Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I scanned with Hijackthis but need help


  • This topic is locked This topic is locked
58 replies to this topic

#1 dali52

dali52

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 10 February 2017 - 03:47 AM

Hello, I hope this is the right place to post the results of the hijackthis scan.  If not, please let me know so I will post them in the correct place.

I Have windows 10 (switched from windows 7) and I keep getting this notice that says"one click starter started in compatibility mode".  I have done some reading and it seems that it is due to tune up utilities.  I have deleted this program, or at least I thought so, therefore I don't know where to look for it now.

Someone suggested I scan with hijackthis, and I have. I looked in the scan, and I did not see it, but I could be wrong because the notepad report says this

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\TuneUp Utilities 2011\OneClickStarter.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
If this is the right place to post the scan results, please let me know, and I will post them.
 If you have any other advice I would appreciate your help very much.
Thank you very much


BC AdBot (Login to Remove)

 


#2 garioch7

garioch7

    RCMP Veteran


  • Malware Response Instructor
  • 3,894 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Port Hood, Nova Scotia, Canada
  • Local time:06:17 AM

Posted 10 February 2017 - 06:07 AM

dali52:
 
:welcome: to the Bleeping Computer Virus, Trojans, Spyware, and Malware Removal Logs Forum.  My name is Phil and  I would like to address you by your first name, if that is alright with you since we will be working together.
 
I will be assisting you with your computer issues.  I will endeavor to respond within a reasonable time, normally 48 hours after your last post.
 
Please review this posted topic and follow the instructions to run a FRST scan (Step :step6:).  Please copy and paste both the "FRST.txt" log and the "Addition.txt" log into your reply.  If your logs are large, you may have to copy and paste one log into one reply and the remaining into another reply.
 
I will need some time to review your FRST logs once you have submitted them.  That could take a day or two.
 
PLEASE DO NOT RUN ANY ADDITIONAL SCANS OR ANTI-MALWARE REMOVAL TOOLS UNTIL YOU HAVE RECEIVED A RESPONSE FROM ME.
Doing so would complicate the situation and it would cause further delays in resolving your issues.  It could also potentially result in harm to your computer because my "fix" will be based on the FRST scan logs you have already submitted.
 
Thank you and have a great day.
 
Regards,
-Phil

Graduate of the Bleeping Computer Malware Removal Study Hall


#3 dali52

dali52
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 10 February 2017 - 12:45 PM

Hello Phil,
Thank you very much for your answer.  Unfortunately I did run spybot last night as I could not sleep (coughing problems) and I guess had nothing better to do.  Sorry.
So here is the new hijackthis report.  It looks the same to me, but I could not swear to it.
I hope I did not mess up your evaluation. 
Thank you very much for your help.
Dalila
 
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 9:41:50 AM, on 2/10/2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Unable to get Internet Explorer version!
 
 
Boot mode: Normal
 
Running processes:
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\TuneUp Utilities 2011\OneClickStarter.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\dalila\Downloads\HijackThis.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O4 - HKLM\..\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
O4 - HKLM\..\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
O4 - HKLM\..\Run: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
O4 - HKLM\..\Run: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [OneDrive] "C:\Users\dalila\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - Startup: Dropbox.lnk = dali\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: File-Extensions.org Search.lnk = C:\Program Files (x86)\File Extensions\File-Extensions.org-Search.exe
O4 - Global Startup: Install LastPass FF RunOnce.lnk = C:\Program Files (x86)\Common Files\lpuninstall.exe
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Program Files\IDT\WDM\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Wireless Bluetooth® + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrYNSvc - Brother Industries, Ltd. - C:\Program Files (x86)\Browny02\BrYNSvc.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: CyberGhost 6 Service (CG6Service) - CyberGhost S.R.L - C:\Program Files\CyberGhost 6\CyberGhost.Service.exe
O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Bitdefender Antivirus Free Edition (gzserv) - Bitdefender - C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @mqutil.dll,-6102 (MSMQ) - Unknown owner - C:\WINDOWS\system32\mqsvc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Dell DataSafe Online (NOBU) - Dell, Inc. - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10101 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: TunnelBear Maintenance (TunnelBearMaintenance) - Unknown owner - C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe
O23 - Service: Intel® Turbo Boost Technology Monitor 2.0 (TurboBoost) - Intel® Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
 
--
End of file - 13373 bytes


#4 garioch7

garioch7

    RCMP Veteran


  • Malware Response Instructor
  • 3,894 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Port Hood, Nova Scotia, Canada
  • Local time:06:17 AM

Posted 10 February 2017 - 02:04 PM

Dalila:

 

Thank you for your post.  HijackThis is no longer used by the vast majority of Malware Removal Specialists, and it hasn't been for years.  It is out-of-date.  The Farbar Recovery and Scan Tool (FRST) is a far more powerful anti-malware scanning and cleaning tool.  You can review this link for further information about HijackThis.  Please pay close attention to the "Note" on that page.  HijackThis is not Windows 10-compatible and will therefore generate erroneous information and also it will not provide necessary information to identify all of the infections that might be present on your computer.

 

 

Please review this posted topic and follow the instructions to run a FRST scan (Step  :step6:).  Please copy and paste both the "FRST.txt" log and the "Addition.txt" log into your reply.  If your logs are large, you may have to copy and paste one log into one reply and the remaining into another reply.

 

 

Please provide the requested FRST logs.  Please copy and paste the contents of both FRST.txt and Addition.txt scan files into your next reply/replies (if your logs are lengthy you may need to split them up into two or more replies).  I prefer that you copy and paste the contents of all log files that I request.  It makes it much faster for me to analyze the logs.

 

Once I receive your FRST logs, it will take a day or two to analyze them.  In fact, I have to be away for a good part of the day tomorrow assisting a non-profit organization, in the town where I live, with their computer issues, so it will probably be Sunday before I can reply.  I had been hoping that you would have posted the FRST logs right away this morning, because I did have time earlier today to undertake the analysis of your logs.  I have other commitments for the remainder of today, unfortunately.  "Real life" takes away from the time that I would like to be able to spend eradicating malware. :(

 

Once we can get started on the disinfection process, then I will normally respond within 24 hours of your last post.  To start that process, I need to see your FRST logs and then we can go from there and hopefully resolve any possible malware issues you might have.  I will also assist with removing the tune-up utility, the use of which is not recommended here at Bleeping Computer.  Please see this topic by Quietman7, one of our foremost computer security experts, on the subject of registry cleaners, optimizers, tune-up utilities, driver updaters, etc.

 

Thank you for anticipated cooperation.  Have a great day.

 

Regards,

-Phil


Graduate of the Bleeping Computer Malware Removal Study Hall


#5 garioch7

garioch7

    RCMP Veteran


  • Malware Response Instructor
  • 3,894 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Port Hood, Nova Scotia, Canada
  • Local time:06:17 AM

Posted 13 February 2017 - 01:19 PM

Dalila:

 
Are you still there?  Do you still require assistance?  It has been three days since I last posted to you.
 
According to Forum policy, topics must be concluded after five days of non-response from the Topic Starter.
 
If I have not heard from you in another two days, I will conclude your topic.  You can always reopen it by sending a Personal Message to a Moderator.
 
Thank you and have a great day.
 
Regards,
-Phil

Graduate of the Bleeping Computer Malware Removal Study Hall


#6 dali52

dali52
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 14 February 2017 - 12:02 AM

Hello Phil,

Sorry for the delay. I was gone for a couple of days.  I downloaded the program you told me about and scanned the computer.  Just to refresh the issue, I keep getting this notice that one click starter program started in compatibility mode and as this can lead to undesirable effects I should disable the compatibility settings. I read that this might be due to Tune up Utilities, which I had with windows 7 and then I deleted (or thought I did) with uninstall program. Ok here are the results.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-02-2017
Ran by dalila (administrator) on DALILAPC (13-02-2017 20:49:51)
Running from C:\Users\dalila\Downloads
Loaded Profiles: dalila (Available Profiles: dali & dalila)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Digidy, s.r.o.) C:\Program Files (x86)\File Extensions\File-Extensions.org-Search.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoUpdateCheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 6\CyberGhost.Service.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Trend Micro Inc.) C:\Users\dalila\Downloads\HijackThis.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.6.2.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
 
==================== Registry (Whitelisted) ====================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [GwxControlPanelMonitor] => C:\Users\dali\Downloads\GWX_control_panel.exe [4596296 2016-05-23] (UltimateOutsider)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [418672 2011-06-22] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [202608 2011-06-22] (Egis Technology Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139776 2014-06-16] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4513792 2014-05-22] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\File-Extensions.org Search.lnk [2016-03-25]
ShortcutTarget: File-Extensions.org Search.lnk -> C:\Program Files (x86)\File Extensions\File-Extensions.org-Search.exe (Digidy, s.r.o.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk [2013-06-09]
ShortcutTarget: Install LastPass FF RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)
Startup: C:\Users\dalila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-03]
ShortcutTarget: Dropbox.lnk -> C:\Users\dali\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2f0fd8b6-a45b-4754-9e86-bc9fa10f39bb}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{74ab9aef-785f-4fa8-ab26-d9b72c64578d}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{cc5a58f2-8aff-4f12-a673-263a55bb8f23}: [DhcpNameServer] 192.168.0.1
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKLM-x32 -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1794967967-372989994-3207961994-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-06] (Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-06] (Oracle Corporation)
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-19] ()
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-06] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-06] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-19] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-19] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @hola.org/FlashPlayer -> C:\Users\dali\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll [2016-04-06] ()
FF Plugin HKU\.DEFAULT: @hola.org/vlc -> C:\Users\dali\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll [2016-04-06] (Hola)
FF Plugin HKU\S-1-5-21-1794967967-372989994-3207961994-1003: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10171.dll [No File]
 
Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.npr.org/
CHR StartupUrls: Default -> "hxxps://mail.google.com/mail/u/0/#inbox","hxxp://www.npr.org/","hxxps://mail.google.com/","hxxp://slickdeals.net/"
CHR DefaultSearchKeyword: Default -> lp
CHR Profile: C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default [2017-02-13]
CHR Extension: (Google Docs) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Drive) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-30]
CHR Extension: (WOT: Web of Trust, Website Reputation Ratings) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2017-02-09]
CHR Extension: (YouTube) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-30]
CHR Extension: (Adblock Plus) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-01-10]
CHR Extension: (Google Search) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]
CHR Extension: (WOT Safe Search) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\ddcihbboebboehpkkdfdkhbodacmmfkk [2014-01-03]
CHR Extension: (Spotflux Lite) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcakbkpmlidimpglgiaclbpgbedlmpfl [2017-01-11]
CHR Extension: (After the Deadline) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcdjadjbdihbaodagojiomdljhjhjfho [2017-01-11]
CHR Extension: (Google Docs Offline) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-10]
CHR Extension: (AdBlock) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-02-09]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2017-02-09]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2017-02-09]
CHR Extension: (Google Keep - notes and lists) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2017-02-13]
CHR Extension: (Dropbox) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl [2015-11-01]
CHR Extension: (Bananatag Email Tracking) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpbnpbfpgjkblmejlgkfkekajajhjcid [2017-01-11]
CHR Extension: (Scriffon) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpcogdkjlajlgojgnjaiojdfepaakkea [2014-01-03]
CHR Extension: (Skype) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-01-10]
CHR Extension: (Google Mail Checker) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2014-01-03]
CHR Extension: (Ghostery) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2017-02-13]
CHR Extension: (LastPass Vault) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncliohomlfopnmlfkepkcbnhmeijkhhf [2014-01-03]
CHR Extension: (Chrome Web Store Payments) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (HubSpot Sales) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd [2017-01-19]
CHR Extension: (Click&Clean App) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp [2017-01-11]
CHR Extension: (Evernote Web Clipper) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2017-02-09]
CHR Extension: (Gmail) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-01]
CHR Extension: (Chrome Media Router) - C:\Users\dalila\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-10]
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - C:\Program Files (x86)\LastPass\lpchrome.crx [2013-06-09]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-08-14]
StartMenuInternet: Google Chrome.DCLINJAJ2IOAYA6N7KTGQFNCWM - E:\GoogleChromePortable\App\Chrome-bin\chrome.exe
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S2 Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [921664 2011-05-18] (Intel Corporation) [File not signed]
S3 Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [1335360 2011-05-18] (Intel Corporation) [File not signed]
S2 Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [995392 2011-05-18] (Intel Corporation) [File not signed]
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
R2 CG6Service; C:\Program Files\CyberGhost 6\CyberGhost.Service.exe [76848 2017-02-06] (CyberGhost S.R.L)
R2 gzserv; C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [79552 2016-03-25] (Bitdefender)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-11-20] ()
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S4 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1225312 2012-11-26] (Secunia)
S4 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [659040 2012-11-26] (Secunia)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2028864 2011-12-08] (TuneUp Software)
R2 TunnelBearMaintenance; C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe [39424 2016-02-10] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2013-11-20] (Intel® Corporation)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R0 avc3; C:\WINDOWS\System32\DRIVERS\avc3.sys [718840 2013-04-17] (BitDefender)
S3 avckf; C:\WINDOWS\System32\DRIVERS\avckf.sys [593144 2013-04-17] (BitDefender)
S1 bdfwfpf; C:\Program Files\Bitdefender\Antivirus Free Edition\bdfwfpf.sys [121928 2013-07-02] (Bitdefender SRL)
R1 ElRawDisk; C:\windows\system32\drivers\rsdrvx64.sys [26024 2009-02-12] (EldoS Corporation)
R1 gzflt; C:\WINDOWS\System32\DRIVERS\gzflt.sys [148696 2013-04-22] (BitDefender LLC)
S3 HTCAND64; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [33736 2009-11-02] (HTC, Corporation) [File not signed]
R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [176064 2017-01-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [250816 2017-02-09] (Malwarebytes)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 RimVSerPort; C:\WINDOWS\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 SWDUMon; C:\WINDOWS\system32\DRIVERS\SWDUMon.sys [13920 2017-01-10] ()
R3 tap-tb-0901; C:\WINDOWS\System32\drivers\tap-tb-0901.sys [38656 2015-08-10] (The OpenVPN Project)
R3 tilfilter; C:\WINDOWS\System32\drivers\TIxHCIlfilter.sys [34424 2016-08-20] (Texas Instruments, Inc.)
R3 tiufilter; C:\WINDOWS\System32\drivers\TIxHCIufilter.sys [39032 2016-08-20] (Texas Instruments, Inc.)
R0 trufos; C:\WINDOWS\System32\DRIVERS\trufos.sys [382536 2013-05-28] (BitDefender S.R.L.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [11856 2010-10-07] (TuneUp Software)
S3 USBAAPL64; C:\WINDOWS\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 idsvc; no ImagePath
U4 wpcsvc; no ImagePath
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-02-13 20:49 - 2017-02-13 20:50 - 00026233 _____ C:\Users\dalila\Downloads\FRST.txt
2017-02-13 20:48 - 2017-02-13 20:49 - 00000000 ____D C:\FRST
2017-02-13 20:46 - 2017-02-13 20:48 - 02422272 _____ (Farbar) C:\Users\dalila\Downloads\FRST64.exe
2017-02-10 01:40 - 2016-07-29 18:15 - 00452309 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20170210-014029.backup
2017-02-10 01:01 - 2016-12-20 23:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-02-10 01:01 - 2016-12-20 20:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-02-10 00:20 - 2017-02-10 00:21 - 00388608 _____ (Trend Micro Inc.) C:\Users\dalila\Downloads\HijackThis.exe
2017-01-19 17:13 - 2017-01-19 17:13 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2017-01-19 16:07 - 2017-01-19 16:12 - 00000000 ____D C:\Users\TEMP.DALILAPC\AppData\Local\Packages
2017-01-19 16:06 - 2017-01-19 16:12 - 00000000 ____D C:\Users\TEMP.DALILAPC
2017-01-19 16:03 - 2017-01-19 16:06 - 00000000 ____D C:\Users\TEMP\AppData\Local\Packages
2017-01-19 16:02 - 2017-01-19 16:06 - 00000000 ____D C:\Users\TEMP
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-02-13 20:45 - 2016-07-16 03:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-13 20:45 - 2016-07-16 03:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-13 20:44 - 2016-12-19 23:47 - 01367672 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-13 20:40 - 2016-12-19 23:40 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-10 01:26 - 2016-07-16 03:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-02-10 00:21 - 2014-01-03 19:52 - 00000000 ____D C:\Users\dalila\AppData\Local\VirtualStore
2017-02-09 23:31 - 2017-01-10 13:55 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-02-09 23:31 - 2014-08-16 12:45 - 00250816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-02-09 23:26 - 2013-05-17 19:11 - 00002274 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-01-19 21:46 - 2017-01-10 13:55 - 00102856 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-01-19 21:46 - 2017-01-10 13:55 - 00091584 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-01-19 21:45 - 2016-12-19 23:47 - 00000000 ____D C:\Users\dalila
2017-01-19 21:45 - 2011-11-19 02:25 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2017-01-19 21:44 - 2016-12-20 00:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-01-19 21:43 - 2016-07-15 22:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-01-19 18:58 - 2017-01-10 13:54 - 00077408 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-01-19 17:13 - 2016-07-16 03:45 - 00000000 ____D C:\WINDOWS\INF
2017-01-19 17:07 - 2016-12-19 23:33 - 00000000 ____D C:\WINDOWS\system32\msmq
2017-01-19 16:57 - 2016-03-25 16:50 - 00000000 ____D C:\Program Files (x86)\TunnelBear
2017-01-19 16:22 - 2016-12-19 23:56 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2017-01-19 16:22 - 2016-12-19 23:56 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2017-01-19 16:21 - 2016-12-19 23:47 - 00000000 ____D C:\Users\dali
2017-01-19 16:16 - 2016-12-20 06:09 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-19 16:16 - 2015-02-10 11:19 - 00000000 ___RD C:\Users\dali\Podcasts
2017-01-19 16:12 - 2016-07-16 03:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-01-15 16:28 - 2016-07-16 03:47 - 00000000 ____D C:\WINDOWS\rescache
2017-01-15 15:45 - 2014-02-02 13:40 - 00000000 ____D C:\Users\dalila\AppData\Local\ElevatedDiagnostics
 
==================== Files in the root of some directories =======
 
2013-06-09 14:48 - 2013-06-09 14:48 - 14880256 _____ (LastPass) C:\Program Files (x86)\Common Files\lpuninstall.exe
2014-04-16 18:07 - 2015-03-07 23:53 - 0099384 _____ () C:\Users\dalila\AppData\Roaming\inst.exe
2014-04-16 18:07 - 2015-03-07 23:53 - 0007859 _____ () C:\Users\dalila\AppData\Roaming\pcouffin.cat
2014-04-16 18:07 - 2015-03-07 23:53 - 0001167 _____ () C:\Users\dalila\AppData\Roaming\pcouffin.inf
2014-04-16 18:07 - 2015-03-07 23:53 - 0000033 _____ () C:\Users\dalila\AppData\Roaming\pcouffin.log
2014-04-16 18:07 - 2015-03-07 23:53 - 0082816 _____ (VSO Software) C:\Users\dalila\AppData\Roaming\pcouffin.sys
2016-03-25 15:52 - 2016-03-25 15:52 - 0045406 _____ () C:\ProgramData\1458949937.bdinstall.bin
2016-03-25 15:54 - 2016-03-25 15:56 - 0041726 _____ () C:\ProgramData\1458950094.3696.bin
2016-03-25 15:54 - 2016-03-25 15:55 - 0002049 _____ () C:\ProgramData\1458950094.5656.bin
2016-03-25 16:11 - 2016-03-25 16:11 - 0204457 _____ () C:\ProgramData\1458950818.bdinstall.bin
2012-02-04 12:20 - 2015-01-21 09:52 - 0000945 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2012-08-04 20:35 - 2012-08-04 20:35 - 0001534 _____ () C:\ProgramData\ss.ini
 
Some files in TEMP:
====================
2017-01-19 16:17 - 2017-01-19 16:17 - 0000000 _____ () C:\Users\dali\AppData\Local\Temp\cnkdbcvn.dll
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2017-02-09 23:29
 
==================== End of FRST.txt ============================
 
addition notepad
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-02-2017
Ran by dalila (13-02-2017 20:51:19)
Running from C:\Users\dalila\Downloads
Windows 10 Home Version 1607 (X64) (2016-12-20 14:08:48)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1794967967-372989994-3207961994-500 - Administrator - Disabled)
dali (S-1-5-21-1794967967-372989994-3207961994-1000 - Administrator - Enabled) => C:\Users\dali
dalila (S-1-5-21-1794967967-372989994-3207961994-1003 - Administrator - Enabled) => C:\Users\dalila
DefaultAccount (S-1-5-21-1794967967-372989994-3207961994-503 - Limited - Disabled)
Guest (S-1-5-21-1794967967-372989994-3207961994-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1794967967-372989994-3207961994-1002 - Limited - Enabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Bitdefender Antivirus Free Edition (Enabled - Up to date) {3FB17364-4FCC-0FA7-6BBF-973897395371}
AS: Bitdefender Antivirus Free Edition (Enabled - Up to date) {84D09280-69F6-0029-510F-AC4AECBE19CC}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Accidental Damage Services Agreement (HKLM-x32\...\{EF85FEF4-EB92-4075-A6D2-5F519BB30A2C}) (Version: 2.0.0 - Dell Inc.)
adbLink version 2.04 (HKLM-x32\...\{284C09DA-1752-4856-BE41-52D34D3DBD11}_is1) (Version: 2.04 - jocala.com)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.7.0.1860 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo Burning Studio FREE v.1.14.5 (HKLM-x32\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG)
Banctec Service Agreement (HKLM-x32\...\{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}) (Version: 2.0.0 - Dell Inc.)
Bitdefender Antivirus Free Edition (HKLM\...\BitDefender Gonzales) (Version: 1.0.21.1109 - Bitdefender)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite HL-L2380DW series (HKLM-x32\...\{F8ECC2FD-CE2B-4ED4-BDCC-90D0D34206FD}) (Version: 1.0.2.0 - Brother Industries, Ltd.)
Brother MFL-Pro Suite MFC-7440N (HKLM-x32\...\{46E1B1F2-A279-4356-9B17-029F9CC72EAE}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Complete Care Business Service Agreement (HKLM-x32\...\{0ECFCB07-9BFE-4970-ACA1-D568D982760B}) (Version: 2.0.0 - Dell Inc.)
Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
CyberGhost 6 (HKLM\...\CyberGhost 6_is1) (Version:  - CyberGhost S.R.L.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Data Lifeguard Diagnostic for Windows 1.22 (HKLM-x32\...\{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1) (Version:  - Western Digital Corporation)
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell)
Dell DataSafe Online (HKLM-x32\...\{7EC66A95-AC2D-4127-940B-0445A526AB2F}) (Version: 2.1.19634 - Dell)
Dell Digital Delivery (HKLM-x32\...\{0EEBAFB5-CB0F-4E1A-A33F-4ECAF15CE2F9}) (Version: 1.5.1249.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell Home Systems Service Agreement (HKLM-x32\...\{AB2FDE4F-6BED-4E9E-B676-3DCCEBB1FBFE}) (Version: 2.0.0 - Dell Inc.)
Dell MusicStage (HKLM-x32\...\{91AF2672-F5BC-42CF-8037-A9D2F92BBCC0}) (Version: 1.5.201.0 - Fingertapps)
Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)
Dell Stage (HKLM-x32\...\{39D06E77-8921-4056-8901-36D0035BAECA}) (Version: 1.5.420.0 - Fingertapps)
Dell Support Center (HKLM\...\PC-Doctor for Windows) (Version: 3.2.6032.125 - PC-Doctor, Inc.)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.218 - ALPS ELECTRIC CO., LTD.)
Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)
Dell VideoStage  (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.01.18 - Creative Technology Ltd)
DSmobile 600 (HKLM\...\{1BDEB6E2-6706-4132-A5D3-99190C6BECD8}) (Version: 1.2.10 - Brother)
dupeGuru (HKLM\...\{C11DACBD-8863-4AA4-94AD-708602F6F7EF}) (Version: 3.9.1 - Hardcoded Software)
dupeGuru Music Edition (HKLM\...\{C51BC104-8666-4F9C-8072-715AE1A69A75}) (Version: 6.8.1 - Hardcoded Software)
dupeGuru Picture Edition (HKLM\...\{C9A60D50-28B0-4BCB-B720-1ECACA351F09}) (Version: 2.10.1 - Hardcoded Software)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
File-Extensions.org Search (HKLM\...\File-Extensions.org Search) (Version:  - Digidy, s.r.o.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
gpedt.msc 1.0 (HKLM-x32\...\{10B9C608-BF7C-4CCF-A658-C01D969DCA21}_is1) (Version:  - Richard)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6324.0 - IDT)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Intel® PROSet/Wireless Software for Bluetooth® Technology (HKLM\...\{7CE8BE79-ABC3-4B2C-9543-28ED2B0A9EA8}) (Version: 1.2.0.0587 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Intel® Turbo Boost Technology Monitor 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)
Intel® WiDi (HKLM-x32\...\{781A93CD-1608-427D-B7F0-D05C07795B25}) (Version: 2.1.41.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{440d014b-4444-4533-b96d-2910e1ca2bcf}) (Version: 16.7.0 - Intel Corporation)
iTunes (HKLM\...\{6CF1A7E2-8001-4870-9F18-3C6CDD6FE9E3}) (Version: 12.2.1.16 - Apple Inc.)
Java 8 Update 40 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418040F0}) (Version: 8.0.400 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LastPass(uninstall only) (HKLM-x32\...\LastPass) (Version:  - LastPass)
LibreOffice 5.1.3.2 (HKLM-x32\...\{5F7475A1-6240-4753-BE3E-61499621EC42}) (Version: 5.1.3.2 - The Document Foundation)
LocK-A-FoLdeR (HKLM-x32\...\LocK-A-FoLdeR) (Version: 3.10.3 - )
Malwarebytes version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)
MediaMonkey 4.0 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.0 - Ventis Media Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microlife BPA 3.2.5A (x32 Version: 3.2.5A - Microlife) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\OneDriveSetup.exe) (Version: 17.3.6720.1207 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyWinLocker (Version: 4.0.14.29 - Egis Technology Inc.) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Premium Service Agreement (HKLM-x32\...\{C33AA6D6-F5EC-48F3-AFDC-8141345D473A}) (Version: 2.0.0 - Dell Inc.)
QualxServ Service Agreement (HKLM-x32\...\{903679E8-44C8-4C07-9600-05C92654FC50}) (Version: 2.0.0 - Dell Inc.)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.25 - Dell Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.31.1025.2010 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.52 - Piriform)
Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.) Hidden
Secunia PSI (3.0.0.6001) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.6001 - Secunia)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.11.13348 - Skype Technologies S.A.)
Skype™ 7.17 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.17.105 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SyncUP (HKLM-x32\...\{D92C9CCE-E5F0-4125-977A-0590F3225B74}) (Version: 10.2.15400 - Nero AG)
SyncUP (x32 Version: 1.12.11200.10.102 - Nero AG) Hidden
System Requirements Lab for Intel (HKLM-x32\...\{53C63F43-B827-42D9-8886-4698D91EA33B}) (Version: 4.5.15.0 - Husdawg, LLC)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{B1EB7FFF-6E44-43D8-869D-B78E44CD3E0F}) (Version: 1.12.14.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.14.0 - Texas Instruments Inc.) Hidden
TouchFreeze (HKLM-x32\...\{9C9744E5-2BB7-4042-BD1C-8A339480A08C}) (Version: 1.1.0 - Ivan Zhakov)
TuneUp Utilities Language Pack (en-US) (x32 Version: 10.0.4500.46 - TuneUp Software) Hidden
TunnelBear (HKLM-x32\...\{7094abcc-0311-45f4-aaac-638bf633a58a}) (Version: 2.3.22.0 - TunnelBear)
TunnelBear (x32 Version: 2.3.22.0 - TunnelBear) Hidden
VisiPics V1.31 (HKLM-x32\...\VisiPics_is1) (Version:  - Ozone)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Widevine Media Optimizer Chrome 6.0.0 (HKLM-x32\...\optimizer_chrome) (Version: 6.0.0.12442 - Widevine Technologies)
Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17364 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Zune (HKLM\...\Zune) (Version: 04.08.2345.00 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {027DDA30-AAA0-4A68-BA02-19A2B3546240} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {06007F15-6CE7-47FF-B9DD-EC951DE9C075} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {08863B0C-AC29-4ABB-9E89-9D0A9F301F27} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {08CA8A42-F022-4EB7-87FF-5AAB9A430B64} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {0B1BDAD8-EE71-4B42-BCD9-276264B90C31} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {10C7C403-6174-40B1-BD52-182831B5FC78} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {15780A7F-E682-45F4-8BD0-427A141841CF} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files (x86)\TuneUp Utilities 2011\OneClick.exe [2011-12-08] (TuneUp Software)
Task: {1663C97D-823A-4B6D-A170-63AEA9640A0E} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-02-10] (Oracle Corporation)
Task: {18F3EF1C-4BD8-4B45-AE20-CE21DDEB9D0C} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {1D8D0FD1-37AD-49AC-9742-835F619D89CF} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {1F6C73E5-D3AE-4423-815C-F0B20E285F9A} - System32\Tasks\{319D7BFF-4790-4358-9FE5-B94E463384AE} => pcalua.exe -a "C:\Program Files (x86)\Common Files\InstallShield\Driver\9\Intel 32\IDriver.exe"
Task: {1FC3CABC-012B-45B2-B51A-B460A4C7A7AC} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => %SystemRoot%\ehome\mcupdate.exe 
Task: {26DE0CC4-AC06-4BD3-8F22-41DA44092E0C} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe 
Task: {31A5243C-6B19-48D1-9106-8D52C7971ECA} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {3A145536-D5C6-481F-B865-B56DAEA21478} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {3D3A051E-336E-44B7-BD3F-2DD4F2252B4F} - System32\Tasks\GoogleUpdateTaskMachineUA1d12fccd00194da => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {3EEE50C6-6DDF-49BF-85AA-DD4EE063F0F5} - System32\Tasks\{2534B4AA-1A68-4957-A8EB-37F7B1B34831} => pcalua.exe -a "C:\Users\dali\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T9PHUWI5\adobe_plugin_install.exe" -d C:\Users\dali\Desktop
Task: {3F7C6768-90B5-4955-AC72-AC451A55BAF6} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {47CCFDF9-3A93-4455-B186-0D488C46D788} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {48D982CD-48B7-4673-9F08-7B7611FC3DA1} - System32\Tasks\Google Updater and Installer => C:\Users\dali\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {52BD6748-2A2D-405A-AA75-643C9FD9FB4D} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate.exe 
Task: {57B86CFF-899E-47D9-A857-C46DE785D7C9} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1794967967-372989994-3207961994-1000UA => C:\Users\dali\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-07-12] (Dropbox, Inc.)
Task: {59F8D8BF-7B8A-42AA-8B26-7131DC2296C2} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {5A0BE5C7-6262-4ABA-A727-950566CC10E6} - System32\Tasks\{D1469D85-8CD6-4970-AAB7-EDB562E7D1A6} => pcalua.exe -a C:\Users\dali\Downloads\clear_flash.exe -d C:\Users\dali\Downloads
Task: {662B25AE-A5B9-4568-83E9-CC72A45F17E3} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {6993FF9D-95D5-4C0B-80B9-1F44959CC054} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe 
Task: {6B442BCF-450F-4157-AD73-3EB48395EABE} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1794967967-372989994-3207961994-1000Core => C:\Users\dali\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-07-12] (Dropbox, Inc.)
Task: {6DD17A99-B852-427B-92E5-43BD02672783} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {7B263E48-193E-440F-AD2E-5FF89F761387} - System32\Tasks\{9E22D4D3-99FF-47ED-A565-9332EA5529F3} => C:\Users\dali\Downloads\DISH_Anywhere_Video_Player_Installer_2.7.1.exe 
Task: {7E2E7575-9830-4994-B036-8EDE2BE5ABB7} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => %SystemRoot%\ehome\ehrec.exe 
Task: {87C0A03B-605B-456A-870C-22F7332C3933} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {8D70244D-891F-451C-B82A-A1484A020BA3} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe 
Task: {8ED78818-79DA-4F09-AF57-5D760705182B} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe 
Task: {96D0338C-9E03-4A24-84C4-018F04A9E6E7} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {9AF40736-9716-454B-9A9C-C1B729B5D1EF} - System32\Tasks\Adobe online update program => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {A56A5016-2853-4C85-A952-52387685E313} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {A5D7C64B-26EB-4149-9B96-DB45B0361958} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell Support Center\uaclauncher.exe [2013-02-05] (PC-Doctor, Inc.)
Task: {A88CF25C-9AF9-45EF-967D-61631B5BF7C1} - System32\Tasks\{C42EC9EE-D907-4F64-A9AC-6280C73C4B08} => pcalua.exe -a "C:\Program Files\AVAST Software\Avast\aswRunDll.exe" -c "C:\Program Files\AVAST Software\Avast\Setup\setiface.dll" RunSetup
Task: {AACB6BE0-12B6-4DAC-A9F2-0933DB4EBF04} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {AC39CC15-12FC-4532-9F7B-2E47DEBB61E0} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-19] (Adobe Systems Incorporated)
Task: {AD5C80DC-FE25-4B57-82DF-1E45A3C7946E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {AFFCA8CA-8036-4EAA-B017-159BD9480988} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {B0EABC97-5599-4FCB-81EF-AA2732C9BDAE} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {B8DF842D-6C12-4E15-93D0-8AB0728959A7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1794967967-372989994-3207961994-1000Core => C:\Users\dali\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {BB6124E4-70F6-4E6E-862A-24EC0E51F57F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {BC9942D6-427C-473D-A5F0-618E6B971FA2} - System32\Tasks\{EA205C78-6772-49E8-AA9F-C28D130C43A5} => Chrome.exe hxxp://ui.skype.com/ui/0/5.8.0.158/en/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: {C2C058C8-E74C-4AEA-8B21-8307D40DAE9B} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {C448E2B9-07D1-495B-A297-5CE2EA64D226} - System32\Tasks\{F2253389-EA90-4E4C-84AF-0D4A61BD63C7} => pcalua.exe -a C:\Users\dali\Downloads\AudibleDM_iTunesSetup(1).exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {C55E48D5-9660-4FC7-A942-07804DF77BC1} - System32\Tasks\PCDEventLauncher => C:\Program Files\Dell Support Center\sessionchecker.exe [2012-11-29] (PC-Doctor, Inc.)
Task: {CC27749A-BF49-4EE2-BD85-283D38C8E7C6} - System32\Tasks\{354DCA4B-0275-4B0D-A25F-590DCA10706D} => C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe 
Task: {D02B4A7D-8C91-4659-B739-32A7001E1087} - System32\Tasks\{80A10A86-33BC-469D-9FC1-AEBEA8FA5A5B} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller"
Task: {D6CE731E-81F6-44AF-A990-5EE3D464D436} - System32\Tasks\GoogleUpdateTaskMachineCore1d12fcccfbea418 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {DC40F7CF-5960-4580-A4C2-90CD34E4948B} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {DE376F8C-E8CA-438F-9FFC-8BB67A9A4B9E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DF8624C1-340E-4076-B285-2C0E87C30A8A} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {E04DF9AD-5487-4844-A70E-60251AF757E7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1794967967-372989994-3207961994-1000UA => C:\Users\dali\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {E7D2C46E-A71A-4B31-9542-0B55A5D6A63A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {E85DD53F-1375-48D9-AA5F-F1C65563598B} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {E8C3666C-102D-462A-9B8F-4115B6E77CE4} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec.exe 
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1794967967-372989994-3207961994-1000Core.job => C:\Users\dali\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1794967967-372989994-3207961994-1000UA.job => C:\Users\dali\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1794967967-372989994-3207961994-1000Core.job => C:\Users\dali\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1794967967-372989994-3207961994-1000UA.job => C:\Users\dali\AppData\Local\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
ShortcutWithArgument: C:\Users\dalila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Keep - notes and lists.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=hmjkmjkepdijhoojdojkdfohbdgmmhki
 
==================== Loaded Modules (Whitelisted) ==============
 
2016-07-16 03:42 - 2016-07-16 03:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-20 09:06 - 2016-12-09 02:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-03-25 16:14 - 2016-03-25 16:14 - 00712288 _____ () C:\Program Files\Bitdefender\Antivirus Free Edition\sqlite3.dll
2016-03-25 16:14 - 2016-03-25 16:14 - 00111832 _____ () C:\Program Files\Bitdefender\Antivirus Free Edition\BDMetrics.dll
2016-02-10 11:24 - 2016-02-10 11:24 - 00039424 _____ () C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe
2016-07-13 08:58 - 2005-04-21 20:36 - 00143360 _____ () C:\WINDOWS\system32\BrSNMP64.dll
2017-01-10 13:54 - 2016-12-14 12:55 - 02259232 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2013-06-11 09:22 - 2012-12-07 16:26 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2015-05-15 15:26 - 2015-05-15 15:26 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 15:26 - 2015-05-15 15:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-12-20 09:06 - 2016-12-09 02:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2017-01-10 11:30 - 2017-01-10 11:30 - 01678560 _____ () C:\Users\dalila\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\amd64\ClientTelemetry.dll
2016-12-20 09:03 - 2016-09-06 20:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-10 11:59 - 2016-12-20 23:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2011-11-19 02:56 - 2015-06-01 21:00 - 00102912 _____ () C:\Windows\System32\IccLibDll_x64.dll
2017-02-09 23:14 - 2017-02-09 23:15 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-09 23:14 - 2017-02-09 23:15 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-09 23:14 - 2017-02-09 23:15 - 42895872 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-09 23:14 - 2017-02-09 23:15 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\roottools.dll
2017-01-10 11:57 - 2016-12-20 22:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-10 11:57 - 2016-12-20 22:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-10 11:57 - 2016-12-20 22:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-10 11:57 - 2016-12-20 22:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-10 11:57 - 2016-12-20 22:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-10 11:57 - 2016-12-20 22:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2011-11-19 01:40 - 2011-01-18 17:33 - 00182560 _____ () C:\WINDOWS\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\slcc3d64.dll
2017-02-09 23:18 - 2017-02-09 23:18 - 01969360 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.6.2.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
2017-02-09 23:18 - 2017-02-09 23:19 - 00381440 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.6.2.0_x64__8wekyb3d8bbwe\Microsoft.Notes.Upgrade.dll
2016-07-29 17:40 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-07-29 17:40 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-07-29 17:40 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-07-29 17:40 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-07-29 17:40 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-02-22 16:29 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2017-01-04 17:41 - 2017-01-04 17:41 - 00169984 _____ () C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IsdiInterop\b69301ba4279f356e59aa79b9b3ec219\IsdiInterop.ni.dll
2011-11-19 01:33 - 2010-11-05 21:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2016-12-19 18:11 - 2016-12-07 23:29 - 01829208 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libglesv2.dll
2016-12-19 18:11 - 2016-12-07 23:29 - 00085848 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libegl.dll
2017-01-11 21:41 - 2017-01-11 21:41 - 17835096 _____ () C:\Users\dalila\AppData\Local\Google\Chrome\User Data\PepperFlash\24.0.0.194\pepflashplayer.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\Users\dali\Downloads\adblw204.exe:BDU [0]
AlternateDataStreams: C:\Users\dali\Downloads\GwxControlPanelSetup (1).exe:BDU [0]
AlternateDataStreams: C:\Users\dali\Downloads\GWX_control_panel.exe:BDU [0]
AlternateDataStreams: C:\Users\dali\Downloads\HL-L2380DW-inst-C1-US (1).EXE:BDU [0]
AlternateDataStreams: C:\Users\dali\Downloads\HL-L2380DW-inst-C1-US.EXE:BDU [0]
AlternateDataStreams: C:\Users\dali\Downloads\Hola-Setup.exe:BDU [0]
AlternateDataStreams: C:\Users\dali\Downloads\TunnelBear-Install.exe:BDU [0]
AlternateDataStreams: C:\Users\dali\Downloads\Windows10Upgrade24074 (1).exe:BDU [0]
AlternateDataStreams: C:\Users\dali\Downloads\Windows10Upgrade24074.exe:BDU [0]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
 
There are 7911 more sites.
 
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\123simsen.com -> www.123simsen.com
 
There are 7911 more sites.
 
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 18:34 - 2017-02-10 01:40 - 00452309 ____R C:\WINDOWS\system32\Drivers\etc\hosts
 
127.0.0.1 localhost127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
 
There are 15548 more lines.
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1794967967-372989994-3207961994-1003\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\Dell\Win7 LtBlue 1920x1200.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
MSCONFIG\Services: CrossLoopService => 2
MSCONFIG\Services: NAUpdate => 2
MSCONFIG\Services: Secunia PSI Agent => 2
MSCONFIG\Services: Secunia Update Agent => 2
MSCONFIG\Services: TomTomHOMEService => 2
MSCONFIG\Services: TuneUp.UtilitiesSvc => 2
MSCONFIG\Services: UxTuneUp => 2
MSCONFIG\startupfolder: C:^Users^dalila^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupfolder: C:^Users^dali^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^dali^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk => C:\windows\pss\EvernoteClipper.lnk.Startup
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: CrossLoop => "C:\Users\dali\AppData\Local\CrossLoop\CrossLoopConnect.exe" -ap=crossloop -port=5910 -udp=www.CrossLoop.com -webserver=server.crossloop.com -webservice=www.crossloop.com -startup=server  -minimize
MSCONFIG\startupreg: Dell DataSafe Online => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
MSCONFIG\startupreg: Dell Webcam Central => "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
MSCONFIG\startupreg: DellStage => "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup
MSCONFIG\startupreg: Dropbox Update => "C:\Users\dali\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: Eraser => "C:\Program Files\Eraser\Eraser.exe" /atRestart
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: MusicManager => "C:\Users\dali\AppData\Local\Programs\Google\MusicManager\MusicManager.exe"
MSCONFIG\startupreg: MyDriveConnect.exe => "C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe"
MSCONFIG\startupreg: QuickSet => C:\Program Files\Dell\QuickSet\QuickSet.exe
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\dali\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: TouchFreeze => C:\Users\dali\AppData\Local\Programs\TouchFreeze\TouchFreeze.exe
MSCONFIG\startupreg: WrtMon.exe => C:\windows\system32\spool\drivers\x64\3\WrtMon.exe
MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"                                                                                                                                                                                                                                 
HKLM\...\StartupApproved\Run: => "GwxControlPanelMonitor"
HKLM\...\StartupApproved\Run32: => "ControlCenter4"
HKLM\...\StartupApproved\Run32: => "EgisUpdate"
HKLM\...\StartupApproved\Run32: => "EgisTecPMMUpdate"
HKLM\...\StartupApproved\Run32: => "SDTray"
HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\StartupApproved\StartupFolder: => "Dropbox.lnk"
HKU\S-1-5-21-1794967967-372989994-3207961994-1003\...\StartupApproved\Run: => "OneDrive"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [MSMQ-In-TCP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => LPort=808
FirewallRules: [{6086E541-D9B7-4118-9DA7-1E085FAD5F2F}] => LPort=54925
FirewallRules: [UDP Query User{D6008FD3-3D2B-425F-9147-CD7101DDFCA5}C:\program files\cryptomator\cryptomator.exe] => C:\program files\cryptomator\cryptomator.exe
FirewallRules: [TCP Query User{1FD433A8-A0C7-4B41-98F7-2F2C33C2CE83}C:\program files\cryptomator\cryptomator.exe] => C:\program files\cryptomator\cryptomator.exe
FirewallRules: [{FFDA14C2-21FF-4012-8135-C5EFFFC51015}] => C:\Program Files\iTunes\iTunes.exe
FirewallRules: [UDP Query User{40589530-EC8D-4B50-A80E-5D232612F068}C:\users\dali\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\dali\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{FAECFA3C-EA55-4C6D-BAD5-C262386439BB}C:\users\dali\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\dali\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{35714BCF-895F-4BC3-AFE2-1393314ED2E6}] => %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{7221E6D8-A084-47ED-943B-E38063101C1E}] => %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{55636DD9-DE91-44D5-A72C-C95605161877}] => %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{40B12E81-98BC-44EB-AC77-484BDB06F778}] => %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{DE64FBAC-3AC0-4FB5-A95E-820C1D79D6D2}] => %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{EDCC0137-523F-4264-8273-229582629EED}] => %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{841DC828-4A21-4310-BF28-79A8DCDF21EF}] => %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{ABF10BC8-7456-4037-9C0E-67DDD2D39551}] => %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{3D64FF33-C344-47D5-B90C-10679EF90F65}] => %ProgramFiles%\Zune\Zune.exe
FirewallRules: [{DF170022-3717-465C-AC77-3B70AAE4E2CD}] => C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{6CC5BBD0-4D8D-445F-AC47-73E262C0A183}] => C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{0031588D-8ECF-4564-9167-C127F9C7B1FB}] => C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{F4D151D5-A165-4C7E-8A8E-9A8459BCB171}] => C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{882C4624-88CE-4974-879C-3D50283A0AB6}] => C:\Users\dali\Downloads\DISH_Anywhere_Video_Player_Installer_2.7.1 (1).exe
FirewallRules: [{D0CE9EDD-972C-411F-A9C5-BACA0B95F52A}] => C:\Users\dali\Downloads\DISH_Anywhere_Video_Player_Installer_2.7.1 (1).exe
FirewallRules: [{2FA72D59-3DD3-42F8-8092-9336E4DCF8D2}] => C:\Users\dali\Downloads\DISH_Anywhere_Video_Player_Installer_2.7.1 (1).exe
FirewallRules: [{55B52823-CC69-404D-9B67-B0C6DA77EA99}] => C:\Users\dali\Downloads\DISH_Anywhere_Video_Player_Installer_2.7.1 (1).exe
FirewallRules: [{4514A31D-74D8-4545-926C-B9DB8683DF91}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [UDP Query User{6FE773EF-CDB9-4AAA-A8EC-BA96979B395B}C:\users\dali\appdata\local\crossloop\crossloopconnect.exe] => C:\users\dali\appdata\local\crossloop\crossloopconnect.exe
FirewallRules: [TCP Query User{EB045F4C-56A9-4D6D-9FAA-BE9356FC1E6F}C:\users\dali\appdata\local\crossloop\crossloopconnect.exe] => C:\users\dali\appdata\local\crossloop\crossloopconnect.exe
FirewallRules: [{FE195E38-C1A2-4D4F-AF68-1134DCE523BB}] => C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{F1C72921-3108-45EA-A7B8-FD192436E328}] => C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
FirewallRules: [UDP Query User{DC343D70-7835-4034-AB12-D77F3E55D75F}C:\users\dali\appdata\roaming\spotify\spotify.exe] => C:\users\dali\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{487C45D7-82C7-45BA-9BFF-25D812509196}C:\users\dali\appdata\roaming\spotify\spotify.exe] => C:\users\dali\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{427B4295-0DD6-40E0-8DB2-F831182EC081}C:\users\dali\appdata\roaming\spotify\spotify.exe] => C:\users\dali\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{2A73EB30-B106-44CC-A4E5-943B7AB0E5C3}C:\users\dali\appdata\roaming\spotify\spotify.exe] => C:\users\dali\appdata\roaming\spotify\spotify.exe
FirewallRules: [{53368CCC-E393-40EF-B4B6-288D40344F8A}] => C:\Users\dali\AppData\Local\Google\Chrome\Application\chrome.exe
FirewallRules: [{3F5BC12D-C92A-4197-8AED-EE2995017309}] => C:\Users\dali\AppData\Local\Google\Chrome\Application\chrome.exe
FirewallRules: [{3BCED160-414E-489E-98D1-25EEDDD6941A}] => C:\Users\dali\AppData\Local\Google\Chrome\Application\chrome.exe
FirewallRules: [{CF215582-BCC4-441D-BD0C-B8EC71D8E8AD}] => C:\Users\dali\AppData\Local\Google\Chrome\Application\chrome.exe
FirewallRules: [UDP Query User{C15A8A68-9EA6-48D1-9CD9-DF163FA470C5}C:\program files (x86)\musicbrainz picard\picard.exe] => C:\program files (x86)\musicbrainz picard\picard.exe
FirewallRules: [TCP Query User{D579E37C-8265-4258-965F-55A817D3B5CF}C:\program files (x86)\musicbrainz picard\picard.exe] => C:\program files (x86)\musicbrainz picard\picard.exe
FirewallRules: [{C46D09F1-A67E-46C8-84F1-223109CBBF27}] => C:\Users\dali\AppData\Local\Temp\lxdj\wireless\ENGLISH\lxdjwpss.exe
FirewallRules: [{AF62FAF7-0F3C-4782-980C-FE00F8DACD1B}] => C:\Users\dali\AppData\Local\Temp\lxdj\wireless\ENGLISH\lxdjwpss.exe
FirewallRules: [{4B9E79BF-E109-4FC5-AE76-3A370C6BD845}] => C:\Program Files (x86)\Lexmark 1400 Series\App4R.exe
FirewallRules: [{60792850-10A9-49D6-B052-293D44A190DD}] => C:\Program Files (x86)\Lexmark 1400 Series\App4R.exe
FirewallRules: [{32DC7341-453D-4793-9B7A-D51DC4541CD8}] => C:\Program Files (x86)\Lexmark 1400 Series\lxdjamon.exe
FirewallRules: [{41BAFF2E-5C0B-4365-A212-BCFA14FC7748}] => C:\Program Files (x86)\Lexmark 1400 Series\lxdjamon.exe
FirewallRules: [{BFD1BF3B-6059-4776-9438-67CF59E2382D}] => C:\Windows\System32\spool\drivers\x64\3\lxdjpswx.exe
FirewallRules: [{98074712-6DCD-4301-9214-9310F6C272D2}] => C:\Windows\System32\spool\drivers\x64\3\lxdjpswx.exe
FirewallRules: [{850BD92D-7266-4EF8-B968-807F81BC5B69}] => C:\Windows\System32\lxdjcoms.exe
FirewallRules: [{083BB672-0D11-40AD-99A8-9AD3C357D72E}] => C:\Windows\System32\lxdjcoms.exe
FirewallRules: [{6D78D8A1-BFA0-4E07-8E0F-2B4B8CCED67C}] => C:\Windows\System32\spool\drivers\x64\3\lxdjtime.exe
FirewallRules: [{20901BA5-223F-4EE8-A738-3AB3DF3D3E64}] => C:\Windows\System32\spool\drivers\x64\3\lxdjtime.exe
FirewallRules: [{CD11461A-0173-4B49-8996-494DF4A66D6B}] => C:\Windows\System32\spool\drivers\x64\3\lxdjjswx.exe
FirewallRules: [{15BFF6FB-AF8A-4F18-845A-CED81E4A135E}] => C:\Windows\System32\spool\drivers\x64\3\lxdjjswx.exe
FirewallRules: [{4EE95FC6-5C7F-49BA-9F5D-0354488B3F5E}] => C:\Windows\SysWOW64\lxdjcoms.exe
FirewallRules: [{9C650F93-DA99-4418-BBFA-583223C10CB9}] => C:\Windows\SysWOW64\lxdjcoms.exe
FirewallRules: [UDP Query User{D07B4D7E-F89C-4D75-80B3-FEC5281DA319}C:\users\dali\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe] => C:\users\dali\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe
FirewallRules: [TCP Query User{4B75160B-A162-49E3-B8DA-FD331E3192B0}C:\users\dali\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe] => C:\users\dali\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe
FirewallRules: [{F122C262-82D4-4005-B582-C31ED4051771}] => C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{F0E9B45C-555C-494D-BDE1-141EA3766125}] => C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [UDP Query User{D75F2F59-5FE8-492D-A65A-5EFE2840F824}C:\windows\system32\wfs.exe] => C:\windows\system32\wfs.exe
FirewallRules: [TCP Query User{DFA45960-2F2A-4747-A0B9-EEF1FE2F9FE2}C:\windows\system32\wfs.exe] => C:\windows\system32\wfs.exe
FirewallRules: [{F428E9A0-F546-4C9F-B48C-0D6BD30DAFC7}] => C:\Users\dali\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{D1AAF0ED-5C75-475E-B8AD-495609944784}] => C:\Users\dali\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{A9BE79B5-6333-4732-B037-DEFA72498561}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2E615A44-14D9-40CE-A8E8-13164133D515}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{583BEADA-F5CB-495C-A498-3B96AC975FF6}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3251C082-2EAD-4D68-BDF9-1E19FBDFC06D}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [UDP Query User{F0D55CE5-0E56-44B5-A13C-99A8A7B87346}C:\users\dali\downloads\bittorrent-7.6.exe] => C:\users\dali\downloads\bittorrent-7.6.exe
FirewallRules: [TCP Query User{249E042B-4D71-42AD-9FC4-55496A46A1FE}C:\users\dali\downloads\bittorrent-7.6.exe] => C:\users\dali\downloads\bittorrent-7.6.exe
FirewallRules: [{5F995983-E4FE-41F1-A014-1217F9D825DF}] => C:\Program Files\dell stage\dell stage\stage_primary.exe
FirewallRules: [{BDED5440-B747-4EE5-8861-AE47BF92B1E6}] => C:\Program Files\dell stage\musicstage\musicstageengine.exe
FirewallRules: [{176A0607-92FF-48EC-BA3B-A96B6A853ABB}] => C:\Program Files\dell stage\dell stage\accuweather\accuweather.exe
FirewallRules: [{AB6D594E-F310-466A-99DA-8BF209E1675D}] => C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{6A4AB3D4-A4F0-4BBC-A053-1437CE058EE7}] => C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{62F55E27-3275-4DB1-85A4-6CCE93AF6553}] => C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{5B2991DA-FB2D-41D2-B245-9ACC2CD9F0C9}] => LPort=1900
FirewallRules: [{E8FDE9DB-9154-42D3-ABAD-109E96A27B17}] => LPort=2869
FirewallRules: [{20D1CB89-2471-470B-A74A-9BBADE338C96}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{630E5F76-B68D-42E5-8AAF-A96593F1E40F}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{0D354057-D31D-4D7E-A5CC-6C348DB3E5CF}] => C:\Program Files (x86)\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [{C339AACF-5DF9-4C7A-A5D9-10BEBD7B2714}] => LPort=9700
FirewallRules: [{B4ECA4D0-1BC4-478D-9F20-A690FF5A8AE7}] => LPort=9702
FirewallRules: [{F40D60D8-9A0C-4B95-A76C-67F112D7E031}] => LPort=9701
FirewallRules: [{18FCD081-C9D0-4269-9914-4F962F1D4219}] => LPort=9700
FirewallRules: [{AB2813FB-9408-4A45-943D-7DADF873D9B5}] => C:\Program Files (x86)\Dell\VideoStage\VideoStage.exe
FirewallRules: [{5C9949B7-81AF-46EE-BE8E-B72CAE7CF3B0}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{085C26D9-2E9F-49F2-8E70-B7496A7CDA6A}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{88DF9812-4EC5-4A37-8ED4-F1F75968D7EA}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
 
==================== Restore Points =========================
 
19-01-2017 17:33:28 Windows Update
10-02-2017 00:04:54 Scheduled Checkpoint
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (02/13/2017 08:53:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: devmonsrv.exe, version: 1.2.0.71, time stamp: 0x4dd4343a
Faulting module name: devmonsrv.exe, version: 1.2.0.71, time stamp: 0x4dd4343a
Exception code: 0xc0000005
Fault offset: 0x0003f5ea
Faulting process id: 0x23b0
Faulting application start time: 0x01d2867e386026c2
Faulting application path: C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
Faulting module path: C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
Report Id: 0531d682-680d-498c-8520-63094aae1b69
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (02/13/2017 08:40:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   18 D.7.2.8.7.D.1.1.B.3.A.4.9.1.5.B.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. PTR dalilapc-2.local.
 
Error: (02/13/2017 08:40:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from FE80:0000:0000:0000:B519:4A3B:11D7:827D:5353   16 D.7.2.8.7.D.1.1.B.3.A.4.9.1.5.B.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. PTR dalilapc.local.
 
Error: (02/13/2017 08:40:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname dalilapc.local already in use; will try dalilapc-2.local instead
 
Error: (02/13/2017 08:40:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 1; will deregister   16 dalilapc.local. AAAA FE80:0000:0000:0000:B519:4A3B:11D7:827D
 
Error: (02/13/2017 08:40:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from FE80:0000:0000:0000:B519:4A3B:11D7:827D:5353    4 dalilapc.local. Addr 192.168.0.107
 
Error: (02/10/2017 12:05:10 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
 
System Error:
Access is denied.
.
 
Error: (02/09/2017 10:41:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname dalilapc.local already in use; will try dalilapc-2.local instead
 
Error: (02/09/2017 10:41:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister   16 dalilapc.local. AAAA FE80:0000:0000:0000:B519:4A3B:11D7:827D
 
Error: (02/09/2017 10:41:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from FE80:0000:0000:0000:B519:4A3B:11D7:827D:5353    4 dalilapc.local. Addr 192.168.0.107
 
 
System errors:
=============
Error: (02/13/2017 08:53:03 PM) (Source: DCOM) (EventID: 10005) (User: DALILAPC)
Description: DCOM got error "1053" attempting to start the service Bluetooth Device Monitor with arguments "Unavailable" in order to run the server:
{DABF28BE-F6B4-4E40-8F40-C4FB26F3116C}
 
Error: (02/13/2017 08:53:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Bluetooth Device Monitor service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.
 
Error: (02/13/2017 08:53:03 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Bluetooth Device Monitor service to connect.
 
Error: (02/10/2017 12:06:54 AM) (Source: Ntfs) (EventID: 55) (User: NT AUTHORITY)
Description: A corruption was discovered in the file system structure on volume OS.
 
A corruption was found in a file system index structure.  The file reference number is 0x500000003b7fe.  The name of the file is "\Windows\WinSxS".  The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
 
Error: (02/10/2017 12:06:28 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT AUTHORITY)
Description: 0x8000002a171\??\Volume{4cbe78c7-128f-11e1-acd5-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{3A00363C-A155-4BE9-8514-F4C0C124F97B}
 
Error: (01/19/2017 09:58:40 PM) (Source: DCOM) (EventID: 10010) (User: DALILAPC)
Description: The server App.AppXy9rh3t8m2jfpvhhxp6y2ksgeq77vymbq.mca did not register with DCOM within the required timeout.
 
Error: (01/19/2017 09:50:12 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/19/2017 09:46:59 PM) (Source: DCOM) (EventID: 10010) (User: DALILAPC)
Description: The server App did not register with DCOM within the required timeout.
 
Error: (01/19/2017 09:45:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/19/2017 09:45:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i5-2430M CPU @ 2.40GHz
Percentage of memory in use: 55%
Total physical RAM: 8098.05 MB
Available physical RAM: 3607.64 MB
Total Virtual: 16290.05 MB
Available Virtual: 11046.58 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:451.01 GB) (Free:226.43 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D8C0FA68)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
 
thank you so very much, and again sorry for the delay.


#7 garioch7

garioch7

    RCMP Veteran


  • Malware Response Instructor
  • 3,894 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Port Hood, Nova Scotia, Canada
  • Local time:06:17 AM

Posted 14 February 2017 - 06:52 AM

Dalila:

 

Thank you for your FRST logs.  I am glad that you are still with me.

 

Here in Atlantic Canada, we have been walloped by a major blizzard, which is just winding up now.  As a result, I have to dedicate several hours today to snow clearing on my large rural Cape Breton property.  That will, unfortunately, delay my analysis of your FRST logs.  Be assured that the analysis of your FRST logs will be my priority once I have the snow cleared.  I hope to get back to you later today; but if not, by tomorrow for sure.

 

Have a great day.

 

Regards,

-Phil


Graduate of the Bleeping Computer Malware Removal Study Hall


#8 dali52

dali52
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 14 February 2017 - 11:31 AM

Hello Phil,

Oh don't worry.. I heard about the bad weather in the north east... sorry for you.  Wishing you all the best, be safe and stay warm (I am in S. California and cold is not really my cup of tea.. but we have had quite a bit of rain actually.)

Wishing you a happy Valentine Day, if you celebrate of course.

Talk to you soon.

ciao

dalila



#9 garioch7

garioch7

    RCMP Veteran


  • Malware Response Instructor
  • 3,894 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Port Hood, Nova Scotia, Canada
  • Local time:06:17 AM

Posted 14 February 2017 - 01:51 PM

Dalila:

Thank you for your patience while I analyzed your FRST logs. The nice thing about rain is that you don't have to shovel it! :) I spent almost three hours today cleaning out from this blizzard and another snowstorm is expected tomorrow evening. :( Oh well, February in Atlantic Canada!

There are some other issues that we will need to address in future posts, but I think that this should get us off to a good start, cleaning up your computer. I don't want to burden you with too much work! :busy:

Before we start dealing with the problems you are experiencing, I would ask that you to take note of the following points:

  • I am a Bleeping Computer volunteer, so I ask you to be patient. I know it is frustrating when your computer is not working properly, but malware removal takes time.
  • Please also remember that I only dedicate a limited number of hours a day to helping people. We may live in different time zones, which may cause delays in responding.
  • If I have not responded to you within 48 hours, please send me a personal message. Likewise, I expect you to respond within 48 hours, and sooner is better because we can fix your computer faster.
  • If I have not heard from you in three days, I will "bump" your post. After five days of no response, I will consider that you no longer need my assistance and this thread will be closed.
  • Logs can take a while to research, so please be patient.
  • Some issues just cannot be solved so you must be prepared for this.
  • Please read and follow the instructions in the exact sequence that they are posted to avoid making a bad situation worse.
  • Please print or copy and save the instructions.
  • Back up all your data and important files on another (external) drive before starting to run malware removal tools.
  • You should try to limit your browsing with this computer until you are given the "All Clear." Some malware applications steal passwords.
  • Please do not install or uninstall any applications, unless directed. Don't run any scripts or tools on your own because unsupervised usage may cause more harm than good.
  • Please use only the tools you have been instructed to use.
  • If you are using CD/DVD emulation software, this should be uninstalled or disabled as it can interfere with the removal of some malware. It can be turned off with Defogger and then turned back on when you get the "All Clear."
  • Please copy and paste the requested log files inside your post, unless otherwise instructed.
  • There are no silly questions. Ask for clarification, if you have any questions or concerns.
  • Bleeping Computer does not support any piracy. Evidence of illegal OS, software, cracks/keygens, etc., will be revealed by scan logs, and if found, further assistance may be suspended. Uninstall such software before proceeding!
  • Any P2P software such as uTorrent, BitTorrent, Kazaa, etc. must be uninstalled or completely disabled. P2P software is a major security risk to your computer and may have been the route the malware used to infect your computer.
  • Failure to follow these guidelines may result in assistance being withdrawn and your thread being closed.
  • I am volunteering my time to help you, and I will need you to help me. Together, we can, hopefully, disinfect your computer and get if functioning properly again. That is my only aim.

.

OK, let's get started ...

 

.

:step1: I see that you have Spybot Search & Destroy installed. You might want to check out this link to a post by Quietman7, one of the foremost computer security experts, here at Bleeping Computer. If you decide you don't want to keep it, and that is YOUR choice, please uninstall it before moving on to the next step.

.

:step2: I do see that TuneUp Utilities Language Pack (en-US) is still showing as installed on your computer. My FRST fix will unhide it, so that you can uninstall it after the FRST fixlist.txt is run, and the computer is rebooted. The FRST fixlist.txt will also remove its running processes, services, and drivers.
 

TuneUp Utilities Language Pack (en-US) (x32 Version: 10.0.4500.46 - TuneUp Software) Hidden


.

:step3: I see that you have the registry set to run this program:
 

C:\Users\dali\Downloads\GWX_control_panel.exe

 

Is there a reason you are running this program? I ask because you have the latest build of Windows 10 installed.

.

:step4: Please upload these files to VirusTotal and send me the URL results links after you have clicked on the "Scan it!" button, so that I can examine the results:

  • C:\ProgramData\ss.ini
  • C:\Program Files (x86)\Common Files\InstallShield\Driver\9\Intel 32\IDriver.exe
  • C:\WINDOWS\system32\BrSNMP64.dll

.

:step5: The Addition.txt log shows two rules permitting BitTorrent to run. I am not seeing it as an installed program, but ...
 

FirewallRules: [UDP Query User{F0D55CE5-0E56-44B5-A13C-99A8A7B87346}C:\users\dali\downloads\bittorrent-7.6.exe] => C:\users\dali\downloads\bittorrent-7.6.exe
FirewallRules: [TCP Query User{249E042B-4D71-42AD-9FC4-55496A46A1FE}C:\users\dali\downloads\bittorrent-7.6.exe] => C:\users\dali\downloads\bittorrent-7.6.exe

  • You should avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you use P2P programs, you will get infected.

.

:step6: Please run a FRST "Fix" for me. You will notice that the fixlist.txt is quite lengthy because FRST is able to detect and report far more issues than HijackThis ever did with Windows XP. Of course, HijackThis is not Windows 10 compatible, whereas FRST is.

Copy and paste the text in the code box below into Notepad and save the file as fixlist.txt to your Downloads folder.

NOTE: It is important that both files, FRST64.exe and fixlist.txt are both in the same folder or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this individual computer. Running this on another computer may cause damage to your operating system.
 

CreateRestorePoint:
CloseProcesses:

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2028864 2011-12-08] (TuneUp Software)
C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoUpdateCheck.exe
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [11856 2010-10-07] (TuneUp Software)
C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoUpdateCheck.exe
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll -> No File
Startup: C:\Users\dalila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-03]
ShortcutTarget: Dropbox.lnk -> C:\Users\dali\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-1794967967-372989994-3207961994-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
FF Plugin HKU\S-1-5-21-1794967967-372989994-3207961994-1003: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10171.dll [No File]
U3 idsvc; no ImagePath
U4 wpcsvc; no ImagePath
File: C:\Users\dalila\AppData\Roaming\inst.exe
TuneUp Utilities Language Pack (en-US) (x32 Version: 10.0.4500.46 - TuneUp Software) Hidden
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
CustomCLSID: HKU\S-1-5-21-1794967967-372989994-3207961994-1003_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\dali\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll => No File
Task: {15780A7F-E682-45F4-8BD0-427A141841CF} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files (x86)\TuneUp Utilities 2011\OneClick.exe [2011-12-08] (TuneUp Software)
C:\Program Files (x86)\TuneUp Utilities 2011\OneClick.exe
Task: {18F3EF1C-4BD8-4B45-AE20-CE21DDEB9D0C} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {3A145536-D5C6-481F-B865-B56DAEA21478} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {3F7C6768-90B5-4955-AC72-AC451A55BAF6} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {59F8D8BF-7B8A-42AA-8B26-7131DC2296C2} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {A88CF25C-9AF9-45EF-967D-61631B5BF7C1} - System32\Tasks\{C42EC9EE-D907-4F64-A9AC-6280C73C4B08} => pcalua.exe -a "C:\Program Files\AVAST Software\Avast\aswRunDll.exe" -c "C:\Program Files\AVAST Software\Avast\Setup\setiface.dll" RunSetup
C:\Program Files\AVAST Software
FirewallRules: [{F122C262-82D4-4005-B582-C31ED4051771}] => C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{F0E9B45C-555C-494D-BDE1-141EA3766125}] => C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
C:\Program Files (x86)\AVG
  • Right click FRST/FRST64.exe, and select "Run as Administrator".
  • Then press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log in your Downloads folder (Fixlog.txt). Please copy and paste the contents into your reply.

.

 

Thank you and have a great day.

Regards,
-Phil


Graduate of the Bleeping Computer Malware Removal Study Hall


#10 dali52

dali52
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 14 February 2017 - 06:21 PM

Hi Phil,

I deleted spybot, uncovered hidden files, ran the scan, saw the tuneup file listed, but you did not say how to delete it. I don't delete it from the report obviously, so how? Please let me know. 

thanks 

dalila



#11 dali52

dali52
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 14 February 2017 - 06:33 PM

oh by the way C:\Users\dali\Downloads\GWX_control_panel.exe  I used it when I was not sure I wanted windows 10.  I thought I uninstalled it.  Is it a good idea to use Revo Uninstaller instead than the windows uninstall programs? I thought that lots of stuff was left behind with the windows uninstaller, but maybe I am wrong. thanks again



#12 dali52

dali52
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 14 February 2017 - 07:06 PM

This is from the virus scan you asked me to do.  number one and two the results are here, number 3 I could not find at all. File already analysed

This file was last analysed by VirusTotal on 2017-02-02 18:36:16 UTC (1 week, 5 days ago) it was first analysed by VirusTotal on 2012-06-23 20:29:20 UTC.

Detection ratio: 0/55

You can take a look at the last analysis or analyse it again now.

File already analysed

This file was last analysed by VirusTotal on 2017-02-14 18:23:41 UTC (5 hours, 36 minutesago) it was first analysed by VirusTotal on 2009-03-10 17:52:17 UTC.

Detection ratio: 0/57

You can take a look at the last analysis or analyse it again now.

 

 



#13 dali52

dali52
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 14 February 2017 - 07:42 PM

Hi again,

I have run FRST and the both txt and addition are in the same download folder and same directory.  When I try to run fix, after doing the admin permission, it says that they are not there. I have never used this or done this before so I don't really have a clue what I am doing wrong.

In my first response I was wondering how I would delete that tuneup utility file.  I found it actually but did not touch it yet. Is this FRST tool going to delete it? how? it seems to me that in order to fix something I would have to tell it what. 

Maybe you could explain it a bit more in detail since I am new at this.

I appreciate your help.  So I will wait for your response.

Thanks

dalila



#14 garioch7

garioch7

    RCMP Veteran


  • Malware Response Instructor
  • 3,894 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Port Hood, Nova Scotia, Canada
  • Local time:06:17 AM

Posted 15 February 2017 - 01:43 PM

Dalila:

 

Thank you for your posts.  If you can see the Tuneup Utilities in the Control Panel, Add/Remove Programs, then you can simply uninstall it.  Don't just delete the file.  I am not seeing it in the Addition.txt file listing of Installed Programs, but there is a hidden program, a language pack for Tuneup Utilities listed, that my FRST fix will unhide and then you should be able to uninstall it.

 

Personally, I do use Revo Uninstaller Pro to uninstall all of my programs.  Most uninstalls do leave files, folders, and registry entries behind.  Revo scans for those and gives you the option to delete them.

 

I think you might need to read my instructions for doing the FRST fix more carefully.  The presence of the FRST.txt file and the Addition.txt file, plus the FRST64.exe file, in the same folder, will not initiate a FRST fix, unless there is a file called fixlist.txt also there in the same folder.  My instructions were to copy and paste the contents of the code box in this post, Step :step6:, into Notepad and then save the file to your Downloads folder as "fixlist.txt.  Do not copy the fixlist.txt code box contents into Microsoft Word, Wordpad, or any other word processing software.  Please use only Notepad because it is does not add any formatting codes.

 

Then right-click FRST64.exe and click the "Fix" button just once.  The fix should run.

 

If it does not run, please let me know about any error messages that you might receive.

 

Thank you and have a great day.

 

Regards,

-Phil


Graduate of the Bleeping Computer Malware Removal Study Hall


#15 dali52

dali52
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:17 AM

Posted 15 February 2017 - 02:39 PM

Hello Phil,

actually when I ran the program it automatically copied the results into notepad.  I guess I can also do it manually and see if it works.

Regarding the tuneup language folder it does not show in the regular windows uninstall, but I can search for it in the Revo Uninstall program and see if it shows and then delete it.

I will do what you suggested later on as I am not at my home at the moment.

Thanks

dalila






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users