Pop ups on any click on a page

[Juliet]

Hi Ben

Can you post the Additional scan again, it was incomplete.

 

May need to uninstall these items for the time being.

Ad-Aware Web Companion (x32 Version: 2.0.1013.2086 - Lavasoft) Hidden

SpyHunter-

Spybot - Search & Destroy

[WsW-WYATT-EARP]

Hi Ben

Can you post the Additional scan again, it was incomplete.

 

May need to uninstall these items for the time being.

Ad-Aware Web Companion (x32 Version: 2.0.1013.2086 - Lavasoft) Hidden

SpyHunter-

Spybot - Search & Destroy

Juliet,

 

I'll repost the log as soon as I get home after work.

 

I only installed them programs to scan before I posted my original logs. I can uninstall them if you want. I just had avg running before all this. I would like to move to avast as well.

[Juliet]

Is "UpdatusUser" a real user?

Loaded Profiles: Ben & UpdatusUser (Available Profiles: Ben & UpdatusUser)

 

Before you try installing Avast, make sure to completely remove/uninstall the other 2 you have on the computer first.

[WsW-WYATT-EARP]

Is "UpdatusUser" a real user?

Loaded Profiles: Ben & UpdatusUser (Available Profiles: Ben & UpdatusUser)

 

Before you try installing Avast, make sure to completely remove/uninstall the other 2 you have on the computer first.

 

I've never seen that user profile, should only be my profile on there.

 

 

I won't install avast until this gets reasolved

[Juliet]

if I'm correct it's for NVidia updates

 

http://www.sevenforums.com/installation-setup/184141-unknown-user-account.html

Edited June 10, 2015 by Juliet

[Juliet]

Post the Addition.txt when you can

[WsW-WYATT-EARP]

Additional scan result of Farbar Recovery Scan Tool (x64) Version:03-06-2015
Ran by Ben at 2015-06-09 21:05:29
Running from C:\Users\Ben\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1628508633-2882252568-2130994149-500 - Administrator - Disabled)
Ben (S-1-5-21-1628508633-2882252568-2130994149-1001 - Administrator - Enabled) => C:\Users\Ben
Guest (S-1-5-21-1628508633-2882252568-2130994149-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1628508633-2882252568-2130994149-1002 - Limited - Enabled)
UpdatusUser (S-1-5-21-1628508633-2882252568-2130994149-1004 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\...\uTorrent) (Version: 3.4.2.34309 - BitTorrent Inc.)
64 Bit HP CIO Components Installer (Version: 16.2.1 - Hewlett-Packard) Hidden
Ad-Aware Web Companion (x32 Version: 2.0.1013.2086 - Lavasoft) Hidden
Adobe Acrobat 9 Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}) (Version: 9.5.5 - Adobe Systems)
Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000004}_955) (Version: - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)
Adobe Creative Suite 5 Design Standard (HKLM-x32\...\{AE29D445-8164-4CD1-8824-FCE85C0BB179}) (Version: 5.0 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)
Avery Wizard 5.0 (HKLM-x32\...\{FC3B3A5D-7058-4627-9F1E-F95CC38B6054}) (Version: 5.0.5 - Avery)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5961 - AVG Technologies)
AVG 2015 (Version: 15.0.4355 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5961 - AVG Technologies) Hidden
AVS Audio Converter 7.2 (HKLM-x32\...\AVS Audio Converter_is1) (Version: 7.2.2.529 - Online Media Technologies Ltd.)
AVS Update Manager 1.0 (HKLM-x32\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.)
AVS Video Converter 8 (HKLM-x32\...\AVS4YOU Video Converter 7_is1) (Version: - Online Media Technologies Ltd.)
AVS4YOU Software Navigator 1.4 (HKLM-x32\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.)
Bigasoft Total Video Converter 3.7.24.4700 (HKLM-x32\...\{a72ce741-1f32-4d79-bffb-a714375c678d}_is1) (Version: - Bigasoft Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
Color Efex Pro 3.0 Complete (HKLM-x32\...\Color Efex Pro 3.0 Complete Stand-Alone) (Version: 3.1.1.0 - Nik Software, Inc.)
Core FTP Pro 2.1 (HKLM-x32\...\Core FTP Pro 2.1) (Version: - )
Dfine 2.0 (HKLM-x32\...\Dfine 2.0) (Version: 2.1.1.2 - Nik Software, Inc.)
DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version: - DVD Shrink)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
HDR Efex Pro (HKLM-x32\...\HDR Efex Pro) (Version: 1.0.0.0 - Nik Software, Inc.)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.20001.0 - IDT)
Imagenomic Noiseware 4.2 Professional Plug-in (build 4205) (HKLM\...\ImagenomicNoisewareProPlugin) (Version: - )
Imagenomic Portraiture 2.3 Plug-in (build 2308) (HKLM\...\ImagenomicPortraiturePlugin) (Version: - )
LavasoftTcpService (x32 Version: 2.3.4.2 - Lavasoft) Hidden
Lexmark 2600 Series (HKLM\...\Lexmark 2600 Series) (Version: - Lexmark International, Inc.)
LG Verizon United Driver (HKLM-x32\...\{A17B9856-40CF-4BEA-BB65-ADB8154A83DC}) (Version: 2.20.0 - LG Electronics)
LightScribe System Software (HKLM-x32\...\{90538B62-F392-4DE1-B886-7B48123866E9}) (Version: 1.18.26.7 - LightScribe)
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Money 98 (HKLM-x32\...\MSMONEYV60) (Version: - )
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office XP Professional with FrontPage (HKLM-x32\...\{90280409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2627.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 38.0.6 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.6 (x86 en-US)) (Version: 38.0.6 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 11 Mini Repack (HKLM\...\NMMS11) (Version: - )
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.10000.1.0 - Nero AG)
NETGEAR Live Parental Controls Management Utility 2.1.5 (HKLM-x32\...\NETGEAR Live Parental Controls Management Utility) (Version: 2.1.5 - )
NVIDIA 3D Vision Driver 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation)
NVIDIA Graphics Driver 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation)
Opanda IExif 2.3 (HKLM-x32\...\Opanda IExif_is1) (Version: 2.3 - Opanda Studio)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Photodex Presenter (HKLM-x32\...\Photodex Presenter) (Version: - Photodex Corporation)
Photodex ProShow Producer version 4.52 (HKLM-x32\...\Photodex ProShow Producer_is1) (Version: - Copyright © 1994-2011 Photodex Corporation)
PhotoWatermark Professional 7 (HKLM-x32\...\PhotoWatermark Professional_is1) (Version: - UniDream Marketing Technologies Inc)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
Sharpener Pro 3.0 (HKLM-x32\...\Sharpener Pro 3.0) (Version: 3.0.1.0 - Nik Software, Inc.)
Silver Efex Pro (HKLM-x32\...\Silver Efex Pro for Stand-Alone) (Version: 1.0.0.7 - Nik Software, Inc.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1194 - SUPERAntiSpyware.com)
System Requirements Lab for Intel (HKLM-x32\...\{C5DA59CF-2BB8-48D5-8E5B-17F2E0F0FEE4}) (Version: 4.5.5.0 - Husdawg, LLC)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Viveza 2 (HKLM-x32\...\Viveza 2) (Version: 2.0.0.9 - Nik Software, Inc.)
VNC Mirror Driver 1.8.0 (HKLM\...\VNCMirror_is1) (Version: 1.8.0 - RealVNC Ltd.)
VNC Printer Driver 1.8.0 (HKLM\...\VNCPrinter_is1) (Version: 1.8.0 - RealVNC Ltd.)
VNC Server 5.0.5 (HKLM\...\RealVNC_is1) (Version: 5.0.5 - RealVNC Ltd)
VNC Viewer 5.0.5 (HKLM\...\RealVNCViewer_is1) (Version: 5.0.5 - RealVNC Ltd)
Vuze (HKLM-x32\...\8461-7759-5462-8226) (Version: 5.5.0.0 - Azureus Software, Inc.)
Vuze Remote Toolbar v11.3 (HKLM-x32\...\{BFD39619-A358-4874-9177-F3B43ADAE8CC}) (Version: 11.3 - Spigot, Inc.) <==== ATTENTION
Web Companion (HKLM-x32\...\{7ADC1B3B-06CB-4EC2-80A7-F063B2C5FE42}_WebCompanion) (Version: 2.0.1013.2086 - Lavasoft)
Winamp (HKLM-x32\...\Winamp) (Version: 5.623 - Nullsoft, Inc)
Winamp Detector Plug-in (HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

06-06-2015 01:00:10 Windows Update
07-06-2015 15:42:48 AA11
07-06-2015 15:48:29 Restore Point Created by FRST
09-06-2015 18:07:20 Restore Point Created by FRST
09-06-2015 19:28:09 Removed Java 8 Update 40

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2015-06-08 18:44 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {039B47EF-932A-449B-BD41-7ED065BF1248} - System32\Tasks\AdobeAAMUpdater-1.0-Ben-PC-Ben => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {135D147D-1406-4CCC-A35D-EAA89FA3FD7D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-08] (Piriform Ltd)
Task: {15B95280-1152-41EA-8536-D1BFCC0705D3} - System32\Tasks\{1D1F9ACF-7813-439B-A078-B5E5C4C4E427} => pcalua.exe -a C:\Users\Ben\Desktop\HijackThis.exe -d C:\Users\Ben\Desktop
Task: {2BE3C332-0D29-456C-8D12-276C73CF2938} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2012-07-22] (Microsoft Corporation)
Task: {301CAF9A-4D77-468D-B0DB-F966DD2D8808} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
Task: {348B180F-F0B0-48D9-9B9A-EBE905BDF644} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {375EA527-3A80-4D30-BBFF-59428DEF7DBA} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {446E469E-ECF7-47FC-A09C-19E747099456} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {4BF848C6-C5BD-464F-8416-1798D44049F0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {4C5EE278-8DDE-4D8A-850C-0EB9CD05B2F5} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-16] (Microsoft Corporation)
Task: {6B054E78-0DB3-4FDC-96E2-7F78F1701738} - System32\Tasks\{67939218-81A2-49B8-9287-67EBF669031D} => pcalua.exe -a "C:\Program Files (x86)\Photodex\ProShow Producer\remove.exe"
Task: {7255DE06-DDC1-4479-8A4F-9D252B4CF0D9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {835C55C7-7D3E-44A3-8C27-9FF16A1DCDEF} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {8F229C1E-EB4D-491B-9808-0C52068605FA} - System32\Tasks\{E2A8B183-BC94-4E0C-9095-FC0A7DEF800A} => pcalua.exe -a C:\Users\Ben\Downloads\pg2-070130.exe -d C:\Users\Ben\Downloads
Task: {956F311D-05DE-4D14-8891-0A4FCDA43A64} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {AD683109-3C7E-484B-AAED-6DF1657585E4} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {D282FB6C-38C9-4471-B4D0-F397995BDEB6} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2012-11-18 02:01 - 2013-10-23 03:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-10-25 03:43 - 2009-08-13 07:06 - 00177152 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxdndrpp.dll
2012-12-02 01:11 - 2010-12-14 11:54 - 00186760 _____ () C:\Program Files (x86)\Photodex\ProShow Producer\scsiaccess.exe
2009-07-23 14:54 - 2009-07-23 14:54 - 01024512 _____ () C:\Windows\system32\lxdndrs64.dll
2009-05-14 08:47 - 2009-05-14 08:47 - 00025088 _____ () C:\Windows\system32\lxdncaps64.dll
2007-10-02 09:51 - 2007-10-02 09:51 - 00054784 _____ () C:\Windows\system32\lxdncnv464.dll
2012-10-03 03:46 - 2009-06-12 16:19 - 00165888 _____ () C:\Program Files\WinRAR\rarext.dll
2012-10-25 03:42 - 2010-02-04 04:05 - 00660136 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exe
2012-10-25 03:42 - 2010-02-04 04:05 - 00025256 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdnMsdMon.exe
2015-06-02 20:33 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-06-02 20:33 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-06-02 20:33 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-06-02 20:33 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-06-02 20:33 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-10-25 03:42 - 2009-07-23 14:48 - 00380928 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdnscw.dll
2012-10-25 03:42 - 2007-05-29 02:39 - 00589824 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdndatr.dll
2012-10-25 03:42 - 2007-03-26 02:39 - 00073728 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdncats.dll
2012-10-25 03:42 - 2009-07-23 14:49 - 00782336 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdnDRS.dll
2012-10-25 03:42 - 2009-05-14 08:46 - 00081920 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdncaps.dll
2012-10-25 03:42 - 2007-10-02 09:51 - 00069632 _____ () C:\Program Files (x86)\Lexmark 2600 Series\lxdncnv4.dll
2012-10-25 03:42 - 2010-02-03 05:21 - 00028672 _____ () C:\Program Files (x86)\Lexmark 2600 Series\App4R.Monitor.Common.dll
2012-10-25 03:42 - 2010-02-03 05:21 - 00036864 _____ () C:\Program Files (x86)\Lexmark 2600 Series\App4R.Monitor.Core.dll
2012-10-25 03:42 - 2010-02-03 05:20 - 00065536 _____ () C:\Program Files (x86)\Lexmark 2600 Series\app4r.devmons.mcmdevmon.dll
2012-10-25 03:42 - 2009-06-26 08:17 - 00012288 _____ () C:\Program Files (x86)\Lexmark 2600 Series\app4r.devmons.mcmdevmon.autoplayutil.dll
2012-05-23 17:00 - 2012-05-23 17:00 - 02408448 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2012-05-23 17:00 - 2012-05-23 17:00 - 08626176 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2012-05-23 17:00 - 2012-05-23 17:00 - 00212992 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2015-05-25 10:23 - 2015-05-25 10:23 - 00078656 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
2015-05-25 10:23 - 2015-05-25 10:23 - 00183656 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
2015-05-25 10:23 - 2015-05-25 10:23 - 00046920 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
2015-05-25 10:24 - 2015-05-25 10:24 - 00123736 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.PUP.Management.dll
2015-05-25 10:23 - 2015-05-25 10:23 - 00015696 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll
2015-05-25 10:24 - 2015-05-25 10:24 - 00073544 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
2015-05-25 10:23 - 2015-05-25 10:23 - 00039256 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Windows:nlsPreferences

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\...\webcompanion.com -> hxxp://webcompanion.com


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Ben\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.27.4

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{032DBD6B-D7AB-4AE4-84C3-A7CDF9D7471D}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{801D0BC6-5E34-4027-BC7E-9961C67756A8}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{E49EE086-455F-4644-BB07-3DE16D2E5C86}] => (Allow) C:\Windows\SysWOW64\lxdncoms.exe
FirewallRules: [{8636B7E5-8E98-4A20-AC42-5A46188B3D38}] => (Allow) C:\Windows\SysWOW64\lxdncoms.exe
FirewallRules: [{EC8E9924-B621-4692-BBB2-5C5CE84A86B6}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\lxdnamon.exe
FirewallRules: [{8FAFE81C-710D-4725-B7F5-C9DAB10389D4}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\lxdnamon.exe
FirewallRules: [{F514A699-1DD5-409A-B3CA-27EF60E6A8F7}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\frun.exe
FirewallRules: [{F03D23CE-387C-490B-BAF5-61012257EC33}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\frun.exe
FirewallRules: [{48FB39C6-1ED2-4DA4-8FB1-7DC100FFFEB6}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exe
FirewallRules: [{8288D249-1D3A-4FD1-BB3C-F3965E48AA63}] => (Allow) C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exe
FirewallRules: [{B677B60D-FA30-45D5-84FD-E20FCF050C6A}] => (Allow) C:\Windows\System32\lxdncoms.exe
FirewallRules: [{58B27833-7576-4AC3-91D7-7213FA40ACA0}] => (Allow) C:\Windows\System32\lxdncoms.exe
FirewallRules: [{3AEA40B5-8673-4F1D-8E5C-36D8CA858605}] => (Allow) C:\Windows\system32\lxdncoms.exe
FirewallRules: [{F1501122-BE70-40E8-BF8F-B6EB86660F6D}] => (Allow) C:\Windows\system32\spool\DRIVERS\x64\3\lxdnpswx.exe
FirewallRules: [{A502F507-5D5B-4410-8140-4485DEC9DC20}] => (Allow) C:\Windows\system32\spool\DRIVERS\x64\3\lxdntime.exe
FirewallRules: [{80EFCF12-EE34-4D46-A032-191BA2198531}] => (Allow) C:\Windows\SysWOW64\lxdncoms.exe
FirewallRules: [TCP Query User{B851AA31-5000-4C1F-948B-24CB938FA8C0}C:\program files (x86)\lexmark 2600 series\lxdnmon.exe] => (Block) C:\program files (x86)\lexmark 2600 series\lxdnmon.exe
FirewallRules: [uDP Query User{EB12A9ED-261A-4B31-B4CB-AED5D818D4BD}C:\program files (x86)\lexmark 2600 series\lxdnmon.exe] => (Block) C:\program files (x86)\lexmark 2600 series\lxdnmon.exe
FirewallRules: [TCP Query User{5B667ABC-BE1F-4BCC-9FE8-8CE1AB132A30}C:\program files (x86)\adobe\acrobat 9.0\acrobat\acrobat.exe] => (Allow) C:\program files (x86)\adobe\acrobat 9.0\acrobat\acrobat.exe
FirewallRules: [uDP Query User{D3018799-FCF2-43FE-8150-388ACB0DF1FD}C:\program files (x86)\adobe\acrobat 9.0\acrobat\acrobat.exe] => (Allow) C:\program files (x86)\adobe\acrobat 9.0\acrobat\acrobat.exe
FirewallRules: [TCP Query User{2A616961-23E5-4507-8B4B-CED89542B033}C:\program files (x86)\lexmark 2600 series\lxdnlscn.exe] => (Block) C:\program files (x86)\lexmark 2600 series\lxdnlscn.exe
FirewallRules: [uDP Query User{EC557D0C-2AA7-4B88-B966-6F1F2DE4F50B}C:\program files (x86)\lexmark 2600 series\lxdnlscn.exe] => (Block) C:\program files (x86)\lexmark 2600 series\lxdnlscn.exe
FirewallRules: [{F2E51D72-47AE-4FB4-8E9B-7610AB7215A8}] => (Allow) C:\Program Files\RealVNC\VNC Server\vncserver.exe
FirewallRules: [{BC45B3B1-1460-4694-B304-F205CB5B9365}] => (Allow) C:\Program Files\RealVNC\VNC Server\vncserver.exe
FirewallRules: [{D50D6A65-FDBE-4585-95A7-25E7596AD1C3}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{53ACC81F-A53F-4DFC-91E7-BBE6192F73CC}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [TCP Query User{EE7F70B6-247D-457F-A80F-9878B4DFB41E}C:\program files (x86)\winamp\winamp.exe] => (Block) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [uDP Query User{B53E7F6A-D002-4FB8-9726-12BDC63AC37D}C:\program files (x86)\winamp\winamp.exe] => (Block) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [{64F9AB0B-8575-4766-BC89-D24004F95511}] => (Allow) C:\Users\Ben\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{1A979AA0-F589-4224-A314-C1B919ECC4D9}] => (Allow) C:\Users\Ben\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{394095FC-56D8-4A2C-B146-8835DD66CF59}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{9BF91785-EC5A-4053-91A9-B788D888022B}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [TCP Query User{D1669505-0256-44BB-810C-7D4275687431}C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe] => (Block) C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe
FirewallRules: [uDP Query User{C71E9749-CDC4-43AE-9F9B-D80975D84E32}C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe] => (Block) C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe
FirewallRules: [{90FC6BDF-BCF1-479F-A046-005C24E36102}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{40EEA8D0-2C36-41BC-868D-A74470EC937A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A900859C-4C20-4C27-B792-44B5DB7BB343}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{730E4462-99BB-4858-B544-48BC2CAB9742}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{DEA53E3A-A1AB-4758-AE03-5484396532FB}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{C205F68A-0F93-4C27-AEF0-D3D124F64FBB}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{8D73116C-B564-4A61-B49B-3FDB493E02C5}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{21C45DE6-AA1F-4BAC-8817-6A6C4E7D5902}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{26BC0433-9FF7-4722-A6B9-4D130E6291D7}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [{EC3B0EA7-04DD-4680-BFCD-00D2654AF05F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Faulty Device Manager Devices =============

Name: PCI Simple Communications Controller
Description: PCI Simple Communications Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/09/2015 07:46:35 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.

Error: (06/09/2015 07:46:35 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.

Error: (06/09/2015 06:07:20 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {28cff1e9-f67a-420f-b462-9a7c34716926}

Error: (06/08/2015 10:09:17 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.

Error: (06/08/2015 06:30:22 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.

Error: (06/08/2015 06:30:22 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.

Error: (06/08/2015 05:13:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program mbar.exe version 1.9.1.1004 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1fac

Start Time: 01d0a1741c68cab7

Termination Time: 0

Application Path: C:\Users\Ben\Desktop\mbar-1.09.1.1004\mbar\mbar.exe

Report Id:

Error: (06/07/2015 03:46:39 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.

Error: (06/07/2015 03:46:39 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.

Error: (06/07/2015 03:42:00 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.


System errors:
=============
Error: (06/09/2015 07:44:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The lxdnCATSCustConnectService service failed to start due to the following error:
%%1053

Error: (06/09/2015 07:44:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the lxdnCATSCustConnectService service to connect.

Error: (06/09/2015 07:42:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (06/09/2015 07:42:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 2 time(s).

Error: (06/09/2015 07:42:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The SAS Core Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NVIDIA Update Service Daemon service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (06/09/2015 07:42:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.


Microsoft Office:
=========================

CodeIntegrity Errors:
===================================
Date: 2015-06-08 18:40:40.975
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-06-08 18:40:40.834
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-12-23 07:10:28.607
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-12-23 07:10:28.553
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-12-23 07:09:20.334
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-12-23 07:09:20.283
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel® Core2 Quad CPU Q8200 @ 2.33GHz
Percentage of memory in use: 24%
Total physical RAM: 8125.31 MB
Available physical RAM: 6118.26 MB
Total Pagefile: 16248.83 MB
Available Pagefile: 13797.51 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.37 GB) (Free:124.84 GB) NTFS
Drive e: (scratch disk) (Fixed) (Total:931.51 GB) (Free:414.81 GB) NTFS
Drive f: (storage) (Fixed) (Total:931.51 GB) (Free:84.68 GB) NTFS
Drive g: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive h: () (Fixed) (Total:931.41 GB) (Free:282.92 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: B1C1A17E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 717A68BD)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 717A68B2)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 62BF841F)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End of log ============================

[Juliet]

For the time being let's make sure these applications get uninstalled.

 

Ad-Aware Web Companion (x32 Version: 2.0.1013.2086 - Lavasoft) Hidden

SpyHunter-

Spybot - Search & Destroy

Vuze Remote Toolbar v11.3 (HKLM-x32\...\{BFD39619-A358-4874-9177-F3B43ADAE8CC}) (Version: 11.3 - Spigot, Inc.) <==== ATTENTION

 

 

~~~~~~~~~~

 

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:

To do this highlight the contents of the box and right click on it and select copy.

Paste this into the open notepad. save it to the Desktop as fixlist.txt

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

 

start

CreateRestorePoint:

CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

FF Plugin: @microsoft.com/GENUINE -> disabled No File

2015-05-25 10:07 - 2015-05-25 10:07 - 06870552 _____ (ParetoLogic, Inc.) C:\Users\Ben\Downloads\RegCureProSetup_f9decd8_.exe

2015-05-25 10:01 - 2015-05-25 10:02 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Ben\Downloads\SpyHunter-Installer.exe

2015-05-25 19:58 - 2012-11-16 14:59 - 00000000 ____D C:\Program Files (x86)\Vuze

C:\Users\Ben\AppData\Local\Temp\Quarantine.exe

C:\Users\Ben\AppData\Local\Temp\sqlite3.dll

H:\Program Files (x86)\Yontoo

AlternateDataStreams: C:\Windows:nlsPreferences

EmptyTemp:

Hosts:

End

Open FRST/FRST64 and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Post this log when you can

 

I don't think we're finished. I've asked someone to take a look at your logs to see if there is anything I'm missing, haven't heard from them yet so hang in there.

[WsW-WYATT-EARP]

fixlog below -

 

I did uninstall the web companion and spybot s&d before through control panel -

 

I still think it's odd that I can get a popup from clicking anywhere on a page - doesn't have to be text or a link. When I highlight the code box, I get a popup and tab. Something mouse driver related? Just throwing things out there....

 

I don't have any problem doing a complete uninstall of firefox and my ff user profile and total fresh reinstall.

 

I don't think I have reinstalled java yet either .... forgot...

 

 

FYI - the H drive was my old install before I went to a SSD drive. I just kept it in the system instead of backing everything up. I did that about 3 years ago.

 

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version:03-06-2015
Ran by Ben at 2015-06-10 18:24:46 Run:3
Running from C:\Users\Ben\Desktop
Loaded Profiles: Ben & UpdatusUser (Available Profiles: Ben & UpdatusUser)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin: @microsoft.com/GENUINE -> disabled No File
2015-05-25 10:07 - 2015-05-25 10:07 - 06870552 _____ (ParetoLogic, Inc.) C:\Users\Ben\Downloads\RegCureProSetup_f9decd8_.exe
2015-05-25 10:01 - 2015-05-25 10:02 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Ben\Downloads\SpyHunter-Installer.exe
2015-05-25 19:58 - 2012-11-16 14:59 - 00000000 ____D C:\Program Files (x86)\Vuze
C:\Users\Ben\AppData\Local\Temp\Quarantine.exe
C:\Users\Ben\AppData\Local\Temp\sqlite3.dll
H:\Program Files (x86)\Yontoo
AlternateDataStreams: C:\Windows:nlsPreferences
EmptyTemp:
Hosts:
End
*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-1628508633-2882252568-2130994149-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
C:\Users\Ben\Downloads\RegCureProSetup_f9decd8_.exe => moved successfully.
C:\Users\Ben\Downloads\SpyHunter-Installer.exe => moved successfully.
C:\Program Files (x86)\Vuze => moved successfully.
C:\Users\Ben\AppData\Local\Temp\Quarantine.exe => moved successfully.
C:\Users\Ben\AppData\Local\Temp\sqlite3.dll => moved successfully.
"H:\Program Files (x86)\Yontoo" => File/Folder not found.
C:\Windows => ":nlsPreferences" ADS removed successfully.
C:\Windows\System32\Drivers\etc\hosts => moved successfully.
Hosts restored successfully.
EmptyTemp: => 49.6 MB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 18:25:00 ====

[Juliet]

I don't have any problem doing a complete uninstall of firefox and my ff user profile and total fresh reinstall.

May end up having to but, let's give this a shot

 

install the ad blocking plug-in for firefox https://addons.mozilla.org/en/firefox/addon/adblock-plus/

when something pops up this should lock it away.

[Juliet]

I still have a couple of questions out that I might not get an answer to till tomorrow.

[WsW-WYATT-EARP]

The adblock is stopping the popups and extra tab coming through - but when it tries to load the popup/tab, firefox flashes.

 

 

I just noticed this - with me typing the reply and mouse sitting still, there is the link on the bottom of the page, like when you mouse over a hyperlink.

 

The link is

 

rdsrv.com/newbidder/click.php?subid=23a667TPPXF6b18Ag...NsaWNrLW9uLWEtcGFnZS9wYWdILTIjZW50cnkxNzk4NTA0&cost=0

 

I know the link is partial and won't work but thats what I see.

[WsW-WYATT-EARP]

http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/potential-malware-rdsrvcom/adab5118-07f8-4020-af94-b6dd3eced7bf

 

this looks exactly what I'm getting

[WsW-WYATT-EARP]

Ok - I checked my router - I have a netgear router, and searched one of the dns addresses it was using

 

https://www.virustotal.com/en/ip-address/217.79.182.212/information/

 

I changed it to using default from ISP

 

I'm going to see how to do a reset and not keep any settings for FF - may require total uninstall like I said before, I don't have much for bookmarks anyways.

[WsW-WYATT-EARP]

Ok - I know I've posted a bunch of times -

 

After resetting my router DNS and resetting FF again - All is well and working.

 

I don't know what this rdsrv.com virus is - but what a pain. I have no more pop-ups, I can click anywhere I want, no tabs popping up.

 

[Juliet]

well now ain't that a hoot!

 

seeing rdsrv.com/newbidder/, I can see quite a bit of info.

If we had run flush/DNS, it would had went poof!

 

so sorry I didn't see it but had no idea what was running in the background.

 

Alright, you wanted to change out antivirus, please use Revo Uninstaller Free to uninstall the ones you want gone before installing the new ones.

 

You think we're ready to remove tools and quarantine folders?

[WsW-WYATT-EARP]

Everything is running great, so I would assume we can start cleaning up the the tools.

 

Should we do a dns flush? Would that of taken care of the router if we had done one?

 

I'll download the uninstaller when I get home.

[Juliet]

Everything is running great, so I would assume we can start cleaning up the the tools.

 

Should we do a dns flush? Would that of taken care of the router if we had done one?

 

I'll download the uninstaller when I get home.

I am very glad it's running good now, as to flushing the DNS, it might have but when you did a router reset, that might have been best.

When it gets into the technical end of those areas I'm a tad lost but, to be honest I had it in mind as a step do do soon.

~~~~~~~~~~~~~~~~~`

Please download MiniToolBox http://www.bleepingcomputer.com/download/minitoolbox/

save it to your desktop and run it.

 

Checkmark the following check-boxes:

 

Flush DNS

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

 

Note: When using Reset FF Proxy Settings option Firefox should be closed.

[WsW-WYATT-EARP]

Juliet - log of minitoolbox is below.

 

I always try to give as much info as I can, during typing out the info I just happened to notice the link at the bottom of firefox like a mouse over. One thing led to another, a search and viola...

 

I just don't know if the dns flush on my system would of resolved the overtake on the router. I just wonder how they are able to change dns settings on the router.

 

MiniToolBox by Farbar Version: 11-05-2015 01
Ran by Ben (administrator) on 11-06-2015 at 18:05:28
Running from "C:\Users\Ben\Desktop"
Microsoft Windows 7 Ultimate Service Pack 1 (X64)
Model: DP35DP__ Manufacturer: INTEL_
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

**** End of log ****

[Juliet]

I would go to a known clean computer and change passwords for banking and other login site information, just thinking security.

 

very possible a vulnerability found in your router?

the router had been hacked and the DNS settings have been modified, Instead of connecting to a clean site or service, youll visit a rogue

~~~

Let's tidy up now.

 

DelFix

• • Please download DelFix
    or from here http://www.bleepingcomputer.com/download/delfix/ and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
    
    • Activate UAC
    • Remove disinfection tools
       
      

  • Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

 

 

~~~~~~~~~~~~

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP
   
  
• The following programmes come highly recommended in the security community.
  
  • AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
  • CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
  • Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
  • Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
  • NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
  • Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
  • Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
  • SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
  • Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

  Want to help others? Join the ClassRoom and learn how.

[WsW-WYATT-EARP]

All squeeky clean -

 

still need to install java and remove avg for avast -

 

Can't thank you enough for the help! I know you were a bit stumped on this as was I - but my system was looked at and whatever was in it - cleaned up.

 

 

Thanks!

Ben

 

 

 

 

# DelFix v1.010 - Logfile created 11/06/2015 at 18:26:08
# Updated 26/04/2015 by Xplode
# Username : Ben - BEN-PC
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)

~ Activating UAC ... OK

~ Removing disinfection tools ...

Deleted : C:\Qoobox
Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\RegBackup
Deleted : C:\ComboFix.txt
Deleted : C:\Users\Ben\Desktop\Addition.txt
Deleted : C:\Users\Ben\Desktop\AdwCleaner.exe
Deleted : C:\Users\Ben\Desktop\aswMBR.exe
Deleted : C:\Users\Ben\Desktop\ComboFix.exe
Deleted : C:\Users\Ben\Desktop\dds.com
Deleted : C:\Users\Ben\Desktop\Fixlog.txt
Deleted : C:\Users\Ben\Desktop\FRST.txt
Deleted : C:\Users\Ben\Desktop\FRST64.exe
Deleted : C:\Users\Ben\Desktop\JRT.exe
Deleted : C:\Users\Ben\Desktop\HijackThis.exe
Deleted : C:\Users\Ben\Desktop\MBR.dat
Deleted : C:\Users\Ben\Desktop\MiniToolBox.exe
Deleted : C:\Users\Ben\Desktop\Result.txt
Deleted : C:\Users\Ben\Downloads\dds.com
Deleted : C:\Users\Ben\Downloads\esetsmartinstaller_enu.exe
Deleted : C:\Users\Ben\Downloads\login.txt
Deleted : C:\Windows\grep.exe
Deleted : C:\Windows\PEV.exe
Deleted : C:\Windows\NIRCMD.exe
Deleted : C:\Windows\MBR.exe
Deleted : C:\Windows\SED.exe
Deleted : C:\Windows\SWREG.exe
Deleted : C:\Windows\SWSC.exe
Deleted : C:\Windows\SWXCACLS.exe
Deleted : C:\Windows\Zip.exe
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\Swearware
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

########## - EOF - ##########

[Juliet]

 

I know you were a bit stumped on this as was I

Yep!!

 

safe surfing!

[Juliet]

Glad we could help.

 

Since this issue appears resolved ... this Topic is closed.