swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\0KO6W34W\vpaid-ssp-vastLR03AZ7C.swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\33A027HU\vpaid-shim[1].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\33A027HU\vpaid-ssp-vast[3].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\S6RKQQH5\adsapi_video_only[1].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\S6RKQQH5\vpaid-shim[1].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\X0NSUJMM\AdOS_2016_09_12_16_31[1].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\X0NSUJMM\vpaid-shim[2].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\X0NSUJMM\vpaid-ssp-vast[2].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\X0NSUJMM\vpaid-ssp-vast[3].swf ¯ CWS ¯ file.swf - unpack error
C:\Users\user\AppData\Local\Temp\WER-1002265-0.sysdata.xml - error opening [4]
C:\Users\user\AppData\Local\Temp\WER-1002375-1.sysdata.xml - error opening [4]
C:\Users\user\AppData\Local\Temp\WER-383261187-0.sysdata.xml - error opening [4]
C:\Users\user\AppData\Local\Temp\WER-383261312-1.sysdata.xml - error opening [4]
C:\Users\user\AppData\Local\Temp\WER-9390546-0.sysdata.xml - error opening [4]
C:\Users\user\Desktop\Programz\(1)New folder (2)\The Lost Art Of The Victim\Every Project\hate exprteed_data\WebFreer_Setup_1.0.3.504\WebFreer_Setup_1.0.3.504\WebFreer_Setup_1.0.3.504.exe ¯ NSIS ¯ webfreer.exe - is OK
C:\Users\user\Desktop\Tra\soft1\ACDSee Pro 9.1.453 (32-bit)\Setup.exe ¯ RAR ¯ program files\ACD Systems\ACDSee Pro\9.0\acdsee.pro.9.0.[32-64bit].unipatch-patch.exe - is OK
C:\Users\user\Desktop\Tra\soft1\Babylon 10.5.0.6\Setup.exe ¯ RAR ¯ Babylon\Babylon-Pro\Utils\BabylonRPI.api - is OK
C:\Users\user\Desktop\Tra\soft1\KMSpico\JB-Activator.exe ¯ INNO ¯ {app}\AutoPico.exe - is OK
C:\Users\user\Desktop\Tra\soft1\KMSpico\JB-Activator.exe ¯ INNO ¯ {app}\KMSELDI.exe - is OK
C:\Users\user\Desktop\Tra\soft1\KMSpico\JB-Activator.exe ¯ INNO ¯ {app}\Service_KMS.exe - is OK
C:\Users\user\Desktop\Tra\soft1\Office Professional Plus 2010\Crack\Method (1)\Activator.exe ¯ SMARTINSTALLMAKER ¯ @$&%04\hidcon.exe - is OK
C:\Users\user\Desktop\Tra\soft1\Office Professional Plus 2010\Crack\Method (1)\Activator.exe ¯ SMARTINSTALLMAKER ¯ @$&%04\KMService.exe - is OK
C:\Users\user\Desktop\Tra\soft1\WebcamMax 7.5.2.6\WebCamMax.exe ¯ NSIS ¯ ApnStub.exe - is OK
C:\Users\user\Desktop\Tra\soft1\WebcamMax 7.5.2.6\WebCamMax.exe ¯ NSIS ¯ ApnIC.dll - is OK
C:\Users\user\Desktop\Tra\soft1\WebcamMax 7.5.2.6\WebCamMax.exe ¯ NSIS ¯ ApnToolbarInstaller.exe - is OK
C:\Users\user\Desktop\Tra\soft1\Windows 10 Activator\Setup.exe ¯ SMARTASSEMBLY ¯ deobfuscated.exe - is OK
Scan terminated by user.
Number of scanned objects: 203586
Number of threats found: 3
Number of cleaned objects: 0
Time of completion: 2:31:44 AM  Total scanning time: 1363 sec (00:22:43)
 
Notes:
[4] Object cannot be opened. It may be in use by another application or operating system.
 

Also the malewareBytes scans didn't took very long which was weird knowing how much time they took before



#14 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:45 AM

Posted 20 March 2017 - 08:59 PM

There was not much to remove this time.

 

p22002970.gif Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

p22002970.gif Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • The tool will start to update the database if one is required.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Logfile button.
  • A window will open which lists the logs of your scans.
  • Click on the Scan tab.
  • Double-click the most recent scan which will be at the top of the list....the log will appear.
  • Review the results...see note below
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[CX].txt) will open automatically (where the largest value of X represents the most recent report).
  • To open a Cleaning log, launch AdwareClearer, click on the Logfile button, click on the Cleaning tab and double-click the log at the top of the list.
  • Copy and paste the contents of AdwCleaner[CX].txt in your next reply.
  • A copy of all logfiles are saved to C:\AdwCleaner.


-- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name or entry that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on and uncheck any items you want to keep.


p22002970.gif Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.


p22002970.gif Download Sophos Free Virus Removal Tool and save it to your desktop.
  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#15 Perfekt369

Perfekt369
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:03:15 PM

Posted 01 April 2017 - 06:12 AM

Hi. So sorry for the late reply I had trouble with the internet connection. Here are the results.

 

AdwCleaner Results
 
# AdwCleaner v6.045 - Logfile created 01/04/2017 at 11:01:50
# Updated on 28/03/2017 by Malwarebytes
# Database : 2017-03-31.1 [Server]
# Operating System : Windows 10 Pro  (X64)
# Username : Phoenix - PHOENIX
# Running from : C:\Users\user\Desktop\AdwCleaner.exe
# Mode: Clean
 
 
 
***** [ Services ] *****
 
 
 
***** [ Folders ] *****
 
[-] Folder deleted: C:\Program Files\DriverSetupUtility
[-] Folder deleted: C:\ProgramData\DriverSetupUtility
[#] Folder deleted on reboot: C:\ProgramData\Application Data\DriverSetupUtility
[-] Folder deleted: C:\Users\Public\Documents\iWin
 
 
***** [ Files ] *****
 
[-] File deleted: C:\Users\user\AppData\Roaming\Installer.dat
[-] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage
[-] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage-journal
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage-journal
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage-journal
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage-journal
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage-journal
[#] File deleted: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cyberghost-vpn.en.softonic.com_0.localstorage-journal
 
 
***** [ DLL ] *****
 
 
 
***** [ WMI ] *****
 
 
 
***** [ Shortcuts ] *****
 
 
 
***** [ Scheduled Tasks ] *****
 
[-] Task deleted: Software Update Application
 
 
***** [ Registry ] *****
 
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{730E03E4-350E-48E5-9D3E-4329903D454D}
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}
[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\Features\4E30E037E0535E84D9E3349209D354D4
[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\Features\A38C15B2D5649AE4C9CDE19DE50DA96C
[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\Products\4E30E037E0535E84D9E3349209D354D4
[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\Products\A38C15B2D5649AE4C9CDE19DE50DA96C
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4E30E037E0535E84D9E3349209D354D4
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A38C15B2D5649AE4C9CDE19DE50DA96C
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4E30E037E0535E84D9E3349209D354D4
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A38C15B2D5649AE4C9CDE19DE50DA96C
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\Features\4E30E037E0535E84D9E3349209D354D4
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\Features\A38C15B2D5649AE4C9CDE19DE50DA96C
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\Products\4E30E037E0535E84D9E3349209D354D4
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\Products\A38C15B2D5649AE4C9CDE19DE50DA96C
[-] Value deleted: HKU\S-1-5-21-3257942847-849358695-2632698190-1001\Software\Microsoft\Windows\CurrentVersion\Run [Itibiti.exe]
[-] Value deleted: HKU\S-1-5-21-3257942847-849358695-2632698190-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [Itibiti.exe]
[#] Value deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Itibiti.exe]
[#] Value deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Itibiti.exe]
 
 
***** [ Web browsers ] *****
 
 
 
*************************
 
:: "Tracing" keys deleted
:: Winsock settings cleared
 
*************************
 
C:\AdwCleaner\AdwCleaner[C0].txt - [5031 Bytes] - [01/04/2017 11:01:50]
C:\AdwCleaner\AdwCleaner[S0].txt - [5068 Bytes] - [01/04/2017 10:47:01]
 
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [5177 Bytes] ##########
 
 
JRT Results
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.2 (03.10.2017)
Operating System: Windows 10 Pro x64 
Ran by Phoenix (Administrator) on Sat 04/01/2017 at 11:10:58.86
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
File System: 4 
 
Successfully deleted: C:\ProgramData\alawarwrapper (Folder) 
Successfully deleted: C:\Users\Public\Desktop\hotspot shield.lnk (Shortcut) 
Successfully deleted: C:\users\Public\Documents\alawarwrapper (Folder) 
Successfully deleted: C:\Users\user\AppData\Roaming\imvuclient (Folder) 
 
 
 
Registry: 0 
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 04/01/2017 at 11:12:19.77
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
I'm still trying to get Sophos but I think the link is broken or locked because I had to access it using a vpn and it still doesn't download it properly says it's corrupted and stuff.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users