Juliet Posted June 10, 2015 Share Posted June 10, 2015 Hi Ben Can you post the Additional scan again, it was incomplete. May need to uninstall these items for the time being. Ad-Aware Web Companion (x32 Version: 2.0.1013.2086 - Lavasoft) Hidden SpyHunter- Spybot - Search & Destroy Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 10, 2015 Author Share Posted June 10, 2015 Hi Ben Can you post the Additional scan again, it was incomplete. May need to uninstall these items for the time being. Ad-Aware Web Companion (x32 Version: 2.0.1013.2086 - Lavasoft) Hidden SpyHunter- Spybot - Search & Destroy Juliet, I'll repost the log as soon as I get home after work. I only installed them programs to scan before I posted my original logs. I can uninstall them if you want. I just had avg running before all this. I would like to move to avast as well. Link to comment Share on other sites More sharing options...
Juliet Posted June 10, 2015 Share Posted June 10, 2015 Is "UpdatusUser" a real user? Loaded Profiles: Ben & UpdatusUser (Available Profiles: Ben & UpdatusUser) Before you try installing Avast, make sure to completely remove/uninstall the other 2 you have on the computer first. Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 10, 2015 Author Share Posted June 10, 2015 Is "UpdatusUser" a real user? Loaded Profiles: Ben & UpdatusUser (Available Profiles: Ben & UpdatusUser) Before you try installing Avast, make sure to completely remove/uninstall the other 2 you have on the computer first. I've never seen that user profile, should only be my profile on there. I won't install avast until this gets reasolved Link to comment Share on other sites More sharing options...
Juliet Posted June 10, 2015 Share Posted June 10, 2015 (edited) if I'm correct it's for NVidia updates http://www.sevenforums.com/installation-setup/184141-unknown-user-account.html Edited June 10, 2015 by Juliet Link to comment Share on other sites More sharing options...
Juliet Posted June 10, 2015 Share Posted June 10, 2015 Post the Addition.txt when you can Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 10, 2015 Author Share Posted June 10, 2015 Additional scan result of Farbar Recovery Scan Tool (x64) Version:03-06-2015Ran by Ben at 2015-06-09 21:05:29Running from C:\Users\Ben\DesktopBoot Mode: Normal============================================================================== Accounts: =============================Administrator (S-1-5-21-1628508633-2882252568-2130994149-500 - Administrator - Disabled)Ben (S-1-5-21-1628508633-2882252568-2130994149-1001 - Administrator - Enabled) => C:\Users\BenGuest (S-1-5-21-1628508633-2882252568-2130994149-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-1628508633-2882252568-2130994149-1002 - Limited - Enabled)UpdatusUser (S-1-5-21-1628508633-2882252568-2130994149-1004 - Limited - Enabled) => C:\Users\UpdatusUser==================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)µTorrent (HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\...\uTorrent) (Version: 3.4.2.34309 - BitTorrent Inc.)64 Bit HP CIO Components Installer (Version: 16.2.1 - Hewlett-Packard) HiddenAd-Aware Web Companion (x32 Version: 2.0.1013.2086 - Lavasoft) HiddenAdobe Acrobat 9 Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}) (Version: 9.5.5 - Adobe Systems)Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000004}_955) (Version: - Adobe Systems Incorporated)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)Adobe Creative Suite 5 Design Standard (HKLM-x32\...\{AE29D445-8164-4CD1-8824-FCE85C0BB179}) (Version: 5.0 - Adobe Systems Incorporated)Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)Adobe Reader XI (11.0.11) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)Avery Wizard 5.0 (HKLM-x32\...\{FC3B3A5D-7058-4627-9F1E-F95CC38B6054}) (Version: 5.0.5 - Avery)AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5961 - AVG Technologies)AVG 2015 (Version: 15.0.4355 - AVG Technologies) HiddenAVG 2015 (Version: 15.0.5961 - AVG Technologies) HiddenAVS Audio Converter 7.2 (HKLM-x32\...\AVS Audio Converter_is1) (Version: 7.2.2.529 - Online Media Technologies Ltd.)AVS Update Manager 1.0 (HKLM-x32\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.)AVS Video Converter 8 (HKLM-x32\...\AVS4YOU Video Converter 7_is1) (Version: - Online Media Technologies Ltd.)AVS4YOU Software Navigator 1.4 (HKLM-x32\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.)Bigasoft Total Video Converter 3.7.24.4700 (HKLM-x32\...\{a72ce741-1f32-4d79-bffb-a714375c678d}_is1) (Version: - Bigasoft Corporation)CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)Color Efex Pro 3.0 Complete (HKLM-x32\...\Color Efex Pro 3.0 Complete Stand-Alone) (Version: 3.1.1.0 - Nik Software, Inc.)Core FTP Pro 2.1 (HKLM-x32\...\Core FTP Pro 2.1) (Version: - )Dfine 2.0 (HKLM-x32\...\Dfine 2.0) (Version: 2.1.1.2 - Nik Software, Inc.)DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version: - DVD Shrink)ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )HDR Efex Pro (HKLM-x32\...\HDR Efex Pro) (Version: 1.0.0.0 - Nik Software, Inc.)IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.20001.0 - IDT)Imagenomic Noiseware 4.2 Professional Plug-in (build 4205) (HKLM\...\ImagenomicNoisewareProPlugin) (Version: - )Imagenomic Portraiture 2.3 Plug-in (build 2308) (HKLM\...\ImagenomicPortraiturePlugin) (Version: - )LavasoftTcpService (x32 Version: 2.3.4.2 - Lavasoft) HiddenLexmark 2600 Series (HKLM\...\Lexmark 2600 Series) (Version: - Lexmark International, Inc.)LG Verizon United Driver (HKLM-x32\...\{A17B9856-40CF-4BEA-BB65-ADB8154A83DC}) (Version: 2.20.0 - LG Electronics)LightScribe System Software (HKLM-x32\...\{90538B62-F392-4DE1-B886-7B48123866E9}) (Version: 1.18.26.7 - LightScribe)Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Money 98 (HKLM-x32\...\MSMONEYV60) (Version: - )Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)Microsoft Office XP Professional with FrontPage (HKLM-x32\...\{90280409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2627.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Mozilla Firefox 38.0.6 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.6 (x86 en-US)) (Version: 38.0.6 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Nero 11 Mini Repack (HKLM\...\NMMS11) (Version: - )Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.10000.1.0 - Nero AG)NETGEAR Live Parental Controls Management Utility 2.1.5 (HKLM-x32\...\NETGEAR Live Parental Controls Management Utility) (Version: 2.1.5 - )NVIDIA 3D Vision Driver 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation)NVIDIA Graphics Driver 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation)Opanda IExif 2.3 (HKLM-x32\...\Opanda IExif_is1) (Version: 2.3 - Opanda Studio)PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) HiddenPhotodex Presenter (HKLM-x32\...\Photodex Presenter) (Version: - Photodex Corporation)Photodex ProShow Producer version 4.52 (HKLM-x32\...\Photodex ProShow Producer_is1) (Version: - Copyright © 1994-2011 Photodex Corporation)PhotoWatermark Professional 7 (HKLM-x32\...\PhotoWatermark Professional_is1) (Version: - UniDream Marketing Technologies Inc)Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) HiddenSharpener Pro 3.0 (HKLM-x32\...\Sharpener Pro 3.0) (Version: 3.0.1.0 - Nik Software, Inc.)Silver Efex Pro (HKLM-x32\...\Silver Efex Pro for Stand-Alone) (Version: 1.0.0.7 - Nik Software, Inc.)Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1194 - SUPERAntiSpyware.com)System Requirements Lab for Intel (HKLM-x32\...\{C5DA59CF-2BB8-48D5-8E5B-17F2E0F0FEE4}) (Version: 4.5.5.0 - Husdawg, LLC)Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)Viveza 2 (HKLM-x32\...\Viveza 2) (Version: 2.0.0.9 - Nik Software, Inc.)VNC Mirror Driver 1.8.0 (HKLM\...\VNCMirror_is1) (Version: 1.8.0 - RealVNC Ltd.)VNC Printer Driver 1.8.0 (HKLM\...\VNCPrinter_is1) (Version: 1.8.0 - RealVNC Ltd.)VNC Server 5.0.5 (HKLM\...\RealVNC_is1) (Version: 5.0.5 - RealVNC Ltd)VNC Viewer 5.0.5 (HKLM\...\RealVNCViewer_is1) (Version: 5.0.5 - RealVNC Ltd)Vuze (HKLM-x32\...\8461-7759-5462-8226) (Version: 5.5.0.0 - Azureus Software, Inc.)Vuze Remote Toolbar v11.3 (HKLM-x32\...\{BFD39619-A358-4874-9177-F3B43ADAE8CC}) (Version: 11.3 - Spigot, Inc.) <==== ATTENTIONWeb Companion (HKLM-x32\...\{7ADC1B3B-06CB-4EC2-80A7-F063B2C5FE42}_WebCompanion) (Version: 2.0.1013.2086 - Lavasoft)Winamp (HKLM-x32\...\Winamp) (Version: 5.623 - Nullsoft, Inc)Winamp Detector Plug-in (HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )==================== Custom CLSID (Whitelisted): ==========================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)==================== Restore Points =========================06-06-2015 01:00:10 Windows Update07-06-2015 15:42:48 AA1107-06-2015 15:48:29 Restore Point Created by FRST09-06-2015 18:07:20 Restore Point Created by FRST09-06-2015 19:28:09 Removed Java 8 Update 40==================== Hosts content: ===============================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 21:34 - 2015-06-08 18:44 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts127.0.0.1 localhost==================== Scheduled Tasks (Whitelisted) =============(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)Task: {039B47EF-932A-449B-BD41-7ED065BF1248} - System32\Tasks\AdobeAAMUpdater-1.0-Ben-PC-Ben => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)Task: {135D147D-1406-4CCC-A35D-EAA89FA3FD7D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-08] (Piriform Ltd)Task: {15B95280-1152-41EA-8536-D1BFCC0705D3} - System32\Tasks\{1D1F9ACF-7813-439B-A078-B5E5C4C4E427} => pcalua.exe -a C:\Users\Ben\Desktop\HijackThis.exe -d C:\Users\Ben\DesktopTask: {2BE3C332-0D29-456C-8D12-276C73CF2938} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2012-07-22] (Microsoft Corporation)Task: {301CAF9A-4D77-468D-B0DB-F966DD2D8808} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)Task: {348B180F-F0B0-48D9-9B9A-EBE905BDF644} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)Task: {375EA527-3A80-4D30-BBFF-59428DEF7DBA} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)Task: {446E469E-ECF7-47FC-A09C-19E747099456} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)Task: {4BF848C6-C5BD-464F-8416-1798D44049F0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)Task: {4C5EE278-8DDE-4D8A-850C-0EB9CD05B2F5} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-16] (Microsoft Corporation)Task: {6B054E78-0DB3-4FDC-96E2-7F78F1701738} - System32\Tasks\{67939218-81A2-49B8-9287-67EBF669031D} => pcalua.exe -a "C:\Program Files (x86)\Photodex\ProShow Producer\remove.exe"Task: {7255DE06-DDC1-4479-8A4F-9D252B4CF0D9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)Task: {835C55C7-7D3E-44A3-8C27-9FF16A1DCDEF} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)Task: {8F229C1E-EB4D-491B-9808-0C52068605FA} - System32\Tasks\{E2A8B183-BC94-4E0C-9095-FC0A7DEF800A} => pcalua.exe -a C:\Users\Ben\Downloads\pg2-070130.exe -d C:\Users\Ben\DownloadsTask: {956F311D-05DE-4D14-8891-0A4FCDA43A64} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)Task: {AD683109-3C7E-484B-AAED-6DF1657585E4} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasksTask: {D282FB6C-38C9-4471-B4D0-F397995BDEB6} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe==================== Loaded Modules (Whitelisted) ==============2012-11-18 02:01 - 2013-10-23 03:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll2012-10-25 03:43 - 2009-08-13 07:06 - 00177152 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxdndrpp.dll2012-12-02 01:11 - 2010-12-14 11:54 - 00186760 _____ () C:\Program Files (x86)\Photodex\ProShow Producer\scsiaccess.exe2009-07-23 14:54 - 2009-07-23 14:54 - 01024512 _____ () C:\Windows\system32\lxdndrs64.dll2009-05-14 08:47 - 2009-05-14 08:47 - 00025088 _____ () C:\Windows\system32\lxdncaps64.dll2007-10-02 09:51 - 2007-10-02 09:51 - 00054784 _____ () C:\Windows\system32\lxdncnv464.dll2012-10-03 03:46 - 2009-06-12 16:19 - 00165888 _____ () C:\Program Files\WinRAR\rarext.dll2012-10-25 03:42 - 2010-02-04 04:05 - 00660136 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exe2012-10-25 03:42 - 2010-02-04 04:05 - 00025256 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdnMsdMon.exe2015-06-02 20:33 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl2015-06-02 20:33 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl2015-06-02 20:33 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl2015-06-02 20:33 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll2015-06-02 20:33 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll2012-10-25 03:42 - 2009-07-23 14:48 - 00380928 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdnscw.dll2012-10-25 03:42 - 2007-05-29 02:39 - 00589824 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdndatr.dll2012-10-25 03:42 - 2007-03-26 02:39 - 00073728 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdncats.dll2012-10-25 03:42 - 2009-07-23 14:49 - 00782336 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdnDRS.dll2012-10-25 03:42 - 2009-05-14 08:46 - 00081920 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdncaps.dll2012-10-25 03:42 - 2007-10-02 09:51 - 00069632 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdncnv4.dll2012-10-25 03:42 - 2010-02-03 05:21 - 00028672 _____ () C:\Program Files (x86)\Lexmark 2600 Series\App4R.Monitor.Common.dll2012-10-25 03:42 - 2010-02-03 05:21 - 00036864 _____ () C:\Program Files (x86)\Lexmark 2600 Series\App4R.Monitor.Core.dll2012-10-25 03:42 - 2010-02-03 05:20 - 00065536 _____ () C:\Program Files (x86)\Lexmark 2600 Series\app4r.devmons.mcmdevmon.dll2012-10-25 03:42 - 2009-06-26 08:17 - 00012288 _____ () C:\Program Files (x86)\Lexmark 2600 Series\app4r.devmons.mcmdevmon.autoplayutil.dll2012-05-23 17:00 - 2012-05-23 17:00 - 02408448 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll2012-05-23 17:00 - 2012-05-23 17:00 - 08626176 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll2012-05-23 17:00 - 2012-05-23 17:00 - 00212992 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll2015-05-25 10:23 - 2015-05-25 10:23 - 00078656 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll2015-05-25 10:23 - 2015-05-25 10:23 - 00183656 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll2015-05-25 10:23 - 2015-05-25 10:23 - 00046920 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll2015-05-25 10:24 - 2015-05-25 10:24 - 00123736 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.PUP.Management.dll2015-05-25 10:23 - 2015-05-25 10:23 - 00015696 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll2015-05-25 10:24 - 2015-05-25 10:24 - 00073544 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll2015-05-25 10:23 - 2015-05-25 10:23 - 00039256 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll==================== Alternate Data Streams (Whitelisted) =========(If an entry is included in the fixlist, only the ADS will be removed.)AlternateDataStreams: C:\Windows:nlsPreferences==================== Safe Mode (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (Whitelisted) ===============(If an entry is included in the fixlist, the registry item will be restored to default or removed.)==================== Internet Explorer trusted/restricted ===============(If an entry is included in the fixlist, it will be removed from the registry.)IE trusted site: HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\...\localhost -> localhostIE trusted site: HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\...\webcompanion.com -> hxxp://webcompanion.com==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Ben\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgDNS Servers: 192.168.27.4==================== MSCONFIG/TASK MANAGER disabled items ==(Currently there is no automatic fix for this section.)==================== FirewallRules (Whitelisted) ===============(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)FirewallRules: [{032DBD6B-D7AB-4AE4-84C3-A7CDF9D7471D}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exeFirewallRules: [{801D0BC6-5E34-4027-BC7E-9961C67756A8}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exeFirewallRules: [{E49EE086-455F-4644-BB07-3DE16D2E5C86}] => (Allow) C:\Windows\SysWOW64\lxdncoms.exeFirewallRules: [{8636B7E5-8E98-4A20-AC42-5A46188B3D38}] => (Allow) C:\Windows\SysWOW64\lxdncoms.exeFirewallRules: [{EC8E9924-B621-4692-BBB2-5C5CE84A86B6}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\lxdnamon.exeFirewallRules: [{8FAFE81C-710D-4725-B7F5-C9DAB10389D4}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\lxdnamon.exeFirewallRules: [{F514A699-1DD5-409A-B3CA-27EF60E6A8F7}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\frun.exeFirewallRules: [{F03D23CE-387C-490B-BAF5-61012257EC33}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\frun.exeFirewallRules: [{48FB39C6-1ED2-4DA4-8FB1-7DC100FFFEB6}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exeFirewallRules: [{8288D249-1D3A-4FD1-BB3C-F3965E48AA63}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exeFirewallRules: [{B677B60D-FA30-45D5-84FD-E20FCF050C6A}] => (Allow) C:\Windows\System32\lxdncoms.exeFirewallRules: [{58B27833-7576-4AC3-91D7-7213FA40ACA0}] => (Allow) C:\Windows\System32\lxdncoms.exeFirewallRules: [{3AEA40B5-8673-4F1D-8E5C-36D8CA858605}] => (Allow) C:\Windows\system32\lxdncoms.exeFirewallRules: [{F1501122-BE70-40E8-BF8F-B6EB86660F6D}] => (Allow) C:\Windows\system32\spool\DRIVERS\x64\3\lxdnpswx.exeFirewallRules: [{A502F507-5D5B-4410-8140-4485DEC9DC20}] => (Allow) C:\Windows\system32\spool\DRIVERS\x64\3\lxdntime.exeFirewallRules: [{80EFCF12-EE34-4D46-A032-191BA2198531}] => (Allow) C:\Windows\SysWOW64\lxdncoms.exeFirewallRules: [TCP Query User{B851AA31-5000-4C1F-948B-24CB938FA8C0}C:\program files (x86)\lexmark 2600 series\lxdnmon.exe] => (Block) C:\program files (x86)\lexmark 2600 series\lxdnmon.exeFirewallRules: [uDP Query User{EB12A9ED-261A-4B31-B4CB-AED5D818D4BD}C:\program files (x86)\lexmark 2600 series\lxdnmon.exe] => (Block) C:\program files (x86)\lexmark 2600 series\lxdnmon.exeFirewallRules: [TCP Query User{5B667ABC-BE1F-4BCC-9FE8-8CE1AB132A30}C:\program files (x86)\adobe\acrobat 9.0\acrobat\acrobat.exe] => (Allow) C:\program files (x86)\adobe\acrobat 9.0\acrobat\acrobat.exeFirewallRules: [uDP Query User{D3018799-FCF2-43FE-8150-388ACB0DF1FD}C:\program files (x86)\adobe\acrobat 9.0\acrobat\acrobat.exe] => (Allow) C:\program files (x86)\adobe\acrobat 9.0\acrobat\acrobat.exeFirewallRules: [TCP Query User{2A616961-23E5-4507-8B4B-CED89542B033}C:\program files (x86)\lexmark 2600 series\lxdnlscn.exe] => (Block) C:\program files (x86)\lexmark 2600 series\lxdnlscn.exeFirewallRules: [uDP Query User{EC557D0C-2AA7-4B88-B966-6F1F2DE4F50B}C:\program files (x86)\lexmark 2600 series\lxdnlscn.exe] => (Block) C:\program files (x86)\lexmark 2600 series\lxdnlscn.exeFirewallRules: [{F2E51D72-47AE-4FB4-8E9B-7610AB7215A8}] => (Allow) C:\Program Files\RealVNC\VNC Server\vncserver.exeFirewallRules: [{BC45B3B1-1460-4694-B304-F205CB5B9365}] => (Allow) C:\Program Files\RealVNC\VNC Server\vncserver.exeFirewallRules: [{D50D6A65-FDBE-4585-95A7-25E7596AD1C3}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exeFirewallRules: [{53ACC81F-A53F-4DFC-91E7-BBE6192F73CC}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exeFirewallRules: [TCP Query User{EE7F70B6-247D-457F-A80F-9878B4DFB41E}C:\program files (x86)\winamp\winamp.exe] => (Block) C:\program files (x86)\winamp\winamp.exeFirewallRules: [uDP Query User{B53E7F6A-D002-4FB8-9726-12BDC63AC37D}C:\program files (x86)\winamp\winamp.exe] => (Block) C:\program files (x86)\winamp\winamp.exeFirewallRules: [{64F9AB0B-8575-4766-BC89-D24004F95511}] => (Allow) C:\Users\Ben\AppData\Roaming\uTorrent\uTorrent.exeFirewallRules: [{1A979AA0-F589-4224-A314-C1B919ECC4D9}] => (Allow) C:\Users\Ben\AppData\Roaming\uTorrent\uTorrent.exeFirewallRules: [{394095FC-56D8-4A2C-B146-8835DD66CF59}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exeFirewallRules: [{9BF91785-EC5A-4053-91A9-B788D888022B}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exeFirewallRules: [TCP Query User{D1669505-0256-44BB-810C-7D4275687431}C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe] => (Block) C:\program files (x86)\nero\nero 11\nero backitup\backitup.exeFirewallRules: [uDP Query User{C71E9749-CDC4-43AE-9F9B-D80975D84E32}C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe] => (Block) C:\program files (x86)\nero\nero 11\nero backitup\backitup.exeFirewallRules: [{90FC6BDF-BCF1-479F-A046-005C24E36102}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exeFirewallRules: [{40EEA8D0-2C36-41BC-868D-A74470EC937A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exeFirewallRules: [{A900859C-4C20-4C27-B792-44B5DB7BB343}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exeFirewallRules: [{730E4462-99BB-4858-B544-48BC2CAB9742}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exeFirewallRules: [{DEA53E3A-A1AB-4758-AE03-5484396532FB}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exeFirewallRules: [{C205F68A-0F93-4C27-AEF0-D3D124F64FBB}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exeFirewallRules: [{8D73116C-B564-4A61-B49B-3FDB493E02C5}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exeFirewallRules: [{21C45DE6-AA1F-4BAC-8817-6A6C4E7D5902}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exeFirewallRules: [{26BC0433-9FF7-4722-A6B9-4D130E6291D7}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exeFirewallRules: [{EC3B0EA7-04DD-4680-BFCD-00D2654AF05F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exeStandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray accessStandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner ServiceStandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 UpdaterStandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service==================== Faulty Device Manager Devices =============Name: PCI Simple Communications ControllerDescription: PCI Simple Communications ControllerClass Guid:Manufacturer:Service:Problem: : The drivers for this device are not installed. (Code 28)Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.==================== Event log errors: =========================Application errors:==================Error: (06/09/2015 07:46:35 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.Error: (06/09/2015 07:46:35 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.Error: (06/09/2015 06:07:20 PM) (Source: VSS) (EventID: 8194) (User: )Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied..This is often caused by incorrect security settings in either the writer or requestor process.Operation: Gathering Writer DataContext: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Name: System Writer Writer Instance ID: {28cff1e9-f67a-420f-b462-9a7c34716926}Error: (06/08/2015 10:09:17 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.Error: (06/08/2015 06:30:22 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.Error: (06/08/2015 06:30:22 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.Error: (06/08/2015 05:13:43 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program mbar.exe version 1.9.1.1004 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.Process ID: 1facStart Time: 01d0a1741c68cab7Termination Time: 0Application Path: C:\Users\Ben\Desktop\mbar-1.09.1.1004\mbar\mbar.exeReport Id:Error: (06/07/2015 03:46:39 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.Error: (06/07/2015 03:46:39 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.Error: (06/07/2015 03:42:00 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.System errors:=============Error: (06/09/2015 07:44:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The lxdnCATSCustConnectService service failed to start due to the following error:%%1053Error: (06/09/2015 07:44:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: A timeout was reached (30000 milliseconds) while waiting for the lxdnCATSCustConnectService service to connect.Error: (06/09/2015 07:42:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )Description: The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.Error: (06/09/2015 07:42:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 2 time(s).Error: (06/09/2015 07:42:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )Description: The SAS Core Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )Description: The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: The NVIDIA Update Service Daemon service terminated unexpectedly. It has done this 1 time(s).Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.Microsoft Office:=========================CodeIntegrity Errors:=================================== Date: 2015-06-08 18:40:40.975 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2015-06-08 18:40:40.834 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-12-23 07:10:28.607 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-12-23 07:10:28.553 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-12-23 07:09:20.334 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-12-23 07:09:20.283 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.==================== Memory info ===========================Processor: Intel® Core2 Quad CPU Q8200 @ 2.33GHzPercentage of memory in use: 24%Total physical RAM: 8125.31 MBAvailable physical RAM: 6118.26 MBTotal Pagefile: 16248.83 MBAvailable Pagefile: 13797.51 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.85 MB==================== Drives ================================Drive c: () (Fixed) (Total:238.37 GB) (Free:124.84 GB) NTFSDrive e: (scratch disk) (Fixed) (Total:931.51 GB) (Free:414.81 GB) NTFSDrive f: (storage) (Fixed) (Total:931.51 GB) (Free:84.68 GB) NTFSDrive g: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive h: () (Fixed) (Total:931.41 GB) (Free:282.92 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: B1C1A17E)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)========================================================Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 717A68BD)Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)========================================================Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 717A68B2)Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)========================================================Disk: 3 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 62BF841F)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)==================== End of log ============================ Link to comment Share on other sites More sharing options...
Juliet Posted June 10, 2015 Share Posted June 10, 2015 For the time being let's make sure these applications get uninstalled. Ad-Aware Web Companion (x32 Version: 2.0.1013.2086 - Lavasoft) Hidden SpyHunter- Spybot - Search & Destroy Vuze Remote Toolbar v11.3 (HKLM-x32\...\{BFD39619-A358-4874-9177-F3B43ADAE8CC}) (Version: 11.3 - Spigot, Inc.) <==== ATTENTION ~~~~~~~~~~ Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below: To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. save it to the Desktop as fixlist.txt NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow) start CreateRestorePoint: CloseProcesses: HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = FF Plugin: @microsoft.com/GENUINE -> disabled No File 2015-05-25 10:07 - 2015-05-25 10:07 - 06870552 _____ (ParetoLogic, Inc.) C:\Users\Ben\Downloads\RegCureProSetup_f9decd8_.exe 2015-05-25 10:01 - 2015-05-25 10:02 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Ben\Downloads\SpyHunter-Installer.exe 2015-05-25 19:58 - 2012-11-16 14:59 - 00000000 ____D C:\Program Files (x86)\Vuze C:\Users\Ben\AppData\Local\Temp\Quarantine.exe C:\Users\Ben\AppData\Local\Temp\sqlite3.dll H:\Program Files (x86)\Yontoo AlternateDataStreams: C:\Windows:nlsPreferences EmptyTemp: Hosts: End Open FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply. Post this log when you can I don't think we're finished. I've asked someone to take a look at your logs to see if there is anything I'm missing, haven't heard from them yet so hang in there. Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 10, 2015 Author Share Posted June 10, 2015 fixlog below - I did uninstall the web companion and spybot s&d before through control panel - I still think it's odd that I can get a popup from clicking anywhere on a page - doesn't have to be text or a link. When I highlight the code box, I get a popup and tab. Something mouse driver related? Just throwing things out there.... I don't have any problem doing a complete uninstall of firefox and my ff user profile and total fresh reinstall. I don't think I have reinstalled java yet either .... forgot... FYI - the H drive was my old install before I went to a SSD drive. I just kept it in the system instead of backing everything up. I did that about 3 years ago. Fix result of Farbar Recovery Scan Tool (x64) Version:03-06-2015Ran by Ben at 2015-06-10 18:24:46 Run:3Running from C:\Users\Ben\DesktopLoaded Profiles: Ben & UpdatusUser (Available Profiles: Ben & UpdatusUser)Boot Mode: Normal==============================================fixlist content:*****************startCreateRestorePoint:CloseProcesses:HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTIONHKU\S-1-5-21-1628508633-2882252568-2130994149-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTIONSearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =FF Plugin: @microsoft.com/GENUINE -> disabled No File2015-05-25 10:07 - 2015-05-25 10:07 - 06870552 _____ (ParetoLogic, Inc.) C:\Users\Ben\Downloads\RegCureProSetup_f9decd8_.exe2015-05-25 10:01 - 2015-05-25 10:02 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Ben\Downloads\SpyHunter-Installer.exe2015-05-25 19:58 - 2012-11-16 14:59 - 00000000 ____D C:\Program Files (x86)\VuzeC:\Users\Ben\AppData\Local\Temp\Quarantine.exeC:\Users\Ben\AppData\Local\Temp\sqlite3.dllH:\Program Files (x86)\YontooAlternateDataStreams: C:\Windows:nlsPreferencesEmptyTemp:Hosts:End*****************Restore point was successfully created.Processes closed successfully."HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully"HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfullyHKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfullyHKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfullyHKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfullyC:\Users\Ben\Downloads\RegCureProSetup_f9decd8_.exe => moved successfully.C:\Users\Ben\Downloads\SpyHunter-Installer.exe => moved successfully.C:\Program Files (x86)\Vuze => moved successfully.C:\Users\Ben\AppData\Local\Temp\Quarantine.exe => moved successfully.C:\Users\Ben\AppData\Local\Temp\sqlite3.dll => moved successfully."H:\Program Files (x86)\Yontoo" => File/Folder not found.C:\Windows => ":nlsPreferences" ADS removed successfully.C:\Windows\System32\Drivers\etc\hosts => moved successfully.Hosts restored successfully.EmptyTemp: => 49.6 MB temporary data Removed.The system needed a reboot..==== End of Fixlog 18:25:00 ==== Link to comment Share on other sites More sharing options...
Juliet Posted June 11, 2015 Share Posted June 11, 2015 I don't have any problem doing a complete uninstall of firefox and my ff user profile and total fresh reinstall.May end up having to but, let's give this a shot install the ad blocking plug-in for firefox https://addons.mozilla.org/en/firefox/addon/adblock-plus/ when something pops up this should lock it away. Link to comment Share on other sites More sharing options...
Juliet Posted June 11, 2015 Share Posted June 11, 2015 I still have a couple of questions out that I might not get an answer to till tomorrow. Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 11, 2015 Author Share Posted June 11, 2015 The adblock is stopping the popups and extra tab coming through - but when it tries to load the popup/tab, firefox flashes. I just noticed this - with me typing the reply and mouse sitting still, there is the link on the bottom of the page, like when you mouse over a hyperlink. The link is rdsrv.com/newbidder/click.php?subid=23a667TPPXF6b18Ag...NsaWNrLW9uLWEtcGFnZS9wYWdILTIjZW50cnkxNzk4NTA0&cost=0 I know the link is partial and won't work but thats what I see. Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 11, 2015 Author Share Posted June 11, 2015 http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/potential-malware-rdsrvcom/adab5118-07f8-4020-af94-b6dd3eced7bf this looks exactly what I'm getting Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 11, 2015 Author Share Posted June 11, 2015 Ok - I checked my router - I have a netgear router, and searched one of the dns addresses it was using https://www.virustotal.com/en/ip-address/217.79.182.212/information/ I changed it to using default from ISP I'm going to see how to do a reset and not keep any settings for FF - may require total uninstall like I said before, I don't have much for bookmarks anyways. Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 11, 2015 Author Share Posted June 11, 2015 Ok - I know I've posted a bunch of times - After resetting my router DNS and resetting FF again - All is well and working. I don't know what this rdsrv.com virus is - but what a pain. I have no more pop-ups, I can click anywhere I want, no tabs popping up. Link to comment Share on other sites More sharing options...
Juliet Posted June 11, 2015 Share Posted June 11, 2015 well now ain't that a hoot! seeing rdsrv.com/newbidder/, I can see quite a bit of info. If we had run flush/DNS, it would had went poof! so sorry I didn't see it but had no idea what was running in the background. Alright, you wanted to change out antivirus, please use Revo Uninstaller Free to uninstall the ones you want gone before installing the new ones. You think we're ready to remove tools and quarantine folders? Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 11, 2015 Author Share Posted June 11, 2015 Everything is running great, so I would assume we can start cleaning up the the tools. Should we do a dns flush? Would that of taken care of the router if we had done one? I'll download the uninstaller when I get home. Link to comment Share on other sites More sharing options...
Juliet Posted June 11, 2015 Share Posted June 11, 2015 Everything is running great, so I would assume we can start cleaning up the the tools. Should we do a dns flush? Would that of taken care of the router if we had done one? I'll download the uninstaller when I get home. I am very glad it's running good now, as to flushing the DNS, it might have but when you did a router reset, that might have been best. When it gets into the technical end of those areas I'm a tad lost but, to be honest I had it in mind as a step do do soon. ~~~~~~~~~~~~~~~~~` Please download MiniToolBox http://www.bleepingcomputer.com/download/minitoolbox/ save it to your desktop and run it. Checkmark the following check-boxes: Flush DNS Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run. Note: When using Reset FF Proxy Settings option Firefox should be closed. Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 11, 2015 Author Share Posted June 11, 2015 Juliet - log of minitoolbox is below. I always try to give as much info as I can, during typing out the info I just happened to notice the link at the bottom of firefox like a mouse over. One thing led to another, a search and viola... I just don't know if the dns flush on my system would of resolved the overtake on the router. I just wonder how they are able to change dns settings on the router. MiniToolBox by Farbar Version: 11-05-2015 01Ran by Ben (administrator) on 11-06-2015 at 18:05:28Running from "C:\Users\Ben\Desktop"Microsoft Windows 7 Ultimate Service Pack 1 (X64)Model: DP35DP__ Manufacturer: INTEL_Boot Mode: Normal***************************************************************************========================= Flush DNS: ===================================Windows IP ConfigurationSuccessfully flushed the DNS Resolver Cache.**** End of log **** Link to comment Share on other sites More sharing options...
Juliet Posted June 11, 2015 Share Posted June 11, 2015 I would go to a known clean computer and change passwords for banking and other login site information, just thinking security. very possible a vulnerability found in your router? the router had been hacked and the DNS settings have been modified, Instead of connecting to a clean site or service, youll visit a rogue ~~~ Let's tidy up now. DelFix Please download DelFix or from here http://www.bleepingcomputer.com/download/delfix/ and save the file to your Desktop. Double-click DelFix.exe to run the programme. Place a checkmark next to the following items:Activate UAC Remove disinfection tools Click the Run button. -- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete). ~~~~~~~~~~~~ Answers to common security questions - Best Practices by quietman7, MVP How Malware Spreads - How did I get infected? by quietman7, MVP Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP How to Prevent Malware by miekiemoes, MVP How to backup and restore your data using Cobian Backup by YourHighness Slow Computer/browser? It May Not Be Malware by quietman7, MVP The following programmes come highly recommended in the security community. AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads. CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted. Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software. Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution. NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology. Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you. Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you. SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies. Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website. Want to help others? Join the ClassRoom and learn how. Link to comment Share on other sites More sharing options...
WsW-WYATT-EARP Posted June 11, 2015 Author Share Posted June 11, 2015 All squeeky clean - still need to install java and remove avg for avast - Can't thank you enough for the help! I know you were a bit stumped on this as was I - but my system was looked at and whatever was in it - cleaned up. Thanks! Ben # DelFix v1.010 - Logfile created 11/06/2015 at 18:26:08# Updated 26/04/2015 by Xplode# Username : Ben - BEN-PC# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)~ Activating UAC ... OK~ Removing disinfection tools ...Deleted : C:\QooboxDeleted : C:\FRSTDeleted : C:\AdwCleanerDeleted : C:\RegBackupDeleted : C:\ComboFix.txtDeleted : C:\Users\Ben\Desktop\Addition.txtDeleted : C:\Users\Ben\Desktop\AdwCleaner.exeDeleted : C:\Users\Ben\Desktop\aswMBR.exeDeleted : C:\Users\Ben\Desktop\ComboFix.exeDeleted : C:\Users\Ben\Desktop\dds.comDeleted : C:\Users\Ben\Desktop\Fixlog.txtDeleted : C:\Users\Ben\Desktop\FRST.txtDeleted : C:\Users\Ben\Desktop\FRST64.exeDeleted : C:\Users\Ben\Desktop\JRT.exeDeleted : C:\Users\Ben\Desktop\HijackThis.exeDeleted : C:\Users\Ben\Desktop\MBR.datDeleted : C:\Users\Ben\Desktop\MiniToolBox.exeDeleted : C:\Users\Ben\Desktop\Result.txtDeleted : C:\Users\Ben\Downloads\dds.comDeleted : C:\Users\Ben\Downloads\esetsmartinstaller_enu.exeDeleted : C:\Users\Ben\Downloads\login.txtDeleted : C:\Windows\grep.exeDeleted : C:\Windows\PEV.exeDeleted : C:\Windows\NIRCMD.exeDeleted : C:\Windows\MBR.exeDeleted : C:\Windows\SED.exeDeleted : C:\Windows\SWREG.exeDeleted : C:\Windows\SWSC.exeDeleted : C:\Windows\SWXCACLS.exeDeleted : C:\Windows\Zip.exeDeleted : HKLM\SOFTWARE\AdwCleanerDeleted : HKLM\SOFTWARE\SwearwareDeleted : HKLM\SOFTWARE\TrendMicro\HijackthisDeleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exeDeleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR########## - EOF - ########## Link to comment Share on other sites More sharing options...
Juliet Posted June 11, 2015 Share Posted June 11, 2015 I know you were a bit stumped on this as was I Yep!! safe surfing! Link to comment Share on other sites More sharing options...
Juliet Posted June 13, 2015 Share Posted June 13, 2015 Glad we could help. Since this issue appears resolved ... this Topic is closed. Link to comment Share on other sites More sharing options...
Recommended Posts