Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

unable to do updates, "amazon winner"popup, user profile issues


  • This topic is locked This topic is locked
8 replies to this topic

#1 vickimarie33

vickimarie33

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:01:49 PM

Posted 04 August 2018 - 10:25 PM

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02.08.2018
Ran by VMarie (administrator) on VMARIE-PC (04-08-2018 20:14:10)
Running from C:\Windows\SysWOW64\config\systemprofile\Downloads
Loaded Profiles: False (Available Profiles: VMarie) <==== ATTENTION (Temporary Profile?)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
() C:\Windows\SysWOW64\secpro.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Wondershare) C:\Program Files (x86)\Wondershare\Dr.Fone for iOS\Library\DriverInstaller\DriverInstall.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\TecoService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(Microsoft Corporation) C:\Windows\System32\WindowsAnytimeUpgradeui.exe
(Runtime Software) C:\Program Files (x86)\Runtime Software\DriveImage XML\dixml.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Runtime Software) C:\Program Files (x86)\Runtime Software\DriveImage XML\dixml.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-05-17] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [972672 2011-04-27] (TOSHIBA Corporation)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [310912 2011-03-24] (Conexant Systems, Inc.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [562304 2011-06-30] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1544624 2011-05-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-06-27] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-06-09] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2011-03-30] (TOSHIBA Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-11-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe [3218864 2011-06-22] (Toshiba)
HKLM-x32\...\Run: [ToshibaAppPlace] => C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe [552960 2010-09-23] (Toshiba)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67896 2018-03-16] (Apple Inc.)
HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
Startup: C:\Users\VMarie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2014-11-21]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (No File)
Startup: C:\Users\VMarie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2017-06-20]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicyScripts: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 10.244.224.1
Tcpip\..\Interfaces\{2756F111-7C24-4F68-B09E-FE0B12F80053}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{5AE57890-1DAE-4C29-A31D-107F66083028}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{E368BD4A-A3E0-4DF9-BC75-294CA6EB2E33}: [DhcpNameServer] 10.244.224.1
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=8
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yahoo.com/?ilc=8
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
SearchScopes: HKLM -> {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
SearchScopes: HKLM-x32 -> DefaultScope {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxps://search.yahoo.com/yhs/search?type=odc198&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM-x32 -> {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-05-12] (Google Inc.)
BHO: No Name -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> No File
BHO: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll [2012-08-24] (TOSHIBA Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-05-12] (Google Inc.)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2012-08-24] (TOSHIBA Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-05-12] (Google Inc.)
Toolbar: HKLM - No Name - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -  No File
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-05-12] (Google Inc.)
Toolbar: HKLM-x32 - No Name - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -  No File
DPF: HKLM-x32 {A8F2B9BD-A6A0-486A-9744-18920D898429} hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
 
FireFox:
========
FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi
FF Extension: (Dragon NaturallySpeaking Rich Internet Application Support) - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi [2013-10-15] [Legacy] [not signed]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-05] ( Microsoft Corporation)
FF Plugin-x32: @mcafee.com/MVT -> C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll [2015-11-09] (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-05] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-06-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-06-10] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-08-05] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-02-22] (Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DragonRIAPlugin -> C:\PROGRA~2\Nuance\NATURA~1\Program\npDgnRia.dll [2013-10-15] (Nuance Communications Inc.)
 
Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [fagakgcelolinfnkfgekcnedpaklfcok] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fagakgcelolinfnkfgekcnedpaklfcok] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-11-27] (Apple Inc.)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [254016 2014-10-07] (WildTangent)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [225792 2014-03-23] (NETGEAR) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe [123320 2013-08-12] (Symantec Corporation)
R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [126392 2011-07-19] (Symantec Corporation)
R2 SecStore; C:\windows\SysWOW64\secpro.exe [61440 2012-12-13] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe [473824 2017-05-05] (Wondershare)
R2 WsDrvInst; C:\Program Files (x86)\Wondershare\Dr.Fone for iOS\Library\DriverInstaller\DriverInstall.exe [119008 2017-06-28] (Wondershare)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
U5 AppMgmt; C:\windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
R1 ESProtectionDriver; C:\windows\system32\drivers\mbae64.sys [152688 2018-07-31] (Malwarebytes)
S3 MBAMFarflt; C:\windows\System32\DRIVERS\farflt.sys [112864 2018-07-15] (Malwarebytes)
S3 MBAMProtection; C:\windows\System32\DRIVERS\mbam.sys [44768 2018-07-15] (Malwarebytes)
R3 MBAMSwissArmy; C:\windows\System32\Drivers\mbamswissarmy.sys [253664 2018-08-01] (Malwarebytes)
S3 MBAMWebProtection; C:\windows\System32\DRIVERS\mwac.sys [94328 2018-07-15] (Malwarebytes)
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
R3 NPF; C:\windows\System32\drivers\NPF.sys [35344 2014-08-06] (CACE Technologies, Inc.)
R3 RTWlanE; C:\windows\System32\DRIVERS\rtwlane.sys [1514568 2013-05-02] (Realtek Semiconductor Corporation )
S1 AntiLog32; \??\C:\windows\system32\drivers\AntiLog64.sys [X]
U0 aswVmm; no ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MREMP50; \??\C:\PROGRA~2\COMMON~1\Motive\MREMP50.SYS [X]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50; \??\C:\PROGRA~2\COMMON~1\Motive\MRESP50.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
S3 panda_url_filteringd; \??\C:\Program Files\Panda Security URL Filtering\panda_url_filteringd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-08-04 20:13 - 2018-08-04 20:14 - 000000000 ___DC C:\FRST
2018-08-04 20:04 - 2018-08-04 20:04 - 000000000 ____D C:\Users\TEMP\AppData\Local\{A4DBAB21-C8DA-4985-9D4A-052123ABFD36}
2018-08-04 19:59 - 2018-08-04 20:05 - 000000000 ____D C:\Users\Default\AppData\Local\Windows Live Writer
2018-08-04 19:59 - 2018-08-04 20:05 - 000000000 ____D C:\Users\Default User\AppData\Local\Windows Live Writer
2018-08-04 19:59 - 2018-08-04 20:00 - 000000000 ____D C:\Users\TEMP\AppData\Local\{4A699B7A-7BB9-49C2-96E4-11228A0DCF67}
2018-08-04 19:59 - 2018-08-04 19:59 - 000000000 ____D C:\windows\SysWOW64\Windows Live Writer
2018-08-04 19:59 - 2018-08-04 19:59 - 000000000 ____D C:\Users\TEMP\AppData\Local\{F7F0EED2-8D70-4993-B4F3-87694E21CFBF}
2018-08-03 23:50 - 2018-08-03 23:50 - 000003870 _____ C:\windows\System32\Tasks\CCleaner Update
2018-08-03 23:50 - 2018-08-03 23:50 - 000002794 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2018-08-03 23:50 - 2018-08-03 23:50 - 000000793 _____ C:\Users\Public\Desktop\CCleaner.lnk
2018-08-03 23:50 - 2018-08-03 23:50 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2018-08-03 13:42 - 2018-08-03 13:43 - 000001122 _____ C:\Users\Public\Desktop\DriveImage XML.lnk
2018-08-03 13:42 - 2018-08-03 13:43 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Runtime Software
2018-08-03 13:36 - 2018-08-03 23:55 - 000000000 ____D C:\Program Files (x86)\Cobian Backup 11
2018-07-31 15:01 - 2018-07-31 15:01 - 000003230 _____ C:\windows\System32\Tasks\SidebarExecute
2018-07-31 07:18 - 2018-08-01 19:10 - 000253664 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamswissarmy.sys
2018-07-15 03:55 - 2018-07-15 04:13 - 000000000 __SDC C:\32788R22FWJFW
2018-07-11 22:47 - 2018-07-15 04:45 - 000112864 _____ (Malwarebytes) C:\windows\system32\Drivers\farflt.sys
2018-07-11 22:46 - 2018-07-31 07:17 - 000152688 _____ (Malwarebytes) C:\windows\system32\Drivers\mbae64.sys
2018-07-11 22:46 - 2018-07-11 22:46 - 000001838 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-07-11 22:46 - 2018-07-11 22:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-08-04 16:58 - 2011-11-01 20:40 - 000000000 ____D C:\windows\SysWOW64\Macromed
2018-08-04 16:49 - 2009-07-13 21:45 - 000024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-08-04 16:49 - 2009-07-13 21:45 - 000024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-08-04 16:04 - 2013-05-17 00:21 - 000129640 _____ C:\Users\VMarie\AppData\Local\GDIPFONTCACHEV1.DAT
2018-08-04 16:00 - 2009-07-13 22:13 - 000006502 _____ C:\windows\system32\PerfStringBackup.INI
2018-08-04 00:19 - 2017-12-01 14:57 - 000000000 ___RD C:\Users\VMarie\OneDrive
2018-08-04 00:15 - 2017-12-13 10:48 - 000129640 _____ C:\windows\system32\GDIPFONTCACHEV1.DAT
2018-08-03 23:52 - 2009-07-13 20:20 - 000000000 ____D C:\windows\inf
2018-08-03 23:51 - 2014-08-16 09:58 - 000000000 ____D C:\Program Files\CCleaner
2018-08-03 13:42 - 2018-04-13 20:51 - 000000000 ____D C:\Program Files (x86)\Runtime Software
2018-08-03 13:27 - 2009-07-13 20:20 - 000000000 ____D C:\windows\system32\NDF
2018-08-03 01:55 - 2013-06-15 22:41 - 000000000 ____D C:\ProgramData\TEMP
2018-08-03 01:08 - 2016-02-29 20:35 - 000002113 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-08-03 01:08 - 2013-05-16 23:57 - 000002154 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-08-01 19:09 - 2013-05-17 20:42 - 000000436 _____ C:\windows\system32\Drivers\etc\hosts.ics
2018-08-01 19:09 - 2009-07-13 22:09 - 000000000 ____D C:\windows\System32\Tasks\WPD
2018-08-01 19:08 - 2009-07-13 22:08 - 000000006 ____H C:\windows\Tasks\SA.DAT
2018-07-31 02:29 - 2018-04-17 15:48 - 000002170 _____ C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2018-07-31 02:29 - 2018-04-17 15:48 - 000000000 ___RD C:\Users\TEMP\OneDrive
2018-07-31 02:29 - 2018-02-25 09:28 - 000003176 _____ C:\windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2659838741-1186510262-2548316083-1000
2018-07-15 05:00 - 2013-05-30 08:12 - 134675576 ____C (Microsoft Corporation) C:\windows\system32\MRT.exe
2018-07-15 04:45 - 2017-11-29 01:31 - 000094328 _____ (Malwarebytes) C:\windows\system32\Drivers\mwac.sys
2018-07-15 04:45 - 2017-11-16 15:31 - 000044768 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2018-07-11 08:15 - 2016-12-21 00:52 - 000004454 _____ C:\windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2018-07-11 08:15 - 2013-05-27 00:58 - 000842240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2018-07-11 08:15 - 2013-05-27 00:58 - 000004312 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2018-07-11 08:15 - 2013-05-27 00:58 - 000000000 ____D C:\windows\system32\Macromed
2018-07-11 08:15 - 2011-11-01 20:40 - 000175104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
 
==================== Files in the root of some directories =======
 
2017-06-18 05:49 - 2017-06-18 05:49 - 011785432 ____N (Macroplant LLC                                              ) C:\Users\VMarie\iExplorer-3.9.11.exe
2015-12-02 16:11 - 2016-02-26 23:35 - 020320792 _____ (LastPass) C:\Program Files (x86)\Common Files\lpuninstall.exe
ZeroAccess:
C:\Users\VMarie\AppData\Local\Google\Desktop\Install
 
Some files in TEMP:
====================
2018-01-18 13:47 - 2018-01-18 13:47 - 000105664 _____ (Dropbox, Inc.) C:\Users\VMarie\AppData\Local\Temp\{285EED0E-B293-4C32-A2B2-4736BF710A38}-DropboxClient_41.4.80.exe
2018-01-18 13:48 - 2018-01-18 13:48 - 000105466 _____ () C:\Users\VMarie\AppData\Local\Temp\{4E87E38E-2B5C-4C39-A83B-60C5E89EE6EE}-63.0.3239.132_63.0.3239.84_chrome_updater.exe
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-07-31 07:38
 
==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02.08.2018
Ran by VMarie (04-08-2018 20:15:36)
Running from C:\Windows\SysWOW64\config\systemprofile\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2013-05-17 07:16:04)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2659838741-1186510262-2548316083-500 - Administrator - Disabled)
Guest (S-1-5-21-2659838741-1186510262-2548316083-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2659838741-1186510262-2548316083-1007 - Limited - Enabled)
VMarie (S-1-5-21-2659838741-1186510262-2548316083-1000 - Administrator - Enabled) => C:\Users\TEMP
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
7-Zip 9.20 (HKLM-x32\...\7-Zip 9.20) (Version:  - )
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.011.20038 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 20.0.0.260 - Adobe Systems Incorporated)
Adobe Flash Player 30 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 30.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 30 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 30.0.0.134 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{16EA5479-5CE2-F045-8D65-3F1FC41B90E5}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-bit) (HKLM-x32\...\{543F829B-4591-4B2F-AF63-6E6E6AE59EB2}) (Version: 6.4 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0ECA3BB5-4410-414B-B226-241FF1C12CD0}) (Version: 6.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BD6778C5-6FA5-492A-ADD6-E706339C2A7B}) (Version: 11.0.2.4 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.)
Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.1.42 - Atheros Communications Inc.)
Bejeweled 3 (HKLM-x32\...\WTA-42c7d3b2-8c11-406c-89f3-2fba1354d566) (Version: 2.2.0.97 - WildTangent) Hidden
Bolt PDF Printer (HKLM-x32\...\BoltPDF) (Version: 2.03 - NCH Software)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Box Sync (HKLM-x32\...\{79b22d0a-c7ba-4c33-9a03-f05ea1b48adb}) (Version: 4.0.4973.0 - Box Inc.) Hidden
CameraHelperMsi (HKLM-x32\...\{15634701-BACE-4449-8B25-1567DA8C9FD3}) (Version: 13.51.815.0 - Logitech) Hidden
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)
Canon MG3200 series On-screen Manual (HKLM-x32\...\Canon MG3200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.44 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.51.2.51 - Conexant)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Debut Video Capture Software (HKLM-x32\...\Debut) (Version: 3.01 - NCH Software)
DIRECTV GenieGO (HKLM-x32\...\{CF2D1F6F-BD25-493C-A257-9ADA0CBC4E1F}) (Version: 2.1.0.62 - DIRECTV, LLC) Hidden
DIRECTV Player (HKLM-x32\...\{04f0c8c0-e0c8-4292-8676-db9174655d7a}) (Version: 12.1 - DIRECTV)
Doxillion Document Converter (HKLM-x32\...\Doxillion) (Version: 2.71 - NCH Software)
dr.fone toolkit for iOS (Version 8.5.0) (HKLM-x32\...\{A26F8BBD-EC10-4bdc-8AD8-F146825A8A63}_is1) (Version: 8.5.0.54 - Wondershare Technology Co.,Ltd.)
Dragon NaturallySpeaking 12 (HKLM-x32\...\{D5D422B9-6976-4E98-8DDF-9632CB515D7E}) (Version: 12.50.000 - Nuance Communications Inc.)
DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.60.000 - Runtime Software)
erLT (HKLM-x32\...\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}) (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Express Zip File Compression (HKLM-x32\...\ExpressZip) (Version: 3.03 - NCH Software)
FATE - The Traitor Soul (HKLM-x32\...\WTA-ed975c68-86f4-471a-afd3-d6feab74123a) (Version: 2.2.0.95 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 68.0.3440.84 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{18455581-E099-4BA8-BC6B-F34B2F06600C}) (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet Pro 8600 Basic Device Software (HKLM\...\{791A06E2-340F-43B0-8FAB-62D151339362}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8600 Help (HKLM-x32\...\{46235FF7-2CBE-4A84-BEDA-87348D1F7850}) (Version: 28.0.0 - Hewlett Packard)
HP Officejet Pro 8600 Product Improvement Study (HKLM\...\{2BF5E9CC-C55D-4B0F-ACAF-FFE77F333CD8}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (HKLM-x32\...\{B6465A32-8BE9-4B38-ADC5-4B4BDDC10B0D}) (Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iCloud (HKLM\...\{99868C9C-C141-4DDE-A2C7-9DDF00F68F17}) (Version: 7.2.0.67 - Apple Inc.)
iSpyPRO64 (HKLM\...\{77D0C08E-1522-48FE-B1BA-26A11CA0EE1A}) (Version: 1.1.8 - iSpy)
iTunes (HKLM\...\{D7D4465C-B3B6-4BC1-B336-2803FB57BFAF}) (Version: 12.7.2.60 - Apple Inc.)
Junk Mail filter update (HKLM-x32\...\{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}) (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Label@Once 1.0 (HKLM-x32\...\{0D795777-9D60-4692-8386-F2B3F2B5E5BF}) (Version: 1.0 - Corel)
Letters from Nowhere 2 (HKLM-x32\...\WTA-6fb94e5f-2311-40f0-8934-3b8c60cf3149) (Version: 2.2.0.97 - WildTangent) Hidden
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)
Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)
McAfee Virtual Technician (HKLM-x32\...\McAfee Virtual Technician) (Version: 8.1.0.135 - McAfee, Inc.)
Merge Excel Files 10.1.10 (HKLM-x32\...\{73E0B0D6-47E5-4E47-9F1D-3C443E1B0129}_is1) (Version:  - Excel-Tool, Inc.)
Mesh Runtime (HKLM-x32\...\{8C6D6116-B724-4810-8F2D-D047E6B7D68E}) (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.5139.5005 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 x64 ENU (HKLM\...\{8424B163-D1E0-48B7-88A2-C7A61767B3D7}) (Version: 4.0.8482.1 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Motion Detection (HKLM-x32\...\Motion Detection) (Version: 1.4.21.2 - Noël Danjou)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MuseScore 1.3 (HKLM-x32\...\MuseScore) (Version: 1.3.0 - Werner Schweer and Others)
NETGEAR Genie (HKLM-x32\...\NETGEAR Genie) (Version: 2.3.1.25 - NETGEAR Inc.)
Netwaiting (HKLM-x32\...\{74B8998B-2B1B-4414-AD5D-17E7E9B5FF0A}) (Version: 1.0.1 - Conexant Systems, Inc)
Paraben's iRecovery Stick Driver Pack (HKLM-x32\...\{51A8A9FA-17D4-48F9-8425-C5F51ECFE123}) (Version: 3.0 - Paraben Corporation)
Penguins! (HKLM-x32\...\WTA-5a86b8af-5ff0-409e-ac13-5d4218ea0ac5) (Version: 2.2.0.98 - WildTangent) Hidden
PhotoPad Image Editor (HKLM-x32\...\PhotoPad) (Version: 2.80 - NCH Software)
Plants vs. Zombies - Game of the Year (HKLM-x32\...\WTA-0214d1f8-3bce-4827-8462-6f90365226a7) (Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (HKLM-x32\...\WTA-4b13c2a6-38da-4b3f-bffb-1c7b8370c4e2) (Version: 2.2.0.97 - WildTangent) Hidden
Prism Video File Converter (HKLM-x32\...\Prism) (Version: 2.59 - NCH Software)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 1.0.0.14 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0013 - REALTEK Semiconductor Corp.)
RollerCoaster Tycoon 3: Platinum (HKLM-x32\...\WTA-9a45b35a-1b06-46fb-953c-8c47837e8b40) (Version: 2.2.0.98 - WildTangent) Hidden
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Sheet Music Plus Digital Print (HKLM-x32\...\{4962F4E2-C1FA-1051-1504-28B8FE63946E}) (Version: 255.02.21 - Sheet Music Plus, LLC) Hidden
Sheet Music Plus Digital Print (HKLM-x32\...\com.sheetmusicplus.DigitalAirPrint2) (Version: v2014.02.21 - Sheet Music Plus, LLC)
Sibelius Scorch (ActiveX Only) (HKLM-x32\...\{868291A4-229E-4795-B0B0-E60E87AF53CD}) (Version: 6.2.0 - Sibelius Software)
Skype Launcher (HKLM-x32\...\{DA84ECBF-4B79-47F2-B34C-95C38484C058}) (Version: 2.01 - TOSHIBA Corporation)
Summitsoft Website Creator - Evolution (HKLM-x32\...\Summitsoft Website Creator - Evolution) (Version:  - Incomedia s.r.l.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.11.1 - Synaptics Incorporated)
Tales of Lagoona (HKLM-x32\...\WTA-38328fe3-daed-4643-b211-9b4f780e2548) (Version: 2.2.0.98 - WildTangent) Hidden
Toshiba App Place (HKLM-x32\...\{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}) (Version: 1.0.6.3 - Toshiba)
TOSHIBA Application Installer (HKLM-x32\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.2 - TOSHIBA)
TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.2.3.0 - TOSHIBA CORPORATION)
Toshiba Book Place (HKLM-x32\...\{A14962A7-2B7D-456E-BFCD-F54E3A88D41F}) (Version: 2.2.7530 - K-NFB Reading Technology, Inc.)
TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}) (Version: 1.6.08.64 - TOSHIBA Corporation)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.11 for x64 - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM\...\{C2F94B5E-201A-4754-8F2F-4395E1D90DA3}) (Version: 1.3.5.64 - TOSHIBA Corporation)
TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.17.64 - TOSHIBA Corporation)
TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{C4FFA951-9678-4D51-84B4-AFD15D3C45AD}) (Version: 4.09.03.00 - TOSHIBA)
TOSHIBA HDD/SSD Alert (HKLM\...\{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.9 - TOSHIBA Corporation)
Toshiba Laptop Checkup (HKLM-x32\...\NortonPCCheckup) (Version: 2.0.13.11 - Symantec Corporation)
TOSHIBA Media Controller (HKLM-x32\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.87.4 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.8.0 - TOSHIBA CORPORATION)
Toshiba Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 2.0.0.31 - Toshiba)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.7.8.64 - TOSHIBA Corporation)
TOSHIBA Quality Application (HKLM-x32\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.4 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.5.5109a - TOSHIBA CORPORATION)
TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}) (Version: 1.7.20.64 - TOSHIBA Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.1.2001 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.12 - TOSHIBA)
TOSHIBA Sleep Utility (HKLM-x32\...\{654F7484-88C5-46DC-AB32-C66BCB0E2102}) (Version: 1.4.2.8 - TOSHIBA Corporation)
TOSHIBA Supervisor Password (HKLM-x32\...\InstallShield_{CBD6B23D-41D5-4A46-8019-6208516C9712}) (Version: 4.09.03.00 - TOSHIBA)
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.6.1.64 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (HKLM-x32\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 2.0.3.3 - TOSHIBA Corporation)
TOSHIBARegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.7 - TOSHIBA)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update Installer for WildTangent Games App (HKLM-x32\...\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version:  - WildTangent) Hidden
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.2.5 - WildTangent)
WildTangent Games App (Toshiba Games) (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-toshiba) (Version: 4.0.11.14 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Zuma's Revenge (HKLM-x32\...\WTA-dd80047e-08db-4735-9ced-6c041a6c3699) (Version: 2.2.0.98 - WildTangent) Hidden
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ShellIconOverlayIdentifiers: [    OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [    OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [    OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [    OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [    OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [    OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ SncrOverlays (Blocked)] -> {C418E880-6280-4010-A888-FD76028E5511} =>  -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [    OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [    OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [    OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [    OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [    OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [    OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  -> No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  -> No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  -> No File
ContextMenuHandlers1-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov)
ContextMenuHandlers1-x32: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} =>  -> No File
ContextMenuHandlers1-x32: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1-x32: [ExpressZip] -> {8EEA165E-0B8B-4BA7-9796-50214C767171} => C:\Program Files (x86)\NCH Software\ExpressZip\ezcm64.dll [2017-01-22] ()
ContextMenuHandlers1-x32: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2017-12-08] (Apple Inc.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers3: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)
ContextMenuHandlers4-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov)
ContextMenuHandlers4-x32: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll [2011-11-10] (Advanced Micro Devices, Inc.)
ContextMenuHandlers6: [ExpressZip] -> {8EEA165E-0B8B-4BA7-9796-50214C767171} => C:\Program Files (x86)\NCH Software\ExpressZip\ezcm64.dll [2017-01-22] ()
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {197411CE-FBED-4196-BB68-6AE60220220F} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-06-27] (Piriform Ltd)
Task: {268944FC-8FFF-4B3D-9329-916771629028} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)
Task: {37559085-181A-4115-B305-31E1C9FEEA8F} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {50A64456-86D7-430D-A5ED-EA6825BAC691} - System32\Tasks\HPCustParticipation HP Officejet Pro 8600 => C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {5D75182B-E26A-4FCA-A874-D780F2B621DA} - \IHUninstallTrackingTASK -> No File <==== ATTENTION
Task: {783C5CEA-1B17-4DBC-AE4B-69FFD12454F5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)
Task: {7B376716-335C-4317-8BA2-ADFC4E411BBA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2018-06-27] (Piriform Ltd)
Task: {8D4D28F6-A328-41E6-865F-FC92363C8AD6} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfigAndContent
Task: {8D4D28F6-A328-41E6-865F-FC92363C8AD6} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(2): C:\windows\system32\GWX\GWXDetector.exe [2015-12-08] (Microsoft Corporation)
Task: {A2B49EC8-79E9-4EB6-AE18-D334C43B95FF} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2659838741-1186510262-2548316083-1000 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {B00B4CF2-7C7C-4899-9CF3-3F84B70140FD} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
Task: {B28892B4-AF7F-488D-A54D-6E2E40EC8431} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2018-01-08] (Apple Inc.)
Task: {B9F54FE2-F8C7-4428-A433-30E07B3D83C7} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig
Task: {B9F54FE2-F8C7-4428-A433-30E07B3D83C7} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(2): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshContent
Task: {B9F54FE2-F8C7-4428-A433-30E07B3D83C7} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(3): C:\windows\system32\GWX\GWXDetector.exe [2015-12-08] (Microsoft Corporation)
Task: {D4EC2436-A74B-49D5-AB55-4EAF3C62139E} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2017-12-08] (Apple Inc.)
Task: {D6FD1266-42EA-4906-A06C-A2FAB6F1EE5E} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_134_pepper.exe [2018-07-11] (Adobe Systems Incorporated)
Task: {E176CAC8-72BA-41C5-A71A-5B4FADADA898} - \IHSelfDeleteTASK -> No File <==== ATTENTION
Task: {E874463F-4EAF-442E-BBDF-3CDBD90095EF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-01-17] (Adobe Systems Incorporated)
Task: {F403238F-6D13-40ED-893D-235966A1037B} - System32\Tasks\{787A680F-F64B-4B73-A8F9-7776B76B80FC} => C:\windows\system32\pcalua.exe -a "C:\Program Files (x86)\Runtime Software\DriveImage XML\Uninstall.exe" -c "C:\Program Files (x86)\Runtime Software\DriveImage XML\install.log" -u
Task: {F5B6A20E-AABE-433C-961A-5EA691842A54} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-07-11] (Adobe Systems Incorporated)
Task: {F9B44D55-8D38-402D-ADD4-3ADB5D539D43} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig
Task: {F9B44D55-8D38-402D-ADD4-3ADB5D539D43} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(2): C:\windows\system32\GWX\GWXDetector.exe [2015-12-08] (Microsoft Corporation)
Task: {FA59AB85-E192-4C9B-81E6-A169C76169C7} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => Command(1): %windir%\system32\GWX\GWXUXWorker.exe -> /ScheduleUpgradeReminderTime
Task: {FA59AB85-E192-4C9B-81E6-A169C76169C7} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => Command(2): C:\windows\system32\GWX\GWXDetector.exe [2015-12-08] (Microsoft Corporation)
Task: {FED69E6A-AEA1-4530-A0D7-0BBC540A4529} - System32\Tasks\{346656DA-C696-443B-8020-3B271F9791C3} => C:\windows\system32\pcalua.exe -a C:\Users\VMarie\Downloads\mergefilesexcel.exe -d C:\Users\VMarie\Downloads
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
2017-01-22 00:34 - 2017-01-22 00:34 - 000105984 _____ () C:\Program Files (x86)\NCH Software\ExpressZip\ezcm64.dll
2018-03-16 15:19 - 2018-03-16 15:19 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-12-08 02:48 - 2017-12-08 02:48 - 000088888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-11-29 22:15 - 2012-12-13 20:45 - 000061440 ___OT () C:\windows\SysWOW64\secpro.exe
2018-07-11 22:46 - 2018-07-31 07:17 - 002433744 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 000264040 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2018-06-27 10:24 - 2018-06-27 10:24 - 000061408 _____ () C:\Program Files\CCleaner\branding.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8 [496]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-18 13.53.35.png:com.dropbox.attributes [980]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-18 14.29.19.png:com.dropbox.attributes [978]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-18 16.00.11.jpg:com.dropbox.attributes [1108]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-18 16.22.58.png:com.dropbox.attributes [485]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-18 20.58.59.png:com.dropbox.attributes [1190]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-18 21.59.54.png:com.dropbox.attributes [488]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-18 22.00.00.png:com.dropbox.attributes [530]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-19 16.22.22.jpg:com.dropbox.attributes [1234]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-20 13.39.26.jpg:com.dropbox.attributes [1236]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-20 14.39.08.png:com.dropbox.attributes [972]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-26 12.01.52.png:com.dropbox.attributes [1190]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-26 12.03.43.png:com.dropbox.attributes [1184]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-26 12.04.56.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-26 12.05.38.png:com.dropbox.attributes [1190]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-26 12.05.43.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-30 10.01.58.jpg:com.dropbox.attributes [1064]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-30 10.07.01.jpg:com.dropbox.attributes [1092]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-03-31 16.47.21.png:com.dropbox.attributes [1058]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-04-05 14.37.42.jpg:com.dropbox.attributes [1102]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-04-05 16.10.37.jpg:com.dropbox.attributes [1106]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-05-24 13.53.36.png:com.dropbox.attributes [1186]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-06-15 16.00.27.jpg:com.dropbox.attributes [1210]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-06-17 10.52.07.jpg:com.dropbox.attributes [618]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-07-01 10.25.34.jpg:com.dropbox.attributes [1262]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-07-01 10.29.46.jpg:com.dropbox.attributes [628]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-08-07 20.37.13.jpg:com.dropbox.attributes [1062]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-08-31 11.24.18.jpg:com.dropbox.attributes [1066]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-09-15 09.07.58.jpg:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-09-26 11.48.02.jpg:com.dropbox.attributes [1122]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-09-26 11.48.10.jpg:com.dropbox.attributes [1112]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-09-26 11.48.33.jpg:com.dropbox.attributes [558]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-09-26 11.50.00.jpg:com.dropbox.attributes [279]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-09-26 13.35.24.mov:com.dropbox.attributes [1066]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-09-26 13.57.50.mov:com.dropbox.attributes [1070]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.48.41.png:com.dropbox.attributes [597]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.50.10.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.51.36.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.51.56.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.52.20.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.53.05.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.54.57.png:com.dropbox.attributes [599]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.56.41.png:com.dropbox.attributes [596]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.57.16.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 05.57.57.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.04.28.png:com.dropbox.attributes [982]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.12.11.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.13.04.png:com.dropbox.attributes [597]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.13.50.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.14.11.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.14.44.png:com.dropbox.attributes [600]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.15.42.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.16.03.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.16.54.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.17.27.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.17.46.png:com.dropbox.attributes [980]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.18.07.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.19.23.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.20.52.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.21.25.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.37.27.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.38.37.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.39.05.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.42.14.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.42.44.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.44.32.png:com.dropbox.attributes [1190]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 06.46.37.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-18 09.31.33.jpg:com.dropbox.attributes [1242]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-23 10.02.35.jpg:com.dropbox.attributes [1236]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-23 10.02.43.jpg:com.dropbox.attributes [1232]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-23 10.03.07.jpg:com.dropbox.attributes [1018]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-24 11.48.58.png:com.dropbox.attributes [978]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-24 11.49.15.png:com.dropbox.attributes [980]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-24 11.51.07.png:com.dropbox.attributes [486]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-24 11.51.15.png:com.dropbox.attributes [982]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-24 12.59.57.png:com.dropbox.attributes [978]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-24 13.00.09.png:com.dropbox.attributes [978]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-28 11.33.13.png:com.dropbox.attributes [1056]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-28 11.33.20.png:com.dropbox.attributes [1062]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-28 11.33.40.png:com.dropbox.attributes [1056]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-28 11.33.43.png:com.dropbox.attributes [1062]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-28 11.56.10.png:com.dropbox.attributes [530]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-30 10.59.27.png:com.dropbox.attributes [1066]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-30 11.06.00.png:com.dropbox.attributes [1058]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-30 11.06.40.png:com.dropbox.attributes [1058]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-10-30 11.08.16.png:com.dropbox.attributes [1060]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-03 16.08.24.png:com.dropbox.attributes [531]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-06 10.07.58.jpg:com.dropbox.attributes [986]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-06 10.09.26.jpg:com.dropbox.attributes [597]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-06 10.09.47.jpg:com.dropbox.attributes [600]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-06 10.21.53.jpg:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-07 07.24.15.png:com.dropbox.attributes [980]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-08 14.35.46.png:com.dropbox.attributes [595]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-09 18.48.59.jpg:com.dropbox.attributes [1238]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-10 04.42.42.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-10 04.42.47.png:com.dropbox.attributes [982]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-10 09.46.10.jpg:com.dropbox.attributes [978]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-10 13.08.58.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-10 13.24.14.png:com.dropbox.attributes [976]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-10 13.28.41.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-10 13.29.00.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-11 09.19.56.jpg:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-11 16.35.20.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-12 13.33.53.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-12 13.35.49.png:com.dropbox.attributes [598]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-12 14.40.45.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 09.23.09.jpg:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 09.24.49.jpg:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 09.50.11.jpg:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 15.43.29.jpg:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 21.41.43.jpg:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 21.42.11.jpg:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 21.42.41.jpg:com.dropbox.attributes [1188]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 21.42.51.gif:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 21.44.42.jpg:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 23.07.13.jpg:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 23.08.46.jpg:com.dropbox.attributes [598]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-14 23.10.01.jpg:com.dropbox.attributes [487]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-15 23.54.55.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 00.11.31.png:com.dropbox.attributes [593]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 00.37.46.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 01.09.38.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 01.10.29.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 09.39.40.png:com.dropbox.attributes [598]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 09.47.10.png:com.dropbox.attributes [984]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 12.13.04.png:com.dropbox.attributes [593]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 14.01.13.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 14.27.34.png:com.dropbox.attributes [597]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 15.19.22.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 15.19.29.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 15.20.22.png:com.dropbox.attributes [594]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 15.26.10.png:com.dropbox.attributes [596]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-16 15.26.27.png:com.dropbox.attributes [594]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-20 11.12.19.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-20 12.11.42.png:com.dropbox.attributes [599]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-20 19.44.14.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-20 19.46.06.png:com.dropbox.attributes [1206]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 15.57.04.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 15.57.55.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 15.59.00.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 16.05.24.png:com.dropbox.attributes [600]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 16.06.10.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 16.09.34.png:com.dropbox.attributes [1184]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 16.09.40.png:com.dropbox.attributes [595]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 17.00.17.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 17.00.22.png:com.dropbox.attributes [597]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 17.00.29.png:com.dropbox.attributes [489]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 17.00.35.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-21 19.52.12.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-22 07.41.38.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-24 13.17.03.png:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-27 18.18.42.jpg:com.dropbox.attributes [982]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-27 19.27.03.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-27 19.27.14.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-28 08.05.57.png:com.dropbox.attributes [1204]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-28 08.06.50.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-28 08.38.48.png:com.dropbox.attributes [1202]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-28 08.39.24.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-29 19.16.31.jpg:com.dropbox.attributes [597]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-30 13.34.28.png:com.dropbox.attributes [1064]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-30 19.57.47.jpg:com.dropbox.attributes [1106]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-30 19.58.20.jpg:com.dropbox.attributes [1110]
AlternateDataStreams: C:\Users\VMarie\Documents\2015-11-30 19.58.41.jpg:com.dropbox.attributes [1106]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-01 06.33.59.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-01 16.32.21.png:com.dropbox.attributes [1188]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-12 16.16.17.jpg:com.dropbox.attributes [1240]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-24 11.59.16.jpg:com.dropbox.attributes [1242]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-24 11.59.22.jpg:com.dropbox.attributes [1242]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-24 14.35.32.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-24 14.35.35.png:com.dropbox.attributes [593]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-24 14.50.54.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-24 14.51.09.png:com.dropbox.attributes [1190]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-24 15.32.37.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-25 17.38.05.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-25 17.39.02.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-26 09.02.53.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-26 10.39.59.jpg:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-26 11.33.39.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-26 11.33.53.png:com.dropbox.attributes [1200]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-26 11.38.12.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 04.36.19.jpg:com.dropbox.attributes [595]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 04.37.53.jpg:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.07.34.png:com.dropbox.attributes [597]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.08.41.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.37.37.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.37.59.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.38.29.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.39.16.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.39.20.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.39.27.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.42.55.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.43.06.png:com.dropbox.attributes [597]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 05.45.21.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 08.22.46.png:com.dropbox.attributes [596]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 08.22.57.png:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 11.26.52.png:com.dropbox.attributes [599]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.36.30.jpg:com.dropbox.attributes [1238]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.36.33.jpg:com.dropbox.attributes [1246]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.37.17.jpg:com.dropbox.attributes [1242]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.37.29.jpg:com.dropbox.attributes [1240]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.37.38.jpg:com.dropbox.attributes [1240]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.37.46.jpg:com.dropbox.attributes [618]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.38.00.jpg:com.dropbox.attributes [1242]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.38.09.jpg:com.dropbox.attributes [616]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.38.37.jpg:com.dropbox.attributes [1240]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 20.38.46.jpg:com.dropbox.attributes [1238]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 21.02.41.jpg:com.dropbox.attributes [1236]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 22.07.57.jpg:com.dropbox.attributes [1234]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-02-27 22.44.42.jpg:com.dropbox.attributes [1198]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-03-05 12.19.56.jpg:com.dropbox.attributes [1194]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-03-05 13.50.16.png:com.dropbox.attributes [598]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-03-05 14.04.13.png:com.dropbox.attributes [595]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-03-18 16.33.15.png:com.dropbox.attributes [1192]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-03-19 12.08.11.jpg:com.dropbox.attributes [595]
AlternateDataStreams: C:\Users\VMarie\Documents\2016-03-20 11.20.35.png:com.dropbox.attributes [1196]
AlternateDataStreams: C:\Users\VMarie\Documents\CaLicense.jpeg:com.dropbox.attributes [416]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0039.PNG:com.dropbox.attributes [428]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0040.PNG:com.dropbox.attributes [416]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0041.PNG:com.dropbox.attributes [414]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0042.PNG:com.dropbox.attributes [424]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0043 (Edited).JPG:com.dropbox.attributes [428]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0043.JPG:com.dropbox.attributes [211]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0044 (Edited).JPG:com.dropbox.attributes [428]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0044.JPG:com.dropbox.attributes [416]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0045 (Edited).JPG:com.dropbox.attributes [422]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0045.JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0046 (Edited).JPG:com.dropbox.attributes [213]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0046.JPG:com.dropbox.attributes [428]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0047 (Edited).JPG:com.dropbox.attributes [420]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0047.JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0048 (Edited).JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0048.JPG:com.dropbox.attributes [424]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0049 (Edited).JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0049.JPG:com.dropbox.attributes [424]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0050 (Edited).JPG:com.dropbox.attributes [210]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0050.JPG:com.dropbox.attributes [424]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0051 (Edited).JPG:com.dropbox.attributes [428]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0051.JPG:com.dropbox.attributes [212]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0052 (Edited).JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0052.JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0053 (Edited).JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0054 (Edited).JPG:com.dropbox.attributes [426]
AlternateDataStreams: C:\Users\VMarie\Documents\IMG_0055.JPG:com.dropbox.attributes [418]
AlternateDataStreams: C:\Users\VMarie\Documents\self10.jpg:com.dropbox.attributes [428]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 19:34 - 2018-04-12 21:37 - 000000031 _____ C:\windows\system32\Drivers\etc\hosts
 
127.0.0.1       localhost
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
DNS Servers: 10.244.224.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
MSCONFIG\startupreg: (default) => 
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{261CE1C0-AF12-40FD-8F74-F0DAFA7B973F}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3B87E4F3-FA53-4469-B80D-5183295479D6}] => (Allow) LPort=2869
FirewallRules: [{15CA432E-D6F7-4229-B4AA-D0C7A60AA02D}] => (Allow) LPort=1900
FirewallRules: [{BBE6F8EB-11B4-456F-B30D-3BD5B2E4F444}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{8343B6AC-8715-4270-BC46-FA42E7335D6E}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [TCP Query User{9259C60B-CE1F-49EC-B122-430C05E056F6}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [UDP Query User{A2DA6129-E369-4268-945D-4DE7C1807B1C}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [TCP Query User{E990EA0F-5DFC-4551-ACB7-E0357C6C8BA0}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [UDP Query User{4370E049-4C2C-45BF-92BA-A14A79CB579F}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [{3DAEEA3B-3B52-407A-858B-8BF6B1E619A1}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\FaxApplications.exe
FirewallRules: [{0009E842-A273-45D2-8656-C64BF100EEB0}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\DigitalWizards.exe
FirewallRules: [{4E479561-8693-4081-871D-EADD1E42ACBF}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\SendAFax.exe
FirewallRules: [{7B596834-33E0-47ED-8BA1-74AF7BA8FFCF}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\DeviceSetup.exe
FirewallRules: [{BABEE893-2267-4C79-8347-2BB08F7B2838}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
FirewallRules: [{C4840544-DEAC-4056-A89E-628792D3F0B4}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [TCP Query User{6F920D26-E807-4687-B66F-36F8ED337338}C:\users\vmarie\downloads\xeoma_win.exe] => (Allow) C:\users\vmarie\downloads\xeoma_win.exe
FirewallRules: [UDP Query User{C9A81E51-5C31-4A66-9976-906CDB5035CB}C:\users\vmarie\downloads\xeoma_win.exe] => (Allow) C:\users\vmarie\downloads\xeoma_win.exe
FirewallRules: [{D0966357-4A54-4E36-91F4-456D5DCDA303}] => (Allow) C:\Users\Public\Documents\Xeoma\Additional\ffmpeg_011m.exe
FirewallRules: [{523E8302-8370-4EDD-B076-68CB4A86A196}] => (Allow) C:\Users\VMarie\Downloads\xeoma_win.exe
FirewallRules: [{123C89E0-E8B6-438A-B920-80C8558C06D0}] => (Allow) C:\Users\Public\Documents\Xeoma\Additional\ffserver_100.exe
FirewallRules: [{264CD0D0-323C-4A93-ABC5-A0CA786F4D1D}] => (Allow) C:\Users\Public\Documents\Xeoma\Additional\ffserver_100.exe
FirewallRules: [{AB419191-4898-44BE-B861-946D0B6DA3C0}] => (Allow) C:\Users\Public\Documents\Xeoma\Additional\ffmpeg_011m.exe
FirewallRules: [{168B1024-9D1D-40CE-B85C-D10E93A46D10}] => (Allow) C:\Users\VMarie\Downloads\xeoma_win.exe
FirewallRules: [{0E3A981B-DD52-4793-AFDD-3CA4164A1CDA}] => (Allow) C:\Users\Public\Documents\Xeoma\Additional\ffserver_100.exe
FirewallRules: [TCP Query User{113814E5-FF13-4C12-A161-F1ADEF28FFF4}C:\users\vmarie\downloads\ftpserver3lite\ftpserver.exe] => (Allow) C:\users\vmarie\downloads\ftpserver3lite\ftpserver.exe
FirewallRules: [UDP Query User{4C60AE0F-DF6C-4A98-8510-B448EB22F834}C:\users\vmarie\downloads\ftpserver3lite\ftpserver.exe] => (Allow) C:\users\vmarie\downloads\ftpserver3lite\ftpserver.exe
FirewallRules: [{44E83A48-7B4D-4991-AE73-FE47638D984C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5FDF36D1-A79B-426D-B48B-425100EFFF4F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2775CEA8-72E3-4041-A417-720FA4BA1E3D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{87558F93-1ABD-4E84-9E0E-163DF69B1410}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{ABA5FBC3-C172-4098-A80F-3951DBC2FF81}] => (Allow) C:\Program Files (x86)\McAfee\Supportability\MVT\MvtApp.exe
FirewallRules: [{8570FE97-A930-4B5F-B8FA-20F6F4A67AEE}] => (Allow) C:\Program Files (x86)\McAfee\Supportability\MVT\MvtApp.exe
FirewallRules: [TCP Query User{25DF45A6-79A5-4740-830F-72AE48410509}C:\users\vmarie\appdata\local\directv player\ndspcshowserver.exe] => (Allow) C:\users\vmarie\appdata\local\directv player\ndspcshowserver.exe
FirewallRules: [UDP Query User{BCFCE7C9-50F0-4ED1-AB1E-A4CA1BCD5357}C:\users\vmarie\appdata\local\directv player\ndspcshowserver.exe] => (Allow) C:\users\vmarie\appdata\local\directv player\ndspcshowserver.exe
FirewallRules: [TCP Query User{4E649827-A92B-418C-8A2B-BFA5C22FF01A}C:\program files (x86)\kodi\kodi.exe] => (Block) C:\program files (x86)\kodi\kodi.exe
FirewallRules: [UDP Query User{67C519CC-6584-40F9-8FB6-E843B00FB49D}C:\program files (x86)\kodi\kodi.exe] => (Block) C:\program files (x86)\kodi\kodi.exe
FirewallRules: [{E94ACEB2-6935-458C-A8D7-C2F72A35DA76}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
FirewallRules: [{A36C6C96-6D96-46E8-8398-125B0965CCDB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{FCF5BC2E-1087-4B64-8167-A79EFE106336}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe
FirewallRules: [{E5D51EED-EAE2-4428-8B4E-82E7E9A20878}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe
 
==================== Restore Points =========================
 
03-08-2018 23:56:00 Removed iSpyPRO64
 
==================== Faulty Device Manager Devices =============
 
Name: WD SES Device USB Device
Description: WD SES Device USB Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: AntiLog32
Description: AntiLog32
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: AntiLog32
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (08/04/2018 08:02:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program wlmail.exe version 15.4.3538.513 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: 89c
 
Start Time: 01d42c684286528b
 
Termination Time: 41
 
Application Path: C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
 
Report Id: 03b2f601-985c-11e8-a086-047d7b6662b6
 
Error: (08/04/2018 04:00:04 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.
 
Error: (08/04/2018 04:00:04 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.
 
Error: (08/04/2018 03:58:16 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)
Description: Product: Adobe Refresh Manager -- Error 1606.Could not access network location %APPDATA%\.
 
Error: (08/04/2018 03:58:16 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)
Description: Product: Adobe Refresh Manager -- Error 1606.Could not access network location %APPDATA%\.
 
Error: (08/04/2018 03:49:38 AM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: VMarie-PC)
Description: Windows cannot load the user's profile but has logged you on with the default profile for the system. 
 
 DETAIL - Access is denied.
 
Error: (08/03/2018 11:56:36 PM) (Source: MsiInstaller) (EventID: 11001) (User: VMarie-PC)
Description: Product: iSpyPRO64 -- Error 1001. Error 1001. Exception occurred while initializing the installation:
System.IO.FileNotFoundException: Could not load file or assembly 'file:///C:\Program Files\iSpy\iSpyPRO64\InstallHelper.exe' or one of its dependencies. The system cannot find the file specified..(NULL)(NULL)(NULL)(NULL)(NULL)
 
Error: (08/03/2018 11:56:00 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-2659838741-1186510262-2548316083-1000.bak).  hr = 0x80070539, The security ID structure is invalid.
.
 
 
Operation:
   OnIdentify event
   Gathering Writer Data
 
Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {537201a5-ffeb-427c-9140-6b37d9fc013c}
 
 
System errors:
=============
Error: (08/04/2018 03:41:59 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
 
Error: (08/04/2018 02:30:22 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
 
Error: (08/04/2018 01:46:46 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
 
Error: (08/04/2018 01:30:37 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "VMARIE-PC      :20" could not be registered on the interface with IP address 10.245.30.190.
The computer with the IP address 10.244.226.190 did not allow the name to be claimed by
this computer.
 
Error: (08/04/2018 01:30:37 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "VMARIE-PC      :0" could not be registered on the interface with IP address 10.245.30.190.
The computer with the IP address 10.244.226.190 did not allow the name to be claimed by
this computer.
 
Error: (08/04/2018 01:30:37 AM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{E368BD4A-A3E0-4DF9-BC75-294CA6EB2E33} because another computer on the network has the same name.  The server could not start.
 
Error: (08/03/2018 09:30:05 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
 
Error: (08/03/2018 08:23:38 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
 
 
Windows Defender:
===================================
Date: 2017-10-12 09:48:46.013
Description: 
Windows Defender scan has been stopped before completion.
Scan ID:{3670956E-0780-490C-BF46-BB5293FE0429}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan
 
Date: 2014-12-01 19:29:56.317
Description: 
Windows Defender scan has been stopped before completion.
Scan ID:{4C146620-856F-40ED-B753-7526FD034773}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan
 
Date: 2014-06-30 13:52:25.640
Description: 
Windows Defender scan has been stopped before completion.
Scan ID:{554F3534-0694-4724-989F-87D8D03035DE}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan
 
Date: 2014-02-08 14:27:35.343
Description: 
Windows Defender scan has been stopped before completion.
Scan ID:{92A3B2F9-D0E3-4AEC-B661-D228FE094618}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan
 
Date: 2014-10-13 09:56:16.444
Description: 
Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted:Current
Error Code:0x80070002
Error description:The system cannot find the file specified. 
Signature version:0.0.0.0
Engine version:0.0.0.0
 
==================== Memory info =========================== 
 
Processor: AMD A4-3305M APU with Radeon™ HD Graphics
Percentage of memory in use: 64%
Total physical RAM: 3558.87 MB
Available physical RAM: 1250.9 MB
Total Virtual: 6947.52 MB
Available Virtual: 3859.54 MB
 
==================== Drives ================================
 
Drive c: (TI106304W0D) (Fixed) (Total:449.63 GB) (Free:60.3 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (easystore) (Fixed) (Total:3725.99 GB) (Free:2878.4 GB) NTFS
 
\\?\Volume{50987ec4-beb7-11e2-8429-806e6f6e6963}\ (TOSHIBA System Volume) (Fixed) (Total:1.46 GB) (Free:1.27 GB) NTFS
 
==================== MBR & Partition Table ==================
 
==================== End of Addition.txt ============================


BC AdBot (Login to Remove)

 


#2 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,193 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:49 PM

Posted 09 August 2018 - 09:10 PM

Greetings vickimarie33 and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
  • It is important to not run any tools or take any steps other than those I will provide for you.
  • Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
  • Please copy and paste all logs into your post unless otherwise requested.
  • When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
  • If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Thank you for your patience thus far.

Please do this.

===================================================

Rkill

-------------------
  • Please download all 3 versions of RKill by Grinler, not including the zip version, and save them to your desktop
  • Disable your anti-malware software. Please refer to this page if you are not sure how.
  • Double click on Rkill to launch the program. If one download version does not launch try a different one.
  • Note: You may have to run Rkill a few times before it is successful
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • Please copy and paste the contents of the RKill report that will appear on your desktop in your reply (file is also located at c:\rkill.log)
  • Do not reboot your computer after running Rkill. If your computer reboots run Rkill again before continuing on
  • If nothing happens or if the tool does not run, please let me know in your next reply.
  • Attempt to run a FRST scan and post the results
===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Right click on the FRST icon and select Run as administrator
  • Highlight the below information then hit the Ctrl + C keys at the same time
  • The information will be copied invisibly and will be "pasted" into FRST automatically when you click Fix as instructed below
Start::
CloseProcesses:
Startup: C:\Users\VMarie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2014-11-21]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (No File)
GroupPolicyScripts: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
BHO: No Name -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
Toolbar: HKLM - No Name - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
Toolbar: HKLM-x32 - No Name - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
U5 AppMgmt; C:\windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
S1 AntiLog32; \??\C:\windows\system32\drivers\AntiLog64.sys [X]
U0 aswVmm; no ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MREMP50; \??\C:\PROGRA~2\COMMON~1\Motive\MREMP50.SYS [X]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50; \??\C:\PROGRA~2\COMMON~1\Motive\MRESP50.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
S3 panda_url_filteringd; \??\C:\Program Files\Panda Security URL Filtering\panda_url_filteringd.sys [X]
C:\Users\VMarie\AppData\Local\Google\Desktop\Install
Task: {5D75182B-E26A-4FCA-A874-D780F2B621DA} - \IHUninstallTrackingTASK
Task: {E176CAC8-72BA-41C5-A71A-5B4FADADA898} - \IHSelfDeleteTASK
Task: {FED69E6A-AEA1-4530-A0D7-0BBC540A4529} - System32\Tasks\{346656DA-C696-443B-8020-3B271F9791C3} => C:\windows\system32\pcalua.exe -a C:\Users\VMarie\Downloads\mergefilesexcel.exe -d C:\Users\VMarie\Downloads
C:\Users\VMarie\Downloads\mergefilesexcel.exe
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8 [496]
emptytemp:
End::
  • Click Fix
  • When completed he tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • RKill log
  • Fixlog
  • Update on computer performance

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#3 vickimarie33

vickimarie33
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:01:49 PM

Posted 11 August 2018 - 11:58 PM

First off Thank you for helping me.

I will be more prompt from now on.

1-I was unable to get rkill to run

 
2-Fix result of Farbar Recovery Scan Tool (x64) Version: 02.08.2018
Ran by VMarie (09-08-2018 22:16:12) Run:1
Running from C:\Windows\SysWOW64\config\systemprofile\Downloads
Loaded Profiles: False (Available Profiles: VMarie)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
CloseProcesses:
Startup: C:\Users\VMarie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2014-11-21]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (No File)
GroupPolicyScripts: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
BHO: No Name -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
Toolbar: HKLM - No Name - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
Toolbar: HKLM-x32 - No Name - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
U5 AppMgmt; C:\windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
S1 AntiLog32; \??\C:\windows\system32\drivers\AntiLog64.sys [X]
U0 aswVmm; no ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MREMP50; \??\C:\PROGRA~2\COMMON~1\Motive\MREMP50.SYS [X]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50; \??\C:\PROGRA~2\COMMON~1\Motive\MRESP50.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
S3 panda_url_filteringd; \??\C:\Program Files\Panda Security URL Filtering\panda_url_filteringd.sys [X]
C:\Users\VMarie\AppData\Local\Google\Desktop\Install
Task: {5D75182B-E26A-4FCA-A874-D780F2B621DA} - \IHUninstallTrackingTASK
Task: {E176CAC8-72BA-41C5-A71A-5B4FADADA898} - \IHSelfDeleteTASK
Task: {FED69E6A-AEA1-4530-A0D7-0BBC540A4529} - System32\Tasks\{346656DA-C696-443B-8020-3B271F9791C3} => C:\windows\system32\pcalua.exe -a C:\Users\VMarie\Downloads\mergefilesexcel.exe -d C:\Users\VMarie\Downloads
C:\Users\VMarie\Downloads\mergefilesexcel.exe
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8 [496]
emptytemp:
 
*****************
 
Processes closed successfully.
C:\Users\VMarie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk => moved successfully
"C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe" => not found
 
"C:\windows\system32\GroupPolicy\Machine" folder move:
 
Could not move "C:\windows\system32\GroupPolicy\Machine" => Scheduled to move on reboot.
 
C:\windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => removed successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\BHO: No Name -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => not found
HKLM\Software\Classes\CLSID\BHO: No Name -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => not found
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}" => removed successfully
HKLM\Software\Classes\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => not found
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => not found
"HKLM\System\CurrentControlSet\Services\AppMgmt" => removed successfully
AppMgmt => service removed successfully
"HKLM\System\CurrentControlSet\Services\AntiLog32" => removed successfully
AntiLog32 => service removed successfully
"HKLM\System\CurrentControlSet\Services\aswVmm" => removed successfully
aswVmm => service removed successfully
"HKLM\System\CurrentControlSet\Services\catchme" => removed successfully
catchme => service removed successfully
"HKLM\System\CurrentControlSet\Services\MREMP50" => removed successfully
MREMP50 => service removed successfully
"HKLM\System\CurrentControlSet\Services\MREMP50a64" => removed successfully
MREMP50a64 => service removed successfully
"HKLM\System\CurrentControlSet\Services\MREMPR5" => removed successfully
MREMPR5 => service removed successfully
"HKLM\System\CurrentControlSet\Services\MRENDIS5" => removed successfully
MRENDIS5 => service removed successfully
"HKLM\System\CurrentControlSet\Services\MRESP50" => removed successfully
MRESP50 => service removed successfully
"HKLM\System\CurrentControlSet\Services\MRESP50a64" => removed successfully
MRESP50a64 => service removed successfully
"HKLM\System\CurrentControlSet\Services\panda_url_filteringd" => removed successfully
panda_url_filteringd => service removed successfully
"C:\Users\VMarie\AppData\Local\Google\Desktop\Install" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5D75182B-E26A-4FCA-A874-D780F2B621DA}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5D75182B-E26A-4FCA-A874-D780F2B621DA}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E176CAC8-72BA-41C5-A71A-5B4FADADA898}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E176CAC8-72BA-41C5-A71A-5B4FADADA898}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FED69E6A-AEA1-4530-A0D7-0BBC540A4529}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FED69E6A-AEA1-4530-A0D7-0BBC540A4529}" => removed successfully
C:\windows\System32\Tasks\{346656DA-C696-443B-8020-3B271F9791C3} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{346656DA-C696-443B-8020-3B271F9791C3}" => removed successfully
"C:\Users\VMarie\Downloads\mergefilesexcel.exe" => not found
C:\ProgramData\TEMP => ":0FF263E8" ADS removed successfully
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 5667234 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 2288745 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 10350 B
Public => 0 B
ProgramData => 0 B
systemprofile => 73747 B
systemprofile32 => 430772186 B
LocalService => 0 B
NetworkService => 0 B
TEMP => 6574 B
VMarie => 305570548 B
 
RecycleBin => 0 B
EmptyTemp: => 717.9 MB temporary data Removed.
 
================================
 
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 09-08-2018 22:19:01)
 
C:\windows\system32\GroupPolicy\Machine => Is moved successfully
 
==== End of Fixlog 22:19:01 ====
 
3-Computer seems quicker on start up 


#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,193 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:49 PM

Posted 12 August 2018 - 08:29 AM

Very good, thank you.

We attempted to run RKill to potentially increase our chances of successfully running the FRST script. Since the script ran successfully we won't worry about RKill for now.

Please try to successfully log into the VMarie User Profile. If you are unable to do that run the below.

===================================================

Creating a New User Profile With Administrative Privileges

--------------
  • Click Start, type cmd, right click on Command Prompt (or cmd) above and select Run as administrator
  • Type the following after the command prompt, pressing Enter after each line

net user BC /add
net localgroup administrators BC /add

  • Hit Ctrl + Alt + Del at the same time and select Switch User
  • Log into the BC User Profile
  • Test your computer performance
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • VMarie profile load?
  • BC profile results, if necessary

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#5 vickimarie33

vickimarie33
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:01:49 PM

Posted 16 August 2018 - 12:25 AM

I havent been able to get online on my laptop. Im responding to you on my tablet. Its still saying user profile wont load but Im taking it to my brother so he can help me complete the tasks youve asked. He is more knowledgeable. Give me until tomorrow to respond please.
Thanks Vicki

#6 vickimarie33

vickimarie33
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:01:49 PM

Posted 16 August 2018 - 12:34 AM

Every thing i try do I get a warning that my internet security settings are preventing one or more files from being opened. (C:windows\system32\rundll32.exe) and (C:program files(x86)\google\chrome\application\chrome.exe)

#7 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,193 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:49 PM

Posted 16 August 2018 - 08:46 AM

Hi Vicky,

Please try this.

===================================================

Resetting Internet Explorer Settings to Default Using inetcpl.cpl

--------------------
  • Press the Windows Key + R at the same time.
  • Type inetcpl.cpl and hit Enter
  • Click the Advanced tab
  • Under Reset Internet Explorer settings click Reset...
  • On the warning page click Reset again
  • Click Close, then OK
  • Reboot your computer and test the performance
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Results?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,193 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:49 PM

Posted 19 August 2018 - 09:15 AM

Greetings,

===================================================

Do You Still Need Help?

It has been 3 days since my last post.
  • Do you still need help with this?
  • If you have not replied within 48 hours I will assume you have abandoned the Topic and it will be closed.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#9 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,193 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:49 PM

Posted 21 August 2018 - 09:01 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users