[Solved]Need help with possible adware problem

jimmyedwards · August 30, 2018

I have an ad blocker and I scan with mbam and windows defender regular but I am still getting these pop ups . They really come a lot if I try to copy and paste a link . Help.

Starbuck · August 31, 2018

Hi Jimmy,

Ok a couple of things for you to do.

Step 1

Download AdwCleaner to your Desktop
Right-click on AdwCleaner.exe and select Run as Administrator
Accept the EULA , then click on Scan
Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button.
This will kill all active processes
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
After the restart, a log will open when logging in.
Please copy/paste the content of that log in your next reply

Step 2

Note:

There are both 32-bit and 64-bit versions of Farbar Recovery Scan Tool available. Please pick the version that matches your operating system's bit type.

If you are unsure what you're system bit type is..... click Here for help.

For x32 bit systems download Farbar Recovery Scan Tool and save it to your Desktop.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to your Desktop.

Double-click the downloaded icon to run the tool. Vista/Windows 7/8/10 users right-click and select Run As Administrator
When the tool opens click Yes to disclaimer.
Make sure that Addition.txt is selected at the bottom
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). Please copy and paste it to your reply also.

In your next reply, please submit:

AdwCleaner report

Both reports from FRST.

This will give us a better understanding of what is going on.

Thanks.

jimmyedwards · August 31, 2018

Thanks for your reply, I did those tasks and I am sending the reports. I copied one of the pop ups url or something . In the address bar was this pcsupportdesk.co/lp30M/ and it said ad arcade loot.

# -------------------------------

# Malwarebytes AdwCleaner 7.2.2.0

# -------------------------------

# Build: 07-17-2018

# Database: 2018-08-30.1

# Support: Customer Support & Help Center

#

# -------------------------------

# Mode: Clean

# -------------------------------

# Start: 08-31-2018

# Duration: 00:00:02

# OS: Windows 8.1

# Cleaned: 0

# Failed: 0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

*************************

[+] Delete Tracing Keys

[+] Reset Winsock

*************************

AdwCleaner[s00].txt - [4635 octets] - [24/08/2018 17:42:20]

AdwCleaner[C00].txt - [4241 octets] - [24/08/2018 17:44:14]

AdwCleaner[s01].txt - [1360 octets] - [31/08/2018 19:04:23]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########

*************************************************************************************************************************************************

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23.08.2018

Ran by Jimmy Edwards (31-08-2018 19:21:20)

Running from C:\Users\Ray\Downloads

Windows 8.1 (Update) (X64) (2014-10-22 20:35:15)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2801032338-2342425128-3870613798-500 - Administrator - Disabled) => C:\Users\Administrator

Guest (S-1-5-21-2801032338-2342425128-3870613798-501 - Limited - Disabled)

Jimmy Edwards (S-1-5-21-2801032338-2342425128-3870613798-1001 - Administrator - Enabled) => C:\Users\Ray

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4500_G510af_Help (HKLM-x32\...\{C175D5B0-ED04-42C9-B23F-D8BD406173E7}) (Version: 1.00.0000 - Hewlett-Packard) Hidden

4500G510af (HKLM-x32\...\{8B9F50F9-BA6F-47c5-990B-76A74A1C68B0}) (Version: 140.0.001.000 - Hewlett-Packard) Hidden

4500G510af_Software_Min (HKLM-x32\...\{3EB6F78A-66E3-434f-BD0E-76C7D078DB5E}) (Version: 140.0.001.000 - Hewlett-Packard) Hidden

64 Bit HP CIO Components Installer (HKLM\...\{FF21C3E6-97FD-474F-9518-8DCBE94C2854}) (Version: 7.2.8 - Hewlett-Packard) Hidden

Adobe Flash Player 30 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 30.0.0.154 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.9.160 - Adobe Systems, Inc.)

Aimersoft Audio Converter(Build 1.1.41) (HKLM-x32\...\Aimersoft Audio Converter_is1) (Version: - Aimersoft Software)

Aimersoft DVD Creator(Build 1.1.22) (HKLM-x32\...\Aimersoft DVD Creator_is1) (Version: - Aimersoft Software)

Aimersoft DVD Ripper(Build 1.1.41) (HKLM-x32\...\Aimersoft DVD Ripper_is1) (Version: - Aimersoft Software)

Aimersoft DVD Studio Pack(Build 1.1.41) (HKLM-x32\...\Aimersoft DVD Studio Pack_is1) (Version: - Aimersoft Software)

Aimersoft Video Converter(Build 1.1.41) (HKLM-x32\...\Aimersoft Video Converter_is1) (Version: - Aimersoft Software)

Ant.com IE add-on (HKLM-x32\...\{B905CAA1-D6FF-4D21-8858-F8C610491C0B}) (Version: 2.2.4.1076 - Ant.com)

Any Video Converter 5.7.8 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)

Ashampoo Burning Studio 6 FREE v.6.84 (HKLM-x32\...\{91B33C97-3ED1-03EA-A67B-244AA4D7B559}_is1) (Version: 6.8.4 - Ashampoo GmbH & Co. KG)

Avery Wizard 4.0 (HKLM-x32\...\{7196E6BD-4B65-43F9-9D30-73A8E58D0E84}) (Version: 4.0.103 - Avery)

BufferChm (HKLM-x32\...\{FA0FF682-CC70-4C57-93CD-E276F3E7537E}) (Version: 140.0.298.000 - Hewlett-Packard) Hidden

Chicken Invaders: Revenge of the Yolk (Christmas Edition) v3.20 (HKLM-x32\...\Chicken Invaders: Revenge of the Yolk (Christmas Edition)_is1) (Version: - InterAction studios)

ChrisPC Free VideoTube Downloader 10.07.26 (HKLM-x32\...\{6006089C-84B5-4F18-8113-1234567890DE}_is1) (Version: - Chris P.C. srl)

ChrisPC YTD Downloader MP3 Converter 2.85 (HKLM-x32\...\{6006089C-9ABC-4F18-ABCD-123456789801}_is1) (Version: - Chris P.C. srl)

Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)

Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden

Dell Backup and Recovery - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 1.5.0.0 - Dell Inc.)

Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.5.0.0 - Dell Inc.)

Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.16.1 - Dell Inc.)

Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.81 - Dell)

Dell Update (HKLM-x32\...\{D8AE5F9D-647C-49B4-A666-1C20B44EC0E1}) (Version: 2.1.3.0 - Dell Inc.)

Dell Wireless Driver Installation (HKLM-x32\...\{451517F1-7E41-400B-AA36-FB7E2563526D}) (Version: 10.0 - Dell)

Destinations (HKLM-x32\...\{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}) (Version: 140.0.253.000 - Hewlett-Packard) Hidden

DeviceDiscovery (HKLM-x32\...\{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}) (Version: 140.0.298.000 - Hewlett-Packard) Hidden

DocProc (HKLM-x32\...\{9B362566-EC1B-4700-BB9C-EC661BDE2175}) (Version: 140.0.185.000 - Hewlett-Packard) Hidden

Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden

Fax (HKLM-x32\...\{9294F169-72EE-4D74-AE92-CA25F64B4FF8}) (Version: 140.0.307.000 - Hewlett-Packard) Hidden

ffdshow [rev 2527] [2008-12-19] (HKLM-x32\...\ffdshow_is1) (Version: 1.0 - )

FFMPEG Addon (HKLM-x32\...\{111124AF-1ED4-44EF-B674-111111985342}_is1) (Version: 1.00 - FFMPEG)

FormatFactory 3.3.5.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.5.0 - Format Factory)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 68.0.3440.106 - Google Inc.)

Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden

Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden

GPBaseService2 (HKLM-x32\...\{BB3447F6-9553-4AA9-960E-0DB5310C5779}) (Version: 140.0.297.000 - Hewlett-Packard) Hidden

HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)

HP Officejet 4500 G510a-f 14.0 Rel. 6 (HKLM\...\{A49C5804-8F24-433C-99B2-9F9F541090C7}) (Version: 14.0 - HP)

HP Officejet 4630 series Basic Device Software (HKLM\...\{38037A50-E9F1-41E4-9AA3-2E0A5A2FC4C5}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)

HP Officejet 4630 series Help (HKLM-x32\...\{9F79230F-EE1C-407E-94E1-D69021954C9B}) (Version: 31.0.0 - Hewlett Packard)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)

HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)

HP Support Solutions Framework (HKLM-x32\...\{E2CB09C1-3C76-4395-BB47-50C066535CF8}) (Version: 12.9.24.3 - HP)

HP Touchpoint Analytics Client (HKLM\...\{E5FB98E0-0784-44F0-8CEC-95CD4690C43F}) (Version: 4.0.2.1439 - HP Inc.)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HPPhotoGadget (HKLM-x32\...\{CAE4213F-F797-439D-BD9E-79B71D115BE3}) (Version: 140.0.524.000 - Hewlett-Packard) Hidden

HPProductAssistant (HKLM-x32\...\{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}) (Version: 140.0.298.000 - Hewlett-Packard) Hidden

HPSSupply (HKLM-x32\...\{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}) (Version: 140.0.297.000 - Hewlett-Packard) Hidden

I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)

Internet Explorer (Enable DEP) (HKLM\...\{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb) (Version: - )

Java 8 Update 181 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180181F0}) (Version: 8.0.1810.13 - Oracle Corporation)

John's Background Switcher 4.17 (HKLM-x32\...\{DD3DAD13-289E-440E-A5D3-3EFB25305018}_is1) (Version: 4.17 - johnsadventures.com)

Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden

Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)

Movie Maker (HKLM-x32\...\{38F03569-A636-4CF3-BDDE-032C8C251304}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Mozilla Firefox 61.0.2 (x64 en-US) (HKLM\...\Mozilla Firefox 61.0.2 (x64 en-US)) (Version: 61.0.2 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 55.0.2 - Mozilla)

OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)

PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.322.9 - Tracker Software Products Ltd)

Product Improvement Study for HP Officejet 4630 series (HKLM\...\{EE629820-EACD-4AAE-966D-DF1560A0ED2D}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)

PySol Fan Club edition v.2.0 (HKLM-x32\...\PySol Fan Club edition_is1) (Version: - )

PySolFC Solitaire (a freeware Solitaire Game) version 1.1 (HKLM-x32\...\PySolFC Solitaire_is1) (Version: - )

Quit Counter (HKLM-x32\...\Quit Counter_is1) (Version: 1.2 - Xarka Software)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.)

Roxio Creator DE (HKLM-x32\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.1 - Roxio)

Scan (HKLM-x32\...\{06A1D88C-E102-4527-AF70-29FFD7AF215A}) (Version: 140.0.253.000 - Hewlett-Packard) Hidden

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)

SolutionCenter (HKLM-x32\...\{BC5DD87B-0143-4D14-AAE6-97109614DC6B}) (Version: 140.0.299.000 - Hewlett-Packard) Hidden

Status (HKLM-x32\...\{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}) (Version: 140.0.342.000 - Hewlett-Packard) Hidden

swMSM (HKLM-x32\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Toolbox (HKLM-x32\...\{292F0F52-B62D-4E71-921B-89A682402201}) (Version: 140.0.596.000 - Hewlett-Packard) Hidden

TrayApp (HKLM-x32\...\{CD31E63D-47FD-491C-8117-CF201D0AFAB5}) (Version: 140.0.297.000 - Hewlett-Packard) Hidden

Uninstall Dual Mode Camera (DT01) (HKLM-x32\...\DT01_2009_1026_1436_is1) (Version: - )

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

Vivitar Experience Image Manager (HKLM-x32\...\Vivitar Experience Image Manager) (Version: - )

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)

WebReg (HKLM-x32\...\{8EE94FD8-5F52-4463-A340-185D16328158}) (Version: 140.0.297.017 - Hewlett-Packard) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

WinPatrol (HKLM-x32\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 35.5.2017.8 - Ruiware)

WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)

WinRAR 5.00 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

Xilisoft DVD Copy Express (HKLM-x32\...\Xilisoft DVD Copy Express) (Version: 1.1.23.0824 - Xilisoft)

Xilisoft DVD Creator (HKLM-x32\...\Xilisoft DVD Creator) (Version: 3.0.39.1121 - Xilisoft)

Youtube Downloader HD v. 2.9.9.30 (HKLM-x32\...\Youtube Downloader HD_is1) (Version: - YoutubeDownloaderHD.com)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2801032338-2342425128-3870613798-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\WINDOWS\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\WINDOWS\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)

ShellIconOverlayIdentifiers-x32-x32-x32-x32-x32-x32: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)

ContextMenuHandlers1: [bB FlashBack 2] -> {A8065B9E-193F-4797-B62D-8F6321E7FCCB} => -> No File

ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2013-08-22] (Alexander Roshal)

ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2013-08-22] (Alexander Roshal)

ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File

ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2015-08-27] (Intel Corporation)

ContextMenuHandlers5: [igfxOSP] -> {FA507C3F-30C6-4DCA-9EE5-2656072EEC14} => C:\WINDOWS\system32\igfxOSP.dll [2015-08-27] (Intel Corporation)

ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)

ContextMenuHandlers6: [startMenuExt] -> {E595F05F-903F-4318-8B0A-7F633B520D2B} => C:\WINDOWS\System32\StartMenuHelper64.dll [2014-04-20] (IvoSoft)

ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2013-08-22] (Alexander Roshal)

ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2013-08-22] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {10E7CDFA-2463-4AA3-A931-EF99644B27C9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2018-06-27] (HP Inc.)

Task: {28389D5E-3DF8-42B9-AA66-9ABFBE4848F8} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-01-12] (Microsoft Corporation)

Task: {2A24730E-C25E-42EC-924B-4F723C6AD2E2} - System32\Tasks\HPCeeScheduleForJimmy Edwards => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)

Task: {2B698B18-E3DE-4BA3-A4A0-99300FD8244C} - System32\Tasks\File1 Update Launch => C:\Program Files (x86)\Ant.com\File1 Package Manager\File1UL.exe

Task: {305486BC-CF31-4F18-B143-564AD42D6FB3} - System32\Tasks\TinyTakeUpgrade => C:\Users\Ray\AppData\Local\MangoApps\TinyTake by MangoApps\TinyTake.exe

Task: {46E0D154-DFBC-4003-8802-D3D51BE25062} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2018-08-17] (HP Inc.)

Task: {4B946556-9B09-4E0A-956B-F8A55E2D30C6} - System32\Tasks\TrackerAutoUpdate => C:\Program Files\Tracker Software\Update\TrackerUpdate.exe [2018-07-03] (Tracker Software Products (Canada) Ltd.)

Task: {4C874592-A1F9-4D5D-84FC-12271CCDCED5} - System32\Tasks\Dell\Dell System Registration => C:\Program Files (x86)\System Registration\prodreg.exe [2012-07-09] (Dell, Inc.)

Task: {5503E6E9-3C07-4745-A157-B44306AC54C6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-01-12] (Microsoft Corporation)

Task: {58FE5BF4-4E30-4242-9B37-A6EB97177E91} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2018-06-28] (HP Inc.)

Task: {95D83143-E725-4C38-8FEF-37E28CA3643E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2018-05-04] (HP Inc.)

Task: {B8B63F70-D4B8-4452-97E7-FDAF10FBC78C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2017-09-20] (HP Inc.)

Task: {BA58B807-D5A9-4B82-97CD-0ACADF6C23B4} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2018-08-17] (Microsoft Corporation)

Task: {BB68C632-3B9B-4DD1-9F33-D4157978C40F} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2017-11-21] ()

Task: {C3CA267B-59D5-435A-B99C-E24A8A70FA5F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-03-03] (Google Inc.)

Task: {C40E713B-FEE2-4A7C-8F9C-DE1F28F79105} - System32\Tasks\HPCeeScheduleForRay => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)

Task: {C9224EE8-B7E4-4335-A2F4-B8CB14DCA61B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-01-12] (Microsoft Corporation)

Task: {CCF5C425-EA50-47A3-9670-C8C13DFBE4A6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-01-12] (Microsoft Corporation)

Task: {D7DD2F8C-5FB0-41DC-ADA7-7139CBD5A1F5} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-03-20] (PC-Doctor, Inc.)

Task: {D8AC50E5-57DE-4865-B539-E7F7D601F9E2} - System32\Tasks\HPCustParticipation HP Officejet 4630 series => C:\Program Files\HP\HP Officejet 4630 series\Bin\HPCustPartic.exe

Task: {DC97E556-53E4-40B4-9843-C6793A6DD3DA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-03-03] (Google Inc.)

Task: {E08D4662-E828-4D68-871C-2B4DB7CFB1F2} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_154_Plugin.exe [2018-08-14] (Adobe Systems Incorporated)

Task: {E12FB32E-7A8A-4D6C-85D2-C79BDD75F5D3} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe

Task: {E43F873B-9CC5-4CEC-AFEE-67FBF2DBD1CA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2018-05-04] (HP Inc.)

Task: {E854B597-C9BE-47FA-827D-4A4D73977A77} - System32\Tasks\arp_flush => C:\Program Files (x86)\hide.me VPN\FlushArpCache.exe

Task: {FC3168F0-5526-43EE-B651-C173054AA193} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-03-20] (PC-Doctor, Inc.)

Task: {FF9D33D7-56DA-4D71-AB20-38BE083343F7} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-08-14] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\HPCeeScheduleForJimmy Edwards.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\WINDOWS\Tasks\HPCeeScheduleForRay.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\WINDOWS\Tasks\TrackerAutoUpdate.job => C:\Program Files\Tracker Software\Update\TrackerUpdate.exe-CheckUpdate(Tracker Software Products (Canada) Ltd.Kee

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Ray\Desktop\My DVD Burners ETC\Disable_Windows_8_Explorer_Auto_Arrange - Shortcut.lnk -> C:\Users\Ray\Downloads\Disable_Windows_8_Explorer_Auto_Arrange.bat ()

Shortcut: C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Network Shortcuts\My Web Sites on MSN\target.lnk -> hxxp://www.msnusers.co

==================== Loaded Modules (Whitelisted) ==============

2018-08-24 17:07 - 2018-07-24 12:32 - 002681424 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll

2018-03-27 13:41 - 2018-03-27 13:41 - 000134616 _____ () C:\Program Files (x86)\Dell Update\ServiceTagPlusPlus.dll

2013-09-24 18:37 - 2012-07-18 15:55 - 001198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [470]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2801032338-2342425128-3870613798-1001\...\aol.com -> hxxps://mail.aol.com

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 01:26 - 2017-05-27 23:39 - 000000035 _____ C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2801032338-2342425128-3870613798-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Ray\AppData\Roaming\johnsadventures.com\Background Switcher\ActiveBackground.jpg

DNS Servers: 192.168.0.1 - 205.171.2.26

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\StartupFolder: => "HP Digital Imaging Monitor.lnk"

HKLM\...\StartupApproved\StartupFolder: => "Amazon Unbox.lnk"

HKLM\...\StartupApproved\StartupFolder: => "Device Monitor 4.lnk"

HKLM\...\StartupApproved\Run: => "IgfxTray"

HKLM\...\StartupApproved\Run: => "HotKeysCmds"

HKLM\...\StartupApproved\Run: => "Persistence"

HKLM\...\StartupApproved\Run: => "RTHDVCPL"

HKLM\...\StartupApproved\Run32: => "IAStorIcon"

HKLM\...\StartupApproved\Run32: => "IMSS"

HKLM\...\StartupApproved\Run32: => "RemoteControl10"

HKLM\...\StartupApproved\Run32: => "HP Software Update"

HKLM\...\StartupApproved\Run32: => "Adobe ARM"

HKLM\...\StartupApproved\Run32: => "GrooveMonitor"

HKU\S-1-5-21-2801032338-2342425128-3870613798-1001\...\StartupApproved\Run: => "Dashlane"

HKU\S-1-5-21-2801032338-2342425128-3870613798-1001\...\StartupApproved\Run: => "PCShowServer"

HKU\S-1-5-21-2801032338-2342425128-3870613798-1001\...\StartupApproved\Run: => "TomTomHOME.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{2E5CE9F1-F4FE-4A1C-BEC2-1FC2E81A853A}] => (Allow) LPort=1900

FirewallRules: [{D754747E-683E-4057-97C5-70B1A9D5027D}] => (Allow) LPort=2869

FirewallRules: [{C923C4C6-9B49-40C7-9371-572B12BDE35B}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{5E061F47-6AD2-47FF-95CB-54C7A1A1431F}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe

FirewallRules: [{86FB472A-4CE5-460E-8F27-B2372E8D6165}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe

FirewallRules: [{990B95F7-EF83-4ECE-BF6F-A4D69FC9F83F}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe

FirewallRules: [{68D3E9AF-C61B-4FAE-BD1F-BC06782A0D14}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

FirewallRules: [{8B34ACD6-5D32-4A76-91D9-350DB78A9719}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe

FirewallRules: [{83E4B487-6614-4483-BC48-0D08204DE91F}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqfxt08.exe

FirewallRules: [{5F9D9918-1620-4A0F-B3A6-3871EDA5216A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxs08.exe

FirewallRules: [{66173C11-6A8B-4C38-A038-9987D21B6297}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe

FirewallRules: [{8D120410-D7AB-457F-BBC3-4D639F3ECD8B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe

FirewallRules: [{434E3162-983B-4CEB-8848-EE80A576B6A5}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpzwiz01.exe

FirewallRules: [{487853B9-8D61-4D6B-809C-D76F3B89C308}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe

FirewallRules: [{FBC077C7-0DF8-4FF6-AFB8-7717F6A41847}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe

FirewallRules: [{D5B8730B-52FD-4209-91C7-A622375CE37F}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe

FirewallRules: [{1166F700-646D-4E42-980B-801C723E1DD3}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposfx08.exe

FirewallRules: [{45ECB300-8CB2-46D4-A602-131B4A7EBAF1}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxm08.exe

FirewallRules: [{EB358FD7-4A9C-43C1-9A47-E94F2085EC6A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe

FirewallRules: [{1EA55450-82A8-4B6A-BCFA-C9956BF9F6C1}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

FirewallRules: [{3E248B0D-F208-403E-A33F-494DBF5B0FEC}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{E8016474-50EB-4A04-91D9-F5164E57AA4E}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{D68BE6A3-B344-4B65-B42B-D6E6B0442842}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{4EF0A35F-1644-4EAB-AAD6-F5AAC83A838D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{26C770EF-9A12-4E13-BD11-F8A0A732D5ED}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{26511AD0-4D0A-497B-BAC4-1D4753F73A68}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{78BB779D-F662-4775-9CF7-4324145858C4}] => (Allow) LPort=5357

FirewallRules: [{A8109729-A3C5-4361-AF9B-66F387804877}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

FirewallRules: [{51CE882D-8A67-43B9-A5D8-6C76D5C002DD}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

FirewallRules: [TCP Query User{B4A45DE7-0320-42B0-89C1-D8EABCD803A7}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [uDP Query User{7A75F94D-4A55-4C9B-9A13-44A1E696171F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [{E4D74A0D-9366-4231-BFE4-C443C883E211}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\FaxApplications.exe

FirewallRules: [{83F2FD09-719D-449E-9A08-C13C1D2597F3}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\DigitalWizards.exe

FirewallRules: [{E7F527F7-B71E-47FD-B497-7B80C962D70A}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\SendAFax.exe

FirewallRules: [{502159B2-3CA4-48BC-B6CA-44733A093A13}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\Bin\DeviceSetup.exe

FirewallRules: [{E9941CCF-EE1C-4066-8380-F72B0F843A3D}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\Bin\HPNetworkCommunicatorCom.exe

FirewallRules: [TCP Query User{BE394815-69B1-4A0F-9159-2C392DA5AE16}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe

FirewallRules: [uDP Query User{144ACAB4-F3D8-48E9-AE9F-071064793C24}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe

FirewallRules: [{24B2410D-CABE-4475-9D29-F7821ACDFC94}] => (Allow) C:\Program Files (x86)\OpinionSquare\opnsqr.exe

FirewallRules: [{420E6D3B-AA86-4C22-ACE2-C5C797CCCF81}] => (Allow) C:\Program Files (x86)\OpinionSquare\opnsqr.exe

FirewallRules: [{E43BCC7E-1AB5-45F6-9079-EA4F4A51ED58}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

31-01-2018 16:05:11 Revo Uninstaller's restore point - Java 8 Update 161 (64-bit)

19-02-2018 00:18:14 Revo Uninstaller's restore point - HP Officejet 4630 series Basic Device Software

19-02-2018 00:24:02 Revo Uninstaller's restore point - HP Officejet 4630 series Basic Device Software

19-02-2018 01:05:13 Revo Uninstaller's restore point - HP Officejet 4630 series Help

26-02-2018 01:26:53 Windows Update

25-03-2018 11:42:15 Windows Update

15-04-2018 13:12:34 Windows Update

15-04-2018 16:59:55 Installed TomTom HOME.

24-04-2018 23:55:52 Windows Update

12-05-2018 13:48:23 Windows Update

14-06-2018 09:20:28 Windows Update

17-07-2018 12:05:55 Installed TomTom HOME.

22-07-2018 10:10:33 Installed DirectX

28-07-2018 12:30:38 Installed OpinionSquare

17-08-2018 15:32:18 Windows Update

24-08-2018 17:50:12 Revo Uninstaller's restore point - Epic Games Launcher

24-08-2018 19:12:13 Revo Uninstaller's restore point - Ezvid

24-08-2018 19:14:55 Revo Uninstaller's restore point - Free Hide Folder

24-08-2018 19:16:04 Revo Uninstaller's restore point - TomTom HOME

24-08-2018 19:19:15 Revo Uninstaller's restore point - TomTom HOME

24-08-2018 19:20:26 Revo Uninstaller's restore point - TomTom HOME

24-08-2018 19:22:04 Revo Uninstaller's restore point - TomTom HOME Visual Studio Merge Modules

24-08-2018 19:22:22 Removed TomTom HOME Visual Studio Merge Modules

24-08-2018 19:23:45 Revo Uninstaller's restore point - Uninstall Dual Mode Camera (DT01)

24-08-2018 19:25:28 Revo Uninstaller's restore point - Google Earth Plug-in

24-08-2018 19:26:32 Revo Uninstaller's restore point - Google Earth Plug-in

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (08/31/2018 11:30:50 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: pcdrcui.exe, version: 6.0.6584.81, time stamp: 0x54ee4835

Faulting module name: KERNELBASE.dll, version: 6.3.9600.18938, time stamp: 0x5a7ddf0a

Exception code: 0xe0434352

Fault offset: 0x0000000000008eac

Faulting process id: 0x1470

Faulting application start time: 0x01d4413f97f9ce0e

Faulting application path: C:\Program Files\Dell\SupportAssist\pcdrcui.exe

Faulting module path: C:\WINDOWS\system32\KERNELBASE.dll

Report Id: d669dd46-ad32-11e8-851e-c81f66038689

Faulting package full name:

Faulting package-relative application ID:

Error: (08/31/2018 11:30:50 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Application: pcdrcui.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.ApplicationException

at asapi.asapicsharp.locale()

at pcd.models.properties.CustomizationManager.get_IsThirdwave()

at pcd.controllers.commandline.CommandLineManagerFactory.InitMyDellCLM(appupdatercommon.utilities.CommandLineManager, System.String[])

at pcd.controllers.commandline.CommandLineManagerFactory.Get(pcd.controllers.commandline.CommandLineManagerType, System.String[])

at pcd.controllers.MainController.InitCommandLineManagerWithArgs(System.String[])

at wpfview.Program.Main(System.String[])

Error: (08/30/2018 10:14:50 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: pcdrcui.exe, version: 6.0.6584.81, time stamp: 0x54ee4835

Faulting module name: KERNELBASE.dll, version: 6.3.9600.18938, time stamp: 0x5a7ddf0a

Exception code: 0xe0434352

Fault offset: 0x0000000000008eac

Faulting process id: 0x814

Faulting application start time: 0x01d4406bd0095d3a

Faulting application path: C:\Program Files\Dell\SupportAssist\pcdrcui.exe

Faulting module path: C:\WINDOWS\system32\KERNELBASE.dll

Report Id: 0e50e85d-ac5f-11e8-851d-c81f66038689

Faulting package full name:

Faulting package-relative application ID:

Error: (08/30/2018 10:14:50 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Application: pcdrcui.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.ApplicationException

at asapi.asapicsharp.locale()

at pcd.models.properties.CustomizationManager.get_IsThirdwave()

at pcd.controllers.commandline.CommandLineManagerFactory.InitMyDellCLM(appupdatercommon.utilities.CommandLineManager, System.String[])

at pcd.controllers.commandline.CommandLineManagerFactory.Get(pcd.controllers.commandline.CommandLineManagerType, System.String[])

at pcd.controllers.MainController.InitCommandLineManagerWithArgs(System.String[])

at wpfview.Program.Main(System.String[])

Error: (08/30/2018 09:38:23 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.19036, time stamp: 0x5b077e91

Faulting module name: ntdll.dll, version: 6.3.9600.18895, time stamp: 0x5a4b127e

Exception code: 0xc0000374

Fault offset: 0x000e6214

Faulting process id: 0x1558

Faulting application start time: 0x01d4406669ba5802

Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: f6d69213-ac59-11e8-851d-c81f66038689

Faulting package full name:

Faulting package-relative application ID:

Error: (08/29/2018 09:43:54 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: pcdrcui.exe, version: 6.0.6584.81, time stamp: 0x54ee4835

Faulting module name: KERNELBASE.dll, version: 6.3.9600.18938, time stamp: 0x5a7ddf0a

Exception code: 0xe0434352

Fault offset: 0x0000000000008eac

Faulting process id: 0x590

Faulting application start time: 0x01d43f9e53513c77

Faulting application path: C:\Program Files\Dell\SupportAssist\pcdrcui.exe

Faulting module path: C:\WINDOWS\system32\KERNELBASE.dll

Report Id: 91a4b1ff-ab91-11e8-851c-c81f66038689

Faulting package full name:

Faulting package-relative application ID:

Error: (08/29/2018 09:43:54 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Application: pcdrcui.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.ApplicationException

at asapi.asapicsharp.locale()

at pcd.models.properties.CustomizationManager.get_IsThirdwave()

at pcd.controllers.commandline.CommandLineManagerFactory.InitMyDellCLM(appupdatercommon.utilities.CommandLineManager, System.String[])

at pcd.controllers.commandline.CommandLineManagerFactory.Get(pcd.controllers.commandline.CommandLineManagerType, System.String[])

at pcd.controllers.MainController.InitCommandLineManagerWithArgs(System.String[])

at wpfview.Program.Main(System.String[])

Error: (08/29/2018 09:15:32 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.19036, time stamp: 0x5b077e91

Faulting module name: ntdll.dll, version: 6.3.9600.18895, time stamp: 0x5a4b127e

Exception code: 0xc0000374

Fault offset: 0x000e6214

Faulting process id: 0x478

Faulting application start time: 0x01d43f98c5ac2f71

Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: 9b51aaf0-ab8d-11e8-851c-c81f66038689

Faulting package full name:

Faulting package-relative application ID:

*************************************************************************************************************************************************

System errors:

=============

Error: (08/31/2018 07:06:35 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The HP Touchpoint Analytics service terminated unexpectedly. It has done this 1 time(s).

Error: (08/31/2018 07:06:35 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Intel® Dynamic Application Loader Host Interface Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/31/2018 07:06:35 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The SoftThinks Agent Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/31/2018 07:06:35 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Andrea RT Filters Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/31/2018 07:06:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Intel® Capability Licensing Service Interface service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (08/31/2018 07:06:34 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (08/31/2018 07:06:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Dell Update Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/31/2018 07:06:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Intel® HD Graphics Control Panel Service service terminated unexpectedly. It has done this 1 time(s).

Windows Defender:

===================================

Date: 2018-05-23 23:03:25.737

Description:

Windows Defender has detected malware or other potentially unwanted software.

For more information please see the following:

Trojan:HTML/Phish threat description - Windows Defender Security Intelligence

Name: Trojan:HTML/Phish

ID: 2147678587

Severity: Severe

Category: Trojan

Path: file:_C:\Users\Ray\AppData\Local\Mozilla\Firefox\Profiles\5eqo96s0.default-1482161108706-1523801744665\cache2\entries\01411E8864B89E9860F722C30A06F09ECF1CE1D8

Detection Origin: Local machine

Detection Type: Concrete

Detection Source: Real-Time Protection

Process Name: C:\Program Files\Mozilla Firefox\firefox.exe

Signature Version: AV: 1.267.1641.0, AS: 1.267.1641.0, NIS: 119.0.0.0

Engine Version: AM: 1.1.14800.3, NIS: 2.1.14600.4

Date: 2018-04-20 12:20:22.153

Description:

Windows Defender has detected malware or other potentially unwanted software.

For more information please see the following:

Trojan:JS/Flafisi.D threat description - Windows Defender Security Intelligence

Name: Trojan:JS/Flafisi.D

ID: 2147725632

Severity: Severe

Category: Trojan

Path: file:_C:\Users\Ray\AppData\Local\Microsoft\Windows\INetCache\Low\IE\V12UNFV1\FlashPlayer[1].hta

Detection Origin: Internet

Detection Type: Concrete

Detection Source: User

Process Name: Unknown

Signature Version: AV: 1.267.15.0, AS: 1.267.15.0, NIS: 119.0.0.0

Engine Version: AM: 1.1.14800.3, NIS: 2.1.14600.4

Date: 2018-04-20 12:20:22.153

Description:

Windows Defender has detected malware or other potentially unwanted software.

For more information please see the following:

Trojan:Win32/Bitrep.A threat description - Windows Defender Security Intelligence

Name: Trojan:Win32/Bitrep.A

ID: 2147723097

Severity: Severe

Category: Trojan

Path: containerfile:_C:\WINDOWS\Downloaded Installations\MediaFACE 4.0.msi;file:_C:\WINDOWS\Downloaded Installations\MediaFACE 4.0.msi->Data1.cab->MFHookManager.dll

Detection Origin: Local machine

Detection Type: FastPath

Detection Source: User

Process Name: Unknown

Signature Version: AV: 1.267.15.0, AS: 1.267.15.0, NIS: 119.0.0.0

Engine Version: AM: 1.1.14800.3, NIS: 2.1.14600.4

Date: 2018-04-02 08:03:12.067

Description:

Windows Defender has detected malware or other potentially unwanted software.

For more information please see the following:

Trojan:JS/Flafisi.D threat description - Windows Defender Security Intelligence

Name: Trojan:JS/Flafisi.D

ID: 2147725632

Severity: Severe

Category: Trojan

Path: file:_C:\Users\Ray\AppData\Local\Microsoft\Windows\INetCache\Low\IE\V12UNFV1\FlashPlayer[2].hta

Detection Origin: Internet

Detection Type: Concrete

Detection Source: Real-Time Protection

Process Name: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Signature Version: AV: 1.263.1111.0, AS: 1.263.1111.0, NIS: 119.0.0.0

Engine Version: AM: 1.1.14600.4, NIS: 2.1.14600.4

Date: 2018-04-02 08:01:27.090

Description:

Windows Defender has detected malware or other potentially unwanted software.

For more information please see the following:

Trojan:JS/Flafisi.D threat description - Windows Defender Security Intelligence

Name: Trojan:JS/Flafisi.D

ID: 2147725632

Severity: Severe

Category: Trojan

Path: file:_C:\Users\Ray\AppData\Local\Microsoft\Windows\INetCache\Low\IE\V12UNFV1\FlashPlayer[2].hta

Detection Origin: Internet

Detection Type: Concrete

Detection Source: Real-Time Protection

Process Name: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Signature Version: AV: 1.263.1111.0, AS: 1.263.1111.0, NIS: 119.0.0.0

Engine Version: AM: 1.1.14600.4, NIS: 2.1.14600.4

Date: 2018-01-30 09:29:22.975

Description:

Windows Defender has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 118.2.0.0

Update Source: Microsoft Malware Protection Center

Signature Type: Network Inspection System

Update Type: Full

Current Engine Version:

Previous Engine Version: 2.1.14202.0

Error code: 0x800704e8

Error description: The remote system is not available. For information about network troubleshooting, see Windows Help.

Date: 2018-01-30 09:29:22.674

Description:

Windows Defender has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 1.261.508.0

Update Source: Microsoft Malware Protection Center

Signature Type: AntiSpyware

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.14500.5

Error code: 0x80072ee2

Error description: The operation timed out

Date: 2018-01-30 09:29:22.673

Description:

Windows Defender has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 1.261.508.0

Update Source: Microsoft Malware Protection Center

Signature Type: AntiVirus

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.14500.5

Error code: 0x80072ee2

Error description: The operation timed out

Date: 2017-12-26 11:29:03.449

Description:

Windows Defender has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 118.2.0.0

Update Source: Microsoft Malware Protection Center

Signature Type: Network Inspection System

Update Type: Full

Current Engine Version:

Previous Engine Version: 2.1.14202.0

Error code: 0x80072ee2

Error description: The operation timed out

CodeIntegrity:

===================================

Date: 2017-08-24 12:30:53.795

Description:

Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\WINDOWS\System32\EasyRedirect64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2017-08-24 12:30:53.263

Description:

Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\WINDOWS\System32\EasyRedirect64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2017-08-24 12:30:52.716

Description:

Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\WINDOWS\System32\EasyRedirect64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2017-08-24 12:30:52.169

Description:

Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\WINDOWS\System32\EasyRedirect64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2017-08-24 10:12:30.029

Description:

Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\WINDOWS\System32\EasyRedirect64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2017-08-24 10:12:29.388

Description:

Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\WINDOWS\System32\EasyRedirect64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2017-08-24 10:12:28.795

Description:

Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\WINDOWS\System32\EasyRedirect64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2017-08-24 10:12:28.216

Description:

Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\WINDOWS\System32\EasyRedirect64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info ===========================

Processor: Intel® Core i3-3240 CPU @ 3.40GHz

Percentage of memory in use: 32%

Total physical RAM: 8066.05 MB

Available physical RAM: 5478.89 MB

Total Virtual: 9346.05 MB

Available Virtual: 6638.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:918.77 GB) (Free:90.44 GB) NTFS

\\?\Volume{8ae1a6c5-57c6-4fdd-abc1-71a9febbb1c2}\ (WINRETOOLS) (Fixed) (Total:0.48 GB) (Free:0.21 GB) NTFS

\\?\Volume{30650a71-79b0-4498-8ce5-c33b7216a1e5}\ (PBR Image) (Fixed) (Total:11.61 GB) (Free:0.71 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 6AA7D01A)

Partition: GPT.

==================== End of Addition.txt ============================

Starbuck · September 3, 2018

Hi Jimmy,

Sorry for the late reply.... I didn't get a notification of your post.

I'll have to check my settings.

Unfortunately you only posted the Addition.txt from FRST.

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23.08.2018

Can you please post the Main FRST.txt.

There will be a copy in your Download folder.

Running from C:\Users\Ray\Downloads

Also, when was the last time that you ran a full scan with Windows Defender?

Thanks

jimmyedwards · September 3, 2018

I did a Windows Defender last week I believe,i will do one now and post it ok,thanks.