Something's wrong, but don't know what.

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Malnutrition
    PCHF Moderator
    • Jul 2016
    • 7041

    #16
    Do you have any idea what this relates to?

    C:\Users\Doneff Family\AppData\Local\TianTianData

    Full Zemana Scan.

    Zemana Deep Scan
    [ul]
    [li]
    • [/li][li]Right click on Zemana and run as admin.[/li][/ul]
      [ul]
      [li]Click the Cog/Sproket Wheel, at the top right of Zemana[/li][/ul]
      [ul]
      [li]Select Advanced - I have read the warning and wish to proceed.[/li][/ul]
      [ul]
      [li]Place a tick next to Detect Suspicious (Root CA) Certificates.[/li][/ul]
      [ul]
      [li]Then click the house icon in Zemana.[/li][/ul]
      [ul]
      [li]Then hit your start button at the lower left hand corner of your desktop.[/li][/ul]
      [ul]
      [li]Then left click on Computer.[/li][/ul]
      [ul]
      [li]Drag Local Disk C: or whichever drive you decide to check first.[/li]
      [li]Into the area of Zemana that reads Drag and drop files here to scan them.[/li][/ul]
      [ul]
      [li]http://i.imgur.com/bOVO6lY.png[/li][/ul]
      [ul]
      [li]Once the scan has completed click graph icon on the top right of the programs User interface.[/li][/ul]
      [ul]
      [li]Double click to open the latest log-file.[/li][/ul]
      [ul]
      [li]Copy it to your clipboard.[/li][/ul]
      [ul]
      [li]Post the log here in your next reply.[/li][/ul]

    Security Check Scan.

    [ul]
    [li]Download Security Check to your desktop.[/li][li]Right click it run as administrator.[/li][li]When the program completes, the tool will automatically open a log file.[/li][li]Please post that log here in your next post.[/li][/ul]

    Comment

    • system
      PCHF Owner
      • Jan 2015
      • 7635

      #17
      No I’m not familiar with that file. What haven’t I posted yet that I still need to post? When I find your link to Hijack This, I’ll download it and delete my copy. Thanks again.

      Comment

      • Malnutrition
        PCHF Moderator
        • Jul 2016
        • 7041

        #18
        Originally posted by GamerGirl74
        No I’m not familiar with that file.
        Ok, we will remove it soon enough.
        Originally posted by GamerGirl74
        What haven’t I posted yet that I still need to post?
        Zhp Diag Fix log.
        Zemana Scan
        Security Check Log.
        Updated Hijack This log. – Link here… Please Click HERE to download HijackThis

        Comment

        • system
          PCHF Owner
          • Jan 2015
          • 7635

          #19
          Scan Result : Completed
          Scan Date : 2017/5/25
          Operating System : Windows 10 64-bit
          Processor : 8X Intel(R) Core™ i7-4790 CPU @ 3.60GHz
          BIOS Mode : UEFI
          CUID : 12E0126C8F1F094BA59947
          Scan Type : System Scan
          Duration : 7m 23s
          Scanned Objects : 93334
          Detected Objects : 5
          Excluded Objects : 0
          Read Level : Normal
          Auto Upload : Enabled
          Detect All Extensions : Disabled
          Scan Documents : Disabled
          Domain Info : WORKGROUP,0,2
          [HEADING=1]Detected Objects[/HEADING]
          Chrome Shortcut
          Status : Scanned
          Object : --profile-directory=“Profile 4”
          MD5 : -
          Publisher : -
          Size : -
          Version : -
          Detection : Suspicious Browser Setting
          Cleaning Action : Repair
          Related Objects :
          Browser Setting - Chrome Shortcut

          Chrome Homepage
          Status : Scanned
          Object : http://www.4loot.com/
          MD5 : -
          Publisher : -
          Size : -
          Version : -
          Detection : Suspicious Browser Setting
          Cleaning Action : Repair
          Related Objects :
          Browser Setting - Chrome Homepage

          Dyna Gaming Advertising
          Status : Scanned
          Object : %localappdata%\google\chrome\user data\profile 1\extensions\hpkmdjomfcomfiihildoihnbhnbkbppl
          MD5 : -
          Publisher : -
          Size : -
          Version : -
          Detection : PUA.ChromeExt!Gr
          Cleaning Action : Repair
          Related Objects :
          Browser Extension - Dyna Gaming Advertising

          Game Time Party Bus Advertising
          Status : Scanned
          Object : %localappdata%\google\chrome\user data\profile 1\extensions\hfegnlbibfofilgojklfejikhcpekfnb
          MD5 : -
          Publisher : -
          Size : -
          Version : -
          Detection : PUA.ChromeExt!Gr
          Cleaning Action : Repair
          Related Objects :
          Browser Extension - Game Time Party Bus Advertising

          ccsetup530.exe
          Status : Scanned
          Object : %userprofile%\desktop\toolbox\ccsetup530.exe
          MD5 : 1D8371C6AC1FC1534EB5FC89E07D4E54
          Publisher : Superb Delivery (Alpha Criteria Ltd.)
          Size : 1242128
          Version : 0.0.0.0
          Detection : Adware:Win32/AutoBulk.a92104!Ep
          Cleaning Action : Quarantine
          Related Objects :
          File - %userprofile%\desktop\toolbox\ccsetup530.exe

          Logfile of HiJackThis Fork (Alpha) by Alex Dragokas v.2.6.4.17

          Platform: x64 Windows 10 (Home), 10.0.15063 (ReleaseId: 1703), Service Pack: 0
          Time: 25.05.2017 - 01:08
          Language: OS: English (0x409). Display: English (0x409). Non-Unicode: English (0x409)
          Elevated: Yes
          Ran by: Doneff Family (group: Administrator) on DESKTOP-DOB72OG

          Chrome: 58.0.3029.110
          Edge: 11.0.15063.250
          Internet Explorer: 11.0.15063.0

          Boot mode: Normal

          Running processes:
          Number | Path
          1 C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe
          1 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
          1 C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
          1 C:\Program Files (x86)\Common Files\Steam\SteamService.exe
          12 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
          1 C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.ex e
          1 C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64. exe
          1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
          1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
          1 C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
          1 C:\Program Files (x86)\Lenovo\LenovoPortal\FastBoot\FbService.exe
          1 C:\Program Files (x86)\Lenovo\LenovoPortal\LenovoPortalService.exe
          1 C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
          1 C:\Program Files (x86)\Steam\Steam.exe
          1 C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
          2 C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
          1 C:\Program Files\AVAST Software\Avast\AvastSvc.exe
          1 C:\Program Files\AVAST Software\Avast\AvastUI.exe
          1 C:\Program Files\AVAST Software\Avast\afwServ.exe
          1 C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
          1 C:\Program Files\CCleaner\CCleaner64.exe
          1 C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
          1 C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
          1 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
          1 C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
          1 C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Containe r.exe
          1 C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
          1 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
          1 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
          1 C:\Program Files\Windows Defender\MSASCuiL.exe
          1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x 64__kzf8qxf38zg5c\SkypeHost.exe
          1 C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1 705.1302.0_x64__8wekyb3d8bbwe\Calculator.exe
          1 C:\Users\Doneff Family\AppData\Local\Microsoft\OneDrive\OneDrive.e xe
          1 C:\Users\Doneff Family\Desktop\HiJackThis\HiJackThis.exe
          1 C:\Users\Doneff Family\Desktop\HiJackThis\MemCompression
          1 C:\Windows\SysWOW64\UMonit64.exe
          1 C:\Windows\SysWOW64\ctfmon.exe
          1 C:\Windows\System32\ApplicationFrameHost.exe
          1 C:\Windows\System32\RuntimeBroker.exe
          1 C:\Windows\System32\SearchFilterHost.exe
          1 C:\Windows\System32\SearchIndexer.exe
          1 C:\Windows\System32\SearchProtocolHost.exe
          1 C:\Windows\System32\SecurityHealthService.exe
          1 C:\Windows\System32\SystemSettingsBroker.exe
          1 C:\Windows\System32\WUDFHost.exe
          1 C:\Windows\System32\audiodg.exe
          2 C:\Windows\System32\csrss.exe
          1 C:\Windows\System32\dllhost.exe
          1 C:\Windows\System32\dwm.exe
          2 C:\Windows\System32\fontdrvhost.exe
          1 C:\Windows\System32\lsass.exe
          1 C:\Windows\System32\services.exe
          1 C:\Windows\System32\sihost.exe
          1 C:\Windows\System32\smartscreen.exe
          1 C:\Windows\System32\smss.exe
          1 C:\Windows\System32\spoolsv.exe
          68 C:\Windows\System32\svchost.exe
          1 C:\Windows\System32\taskhostw.exe
          1 C:\Windows\System32\wininit.exe
          1 C:\Windows\System32\winlogon.exe
          1 C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw 5n1h2txyewy\SearchUI.exe
          1 C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2t xyewy\ShellExperienceHost.exe
          1 C:\Windows\explorer.exe
          1 C:\Windows\jmesoft\JME_LOAD.exe
          1 C:\Windows\jmesoft\Service.exe
          1 C:\Windows\jmesoft\hotkey.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
          R4 - HKCU\Software\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: SuggestionsURL = http://api.bing.com/qsml.aspx?query= {searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie :rowHeight}&sectionHeight={ie:sectionHeight}&FORM= IESS02&market={language}
          R4 - HKCU\Software\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: SuggestionsURLFallback = http://api.bing.com/qsml.aspx?query= {searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie :rowHeight}&sectionHeight={ie:sectionHeight}&FORM= IESS02&market={language}
          R4 - HKCU\Software\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: URL = Search - Microsoft Bing {searchTerms}&src=IE-SearchBox&FORM=IESR02
          O2 - BHO: (no name) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL
          O2 - BHO: Adobe Acrobat Create PDF Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavSt ub.dll
          O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll
          O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavSt ub.dll
          O2-32 - BHO: Adobe Acrobat Create PDF Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.d ll
          O2-32 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll
          O2-32 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll
          O2-32 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.d ll
          O4 - HKCU..\Run: [Adobe Acrobat Synchronizer] C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe --restore-last-session
          O4 - HKCU..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe /MONITOR
          O4 - HKCU..\Run: [GoogleChromeAutoLaunch_DDF34A59040FF57D719F4EF1CA2 787C3] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --no-startup-window /prefetch:5
          O4 - HKCU..\Run: [OneDrive] C:\Users\Doneff Family\AppData\Local\Microsoft\OneDrive\OneDrive.e xe /background --restore-last-session
          O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe -silent --restore-last-session
          O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.e xe
          O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvLaunch.exe /gui
          O4 - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe “C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe” 60
          O4 - HKLM..\Run: [Malwarebytes TrayApp] C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe
          O4 - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit64.exe
          O4 - HKLM..\Run: [ZAM] C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe /minimized
          O4 - HKLM..\StartupApproved\Run32: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
          O4 - HKLM..\StartupApproved\Run32: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe “C:\Program Files (x86)\Lenovo\Power2Go” UpdateWithCreateOnce “SOFTWARE\CyberLink\Power2Go\6.0”
          O4 - HKLM..\StartupApproved\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
          O4 - HKLM..\StartupApproved\Run: [RtHDVBg_LENOVO_MICPKEY] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /LENOVO_MICPKEY
          O4 - HKLM..\StartupApproved\Run: [SecurityHealth] C:\Program Files\Windows Defender\MSASCuiL.exe
          O4 - HKU\S-1-5-19..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
          O4 - HKU\S-1-5-20..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
          O4-32 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe
          O4-32 - HKLM..\Run: [jmekey] C:\Windows\jmesoft\hotkey.exe
          O4-32 - HKLM..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
          O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE
          O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll
          O9 - Extra ‘Tools’ menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll (HKLM)
          O9 - Extra ‘Tools’ menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\ONBttnIELinkedNotes.dll (HKLM)
          O9 - Extra ‘Tools’ menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\ONBttnIE.dll (HKLM)
          O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll (HKLM)
          O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\ONBttnIELinkedNotes.dll (HKLM)
          O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\ONBttnIE.dll (HKLM)
          O9-32 - Extra ‘Tools’ menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll (HKLM)
          O9-32 - Extra ‘Tools’ menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll (HKLM)
          O9-32 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll (HKLM)
          O9-32 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll (HKLM)
          O17 - DHCP DNS - 1: 209.18.47.61
          O17 - DHCP DNS - 2: 209.18.47.62
          O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
          O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
          O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
          O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
          O22 - Task (Disabled): \Microsoft\Windows\Subscription\LicenseAcquisition - C:\WINDOWS\system32\ClipRenew.exe
          O22 - Task (Disabled): \Microsoft\Windows\UpdateOrchestrator\Combined Scan Download Install - C:\WINDOWS\system32\usoclient.exe ScanInstallWait
          O22 - Task (Ready): Adobe Flash Player Updater - C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpda teService.exe
          O22 - Task (Ready): Avast Emergency Update - C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
          O22 - Task (Ready): CCleanerSkipUAC - C:\Program Files\CCleaner\CCleaner.exe $(Arg0)
          O22 - Task (Ready): GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
          O22 - Task (Ready): GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
          O22 - Task (Ready): SafeZone scheduled Autoupdate 1462830905 - C:\Program Files\AVAST Software\SZBrowser\launcher.exe --scheduledautoupdate $(Arg0)
          O22 - Task (Ready): \AVAST Software\Avast settings backup - C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs
          O22 - Task (Ready): \Microsoft\Office\Office Automatic Updates - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /update SCHEDULEDTASK displaylevel=False
          O22 - Task (Ready): \Microsoft\Office\Office ClickToRun Service Monitor - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /WatchService
          O22 - Task (Ready): \Microsoft\Office\Office Subscription Maintenance - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe
          O22 - Task (Ready): \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - C:\WINDOWS\system32\compattelrunner.exe
          O22 - Task (Ready): \Microsoft\Windows\Application Experience\ProgramDataUpdater - C:\WINDOWS\system32\compattelrunner.exe -maintenance
          O22 - Task (Ready): \Microsoft\Windows\BitLocker\BitLocker MDM policy Refresh - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},BitLockerPolicy - C:\WINDOWS\System32\edptask.dll
          O22 - Task (Ready): \Microsoft\Windows\BrokerInfrastructure\BgTaskRegi strationMaintenanceTask - {E984D939-0E00-4DD9-AC3A-7ACA04745521} - (no file)
          O22 - Task (Ready): \Microsoft\Windows\DeviceDirectoryClient\RegisterD eviceProtectionStateChanged - {AE31B729-D5FD-401E-AF42-784074835AFE},-RegisterDevice -ProtectionStateChanged -FreeNetworkOnly -NoLocation - C:\WINDOWS\system32\DeviceDirectoryClient.dll
          O22 - Task (Ready): \Microsoft\Windows\EDP\EDP App Launch Task - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},AppLaunch - C:\WINDOWS\System32\edptask.dll
          O22 - Task (Ready): \Microsoft\Windows\EDP\EDP Auth Task - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},ReAuth - C:\WINDOWS\System32\edptask.dll
          O22 - Task (Ready): \Microsoft\Windows\EDP\EDP Inaccessible Credentials Task - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},MissingCredentials - C:\WINDOWS\System32\edptask.dll
          O22 - Task (Ready): \Microsoft\Windows\EDP\StorageCardEncryption Task - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},SDCardEncryptionPolicy - C:\WINDOWS\System32\edptask.dll
          O22 - Task (Ready): \Microsoft\Windows\Management\Provisioning\Cellula r - C:\WINDOWS\system32\ProvTool.exe /turn 7 /source CellStateChangeTask
          O22 - Task (Ready): \Microsoft\Windows\Management\Provisioning\Logon - C:\WINDOWS\system32\ProvTool.exe /turn 5 /source LogonIdleTask
          O22 - Task (Ready): \Microsoft\Windows\Maps\MapsToastTask - {9885AEF2-BD9F-41E0-B15E-B3141395E803},$(Arg0);$(Arg1);$(Arg2);$(Arg3);$(Ar g4);$(Arg5);$(Arg6);$(Arg7) - C:\WINDOWS\System32\mapstoasttask.dll
          O22 - Task (Ready): \Microsoft\Windows\Subscription\EnableLicenseAcqui sition - C:\WINDOWS\system32\ClipRenew.exe -e
          O22 - Task (Ready): \Microsoft\Windows\UNP\RunCampaignManager - C:\WINDOWS\System32\UNP\UNPCampaignManager.exe
          O22 - Task (Ready): \Microsoft\Windows\WwanSvc\NotificationTask - C:\WINDOWS\System32\WiFiTask.exe wwan
          O23 - Service R2: Adobe Acrobat Update Service - (AdobeARMservice) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
          O23 - Service R2: Adobe Genuine Software Integrity Service - (AGSService) - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
          O23 - Service R2: Avast Antivirus - (avast! Antivirus) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
          O23 - Service R2: Avast Firewall Service - (avast! Firewall) - C:\Program Files\AVAST Software\Avast\afwServ.exe
          O23 - Service R2: FastbootService - C:\Program Files (x86)\Lenovo\LenovoPortal\FastBoot\FbService.exe
          O23 - Service R2: Intel(R) Dynamic Application Loader Host Interface Service - (jhi_service) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
          O23 - Service R2: Intel(R) Management and Security Application Local Management Service - (LMS) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
          O23 - Service R2: JME Keyboard Driver - (JME Keyboard) - C:\Windows\jmesoft\Service.exe
          O23 - Service R2: LenovoPortalService - C:\Program Files (x86)\Lenovo\LenovoPortal\LenovoPortalService.exe
          O23 - Service R2: Malwarebytes Service - (MBAMService) - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
          O23 - Service R2: NVIDIA Display Container LS - (NVDisplay.ContainerLocalSystem) - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Containe r.exe
          O23 - Service R2: ZAM Controller Service - (ZAMSvc) - C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
          O23 - Service R3: Intel(R) Security Assist - C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
          O23 - Service R3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
          O23 - Service R3: aswbIDSAgent - C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
          O23 - Service S2: Google Update Service (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          O23 - Service S2: Intel(R) Rapid Storage Technology - (IAStorDataMgrSvc) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
          O23 - Service S2: Intel(R) Security Assist Helper - (isaHelperSvc) - C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe
          O23 - Service S2: System Interface Foundation Service - (ImControllerService) - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.Im Controller.exe
          O23 - Service S3: Adobe Flash Player Update Service - (AdobeFlashPlayerUpdateSvc) - C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpda teService.exe
          O23 - Service S3: Google Update Service (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          O23 - Service S3: Intel(R) Capability Licensing Service TCP IP Interface - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
          O23 - Service S3: LSCWinService - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
          O23 - Service S3: ShareItSvc - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
          O23 - Service S3: Windows Defender Antivirus Network Inspection Service - (WdNisSvc) - C:\Program Files\Windows Defender\NisSrv.exe
          O23 - Service S3: Windows Defender Antivirus Service - (WinDefend) - C:\Program Files\Windows Defender\MsMpEng.exe
          O23 - Service S3: nProtect GameGuard Service - (npggsvc) - C:\WINDOWS\SysWow64\GameMon.des


          End of file - Time spent: 14 sec. - 37910 bytes, CRC32: FFFFFFFF. Sign: 螷댍

          I can’t get the ZHP Fix to work. I followed all your instructions and I get a little box that only gives me the option to click “Ok”

          Comment

          • system
            PCHF Owner
            • Jan 2015
            • 7635

            #20
            I got it to work, forgot to copy the code you requested I copy.

            Rapport de ZHPFix 2015.10.19.9 par Nicolas Coolman, Update du 19/10/2015
            Fichier d’export Registre :
            Run by Doneff Family at 5/25/2017 1:13:46 AM
            High Elevated Privileges : OK
            Windows 8 Home Premium Edition, 64-bit Service Pack 1 (15063)

            Recycle Bin emptied (47mn AMs)

            ========== Registry keys ==========
            REMOVES: Service: AdobeARMservice
            REMOVES: HKLM\SOFTWARE\Wow6432Node\kpzs
            REMOVES: HKCU\SOFTWARE\Chromium
            REMOVES: Services Svchost: dmwappushservice
            REMOVES:* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}
            REMOVES:* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}
            REMOVES: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext \Stats{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}

            ========== Registry values ==========
            ProxyFix : Proxy configuration successfully removed
            REMOVES ProxyServer Value
            REMOVES ProxyEnable Value
            REMOVES EnableHttp1_1 Value
            REMOVES ProxyHttp1.1 Value
            REMOVES ProxyOverride Value
            REMOVES RunValue: CCleaner Monitoring

            ========== Preferences browser ==========
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://windstream.com
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://apis.google.com
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://bs.serving-sys.com
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://se.monetate.net
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://secure-ds.serving-sys.com
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://ssl.gstatic.com
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://vt.myvisualiq.net
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://www.gstatic.com
            NOW Chrome File: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Preferences
            ABSENT Chrome Site: http://www.windstream.com
            REMOVES Folder Chrome: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmkinhboiljjkhaknpaeaicmdj hagpep

            ========== Folders ==========
            No folders empty CLSID Local user
            REMOVES: C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmkinhboiljjkhaknpaeaicmdj hagpep
            REMOVES: C:\Program Files (x86)\GUMFE8C.tmp
            REMOVES: C:\ProgramData\McAfee
            REMOVES: C:\Users\Doneff Family\AppData\Local\Facebook
            Deletes temporary Windows (0)

            ========== Files ==========
            REMOVES Flash Cookies (0) (0 octets)
            REMOVES: c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe
            REMOVES: c:\program files\ccleaner\ccleaner64.exe
            REMOVES Reboot: c:\program files\ccleaner\ccleaner64.exe
            Deletes temporary Windows (0) (0 octets)

            ========== System restore ==========
            The system successfully created restore point

            ========== Summary ==========
            7 : Registry keys
            7 : Registry values
            6 : Folders
            5 : Files
            19 : Preferences browser
            1 : System restore

            End of clean in 15mn AMs

            ========== Path to file report ==========
            C:\Users\Doneff Family\AppData\Roaming\ZHP\ZHPFix[R1].txt - 5/25/2017 1:17:33 AM [3547]

            Comment

            • system
              PCHF Owner
              • Jan 2015
              • 7635

              #21
              SecurityCheck by glax24 & Severnyj v.1.4.0.49 [15.04.17]
              WebSite: www.safezone.cc
              DateLog: 25.05.2017 01:19:10
              Path starting: C:\Users\Doneff Family\AppData\Local\Temp\SecurityCheck\SecurityCh eck.exe
              Log directory: C:\SecurityCheck
              IsAdmin: True
              User: Doneff Family
              VersionXML: 4.27is-21.05.2017


              Windows 10(6.3.15063) (x64) Core Release: 1703 Lang: English(0409)
              Installation date OS: 18.05.2017 21:29:07
              LicenseStatus: Windows(R), Core edition The machine is permanently activated.
              LicenseStatus: Office 16, Office16O365HomePremR_SubTrial5 edition Initial grace period ends :5291 minutes
              LicenseStatus: Office 16, Office16O365HomePremR_Grace edition Windows is in Notification mode
              Boot Mode: Normal
              Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              SystemDrive: C: FS: [NTFS] Capacity: [899.7 Gb] Used: [142 Gb] Free: [757.7 Gb]
              ------------------------------- [ Windows ] -------------------------------
              Internet Explorer 11.296.15063.0
              User Account Control enabled
              Automatically download and schedule installation
              Windows Update (wuauserv) - The service has stopped
              Security Center (wscsvc) - The service is running
              Remote Registry (RemoteRegistry) - The service has stopped
              SSDP Discovery (SSDPSRV) - The service is running
              Remote Desktop Services (TermService) - The service has stopped
              Windows Remote Management (WS-Management) (WinRM) - The service has stopped
              ---------------------------- [ Antivirus_WMI ] ----------------------------
              Avast Antivirus (enabled and up to date)
              Windows Defender (disabled and up to date)
              Malwarebytes (enabled and up to date)
              ---------------------------- [ Firewall_WMI ] -----------------------------
              Avast Antivirus (enabled)
              --------------------------- [ AntiSpyware_WMI ] ---------------------------
              Malwarebytes (enabled and up to date)
              Windows Defender (disabled and up to date)
              Avast Antivirus (enabled and up to date)
              ---------------------- [ AntiVirusFirewallInstall ] -----------------------
              Avast Internet Security v.17.4.2294
              -------------------------- [ SecurityUtilities ] --------------------------
              Malwarebytes version 3.1.2.1733 v.3.1.2.1733
              Zemana AntiMalware v.2.72.0.388
              --------------------------- [ OtherUtilities ] ----------------------------
              Microsoft Silverlight v.5.1.50906.0
              -------------------------------- [ Java ] ---------------------------------
              Java 8 Update 121 v.8.0.1210.13 Warning! Download Update
              Uninstall old version and install new one (jre-8u131-windows-i586.exe).
              --------------------------- [ AdobeProduction ] ---------------------------
              Adobe Flash Player 25 PPAPI v.25.0.0.171
              Adobe Acrobat DC v.17.009.20044
              Adobe Acrobat Reader DC v.17.009.20044
              ------------------------------- [ Browser ] -------------------------------
              Google Chrome v.58.0.3029.110
              --------------------------- [ RunningProcess ] ----------------------------
              C:\Program Files (x86)\Google\Chrome\Application\chrome.exe v.58.0.3029.110
              ------------------ [ AntivirusFirewallProcessServices ] -------------------
              Avast Antivirus (avast! Antivirus) - The service is running
              C:\Program Files\AVAST Software\Avast\AvastSvc.exe v.17.4.3482.0
              aswbIDSAgent (aswbIDSAgent) - The service is running
              C:\Program Files\AVAST Software\Avast\AvastUI.exe v.17.4.3482.0
              C:\Program Files\AVAST Software\Avast\afwServ.exe v.17.4.3482.0
              Avast Firewall Service (avast! Firewall) - The service is running
              C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe v.3.0.0.1068
              Malwarebytes Service (MBAMService) - The service is running
              C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe v.3.1.0.479
              C:\Program Files\Windows Defender\MSASCuiL.exe v.4.11.15063.0
              Windows Defender Antivirus Service (WinDefend) - The service has stopped
              Windows Defender Antivirus Network Inspection Service (WdNisSvc) - The service has stopped
              ZAM Controller Service (ZAMSvc) - The service is running
              C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe v.2.72.0.388
              ----------------------------- [ End of Log ] ------------------------------

              Comment

              • Malnutrition
                PCHF Moderator
                • Jul 2016
                • 7041

                #22
                Java 8 Update 121 v.8.0.1210.13 Warning! Download Update
                Uninstall old version and install new one (jre-8u131-windows-i586.exe).


                Hijack This Fix.

                Start HijackThis , Right Click Run as Admin.
                Close all other open programs prior to running this tool!!
                Click System Scan Only.
                Then check mark the items listed below.

                O4 - HKCU..\Run: [Adobe Acrobat Synchronizer] C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe --restore-last-session
                O4 - HKCU..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe /MONITOR
                O4 - HKCU..\Run: [GoogleChromeAutoLaunch_DDF34A59040FF57D719F4EF1CA2 787C3] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --no-startup-window /prefetch:5
                O4 - HKCU..\Run: [OneDrive] C:\Users\Doneff Family\AppData\Local\Microsoft\OneDrive\OneDrive.e xe /background --restore-last-session
                O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.e xe
                O4 - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe “C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe” 60
                O4 - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit64.exe
                O4 - HKLM..\Run: [ZAM] C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe /minimized
                O4 - HKLM..\StartupApproved\Run32: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
                O4 - HKLM..\StartupApproved\Run32: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe “C:\Program Files (x86)\Lenovo\Power2Go” UpdateWithCreateOnce “SOFTWARE\CyberLink\Power2Go\6.0”
                O4 - HKLM..\StartupApproved\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
                O4 - HKLM..\StartupApproved\Run: [RtHDVBg_LENOVO_MICPKEY] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /LENOVO_MICPKEY
                O4 - HKLM..\StartupApproved\Run: [SecurityHealth] C:\Program Files\Windows Defender\MSASCuiL.exe
                O4 - HKU\S-1-5-19..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
                O4 - HKU\S-1-5-20..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
                O4-32 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe
                O4-32 - HKLM..\Run: [jmekey] C:\Windows\jmesoft\hotkey.exe
                O4-32 - HKLM..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
                O22 - Task (Disabled): \Microsoft\Windows\Subscription\LicenseAcquisition - C:\WINDOWS\system32\ClipRenew.exe
                O22 - Task (Disabled): \Microsoft\Windows\UpdateOrchestrator\Combined Scan Download Install - C:\WINDOWS\system32\usoclient.exe ScanInstallWait
                O22 - Task (Ready): Adobe Flash Player Updater - C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpda teService.exe
                O22 - Task (Ready): \Microsoft\Office\Office Automatic Updates - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /update SCHEDULEDTASK displaylevel=False
                O22 - Task (Ready): \Microsoft\Office\Office ClickToRun Service Monitor - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /WatchService
                O22 - Task (Ready): \Microsoft\Office\Office Subscription Maintenance - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe
                O22 - Task (Ready): \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - C:\WINDOWS\system32\compattelrunner.exe
                O22 - Task (Ready): \Microsoft\Windows\Application Experience\ProgramDataUpdater - C:\WINDOWS\system32\compattelrunner.exe -maintenance
                O23 - Service R2: Adobe Acrobat Update Service - (AdobeARMservice) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                O23 - Service S3: Adobe Flash Player Update Service - (AdobeFlashPlayerUpdateSvc) - C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpda teService.exe
                O23 - Service S3: Windows Defender Antivirus Network Inspection Service - (WdNisSvc) - C:\Program Files\Windows Defender\NisSrv.exe
                O23 - Service S3: Windows Defender Antivirus Service - (WinDefend) - C:\Program Files\Windows Defender\MsMpEng.exe

                Now click on fix checked.
                After the fix is complete, then reboot your machine.

                After the reboot post a new hijack this log and let me know how things are running now.

                Comment

                • system
                  PCHF Owner
                  • Jan 2015
                  • 7635

                  #23
                  Logfile of HiJackThis Fork (Alpha) by Alex Dragokas v.2.6.4.17

                  Platform: x64 Windows 10 (Home), 10.0.15063 (ReleaseId: 1703), Service Pack: 0
                  Time: 25.05.2017 - 03:23
                  Language: OS: English (0x409). Display: English (0x409). Non-Unicode: English (0x409)
                  Elevated: Yes
                  Ran by: Doneff Family (group: Administrator) on DESKTOP-DOB72OG

                  Chrome: 58.0.3029.110
                  Edge: 11.0.15063.250
                  Internet Explorer: 11.0.15063.0

                  Boot mode: Normal

                  Running processes:
                  Number | Path
                  1 C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe
                  1 C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
                  1 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
                  1 C:\Program Files (x86)\Common Files\Steam\SteamService.exe
                  1 C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.ex e
                  1 C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64. exe
                  1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
                  1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
                  1 C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe
                  1 C:\Program Files (x86)\Lenovo\LenovoPortal\FastBoot\FbService.exe
                  1 C:\Program Files (x86)\Lenovo\LenovoPortal\LenovoPortalService.exe
                  1 C:\Program Files (x86)\Steam\Steam.exe
                  1 C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
                  1 C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
                  1 C:\Program Files\AVAST Software\Avast\AvastSvc.exe
                  1 C:\Program Files\AVAST Software\Avast\AvastUI.exe
                  1 C:\Program Files\AVAST Software\Avast\afwServ.exe
                  1 C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
                  1 C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
                  1 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                  1 C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
                  1 C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Containe r.exe
                  1 C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
                  1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x 64__kzf8qxf38zg5c\SkypeHost.exe
                  1 C:\Users\Doneff Family\Desktop\HiJackThis\HiJackThis.exe
                  1 C:\Users\Doneff Family\Desktop\MemCompression
                  1 C:\Windows\SysWOW64\dllhost.exe
                  1 C:\Windows\System32\RuntimeBroker.exe
                  1 C:\Windows\System32\SearchFilterHost.exe
                  1 C:\Windows\System32\SearchIndexer.exe
                  1 C:\Windows\System32\SearchProtocolHost.exe
                  1 C:\Windows\System32\SecurityHealthService.exe
                  1 C:\Windows\System32\SettingSyncHost.exe
                  1 C:\Windows\System32\WUDFHost.exe
                  1 C:\Windows\System32\audiodg.exe
                  1 C:\Windows\System32\backgroundTaskHost.exe
                  2 C:\Windows\System32\csrss.exe
                  1 C:\Windows\System32\dwm.exe
                  2 C:\Windows\System32\fontdrvhost.exe
                  1 C:\Windows\System32\lsass.exe
                  1 C:\Windows\System32\services.exe
                  1 C:\Windows\System32\sihost.exe
                  1 C:\Windows\System32\smartscreen.exe
                  1 C:\Windows\System32\smss.exe
                  1 C:\Windows\System32\spoolsv.exe
                  1 C:\Windows\System32\sppsvc.exe
                  70 C:\Windows\System32\svchost.exe
                  1 C:\Windows\System32\taskhostw.exe
                  1 C:\Windows\System32\wbem\WMIADAP.exe
                  2 C:\Windows\System32\wbem\WmiPrvSE.exe
                  1 C:\Windows\System32\wininit.exe
                  1 C:\Windows\System32\winlogon.exe
                  1 C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw 5n1h2txyewy\SearchUI.exe
                  1 C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2t xyewy\ShellExperienceHost.exe
                  1 C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_ 1a733a82001933cc\TiWorker.exe
                  1 C:\Windows\explorer.exe
                  1 C:\Windows\jmesoft\Service.exe
                  1 C:\Windows\servicing\TrustedInstaller.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
                  R4 - HKCU\Software\Microsoft\Internet Explorer\SearchScopes: DefaultScope = {D79BB3A3-DB24-49D3-A463-680951CD61C4} - Bing - Search - Microsoft Bing {searchTerms}&form=PRLNC1&src=IE11TR&pc=LCTE
                  R4 - HKCU\Software\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: SuggestionsURL = http://api.bing.com/qsml.aspx?query= {searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie :rowHeight}&sectionHeight={ie:sectionHeight}&FORM= IESS02&market={language}
                  R4 - HKCU\Software\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: SuggestionsURLFallback = http://api.bing.com/qsml.aspx?query= {searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie :rowHeight}&sectionHeight={ie:sectionHeight}&FORM= IESS02&market={language}
                  R4 - HKCU\Software\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: URL = Search - Microsoft Bing {searchTerms}&src=IE-SearchBox&FORM=IESR02
                  R4 - HKCU\Software\Microsoft\Internet Explorer\SearchScopes{D79BB3A3-DB24-49D3-A463-680951CD61C4} - Bing - Search - Microsoft Bing {searchTerms}&form=PRLNC1&src=IE11TR&pc=LCTE
                  O2 - BHO: Adobe Acrobat Create PDF Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavSt ub.dll
                  O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavSt ub.dll
                  O2-32 - BHO: Adobe Acrobat Create PDF Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.d ll
                  O2-32 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll
                  O2-32 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll
                  O2-32 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.d ll
                  O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe -silent --restore-last-session
                  O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvLaunch.exe /gui
                  O4 - HKLM..\Run: [Malwarebytes TrayApp] C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe
                  O4-32 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
                  O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE
                  O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll
                  O9 - Extra ‘Tools’ menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll (HKLM)
                  O9 - Extra ‘Tools’ menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\ONBttnIELinkedNotes.dll (HKLM)
                  O9 - Extra ‘Tools’ menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\ONBttnIE.dll (HKLM)
                  O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll (HKLM)
                  O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\ONBttnIELinkedNotes.dll (HKLM)
                  O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\ONBttnIE.dll (HKLM)
                  O9-32 - Extra ‘Tools’ menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll (HKLM)
                  O9-32 - Extra ‘Tools’ menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll (HKLM)
                  O9-32 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll (HKLM)
                  O9-32 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll (HKLM)
                  O17 - DHCP DNS - 1: 209.18.47.61
                  O17 - DHCP DNS - 2: 209.18.47.62
                  O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
                  O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
                  O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
                  O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
                  O22 - Task (Ready): Avast Emergency Update - C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
                  O22 - Task (Ready): GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
                  O22 - Task (Ready): SafeZone scheduled Autoupdate 1462830905 - C:\Program Files\AVAST Software\SZBrowser\launcher.exe --scheduledautoupdate $(Arg0)
                  O22 - Task (Ready): \Microsoft\Windows\BitLocker\BitLocker MDM policy Refresh - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},BitLockerPolicy - C:\WINDOWS\System32\edptask.dll
                  O22 - Task (Ready): \Microsoft\Windows\BrokerInfrastructure\BgTaskRegi strationMaintenanceTask - {E984D939-0E00-4DD9-AC3A-7ACA04745521} - (no file)
                  O22 - Task (Ready): \Microsoft\Windows\DeviceDirectoryClient\RegisterD eviceProtectionStateChanged - {AE31B729-D5FD-401E-AF42-784074835AFE},-RegisterDevice -ProtectionStateChanged -FreeNetworkOnly -NoLocation - C:\WINDOWS\system32\DeviceDirectoryClient.dll
                  O22 - Task (Ready): \Microsoft\Windows\EDP\EDP App Launch Task - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},AppLaunch - C:\WINDOWS\System32\edptask.dll
                  O22 - Task (Ready): \Microsoft\Windows\EDP\EDP Auth Task - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},ReAuth - C:\WINDOWS\System32\edptask.dll
                  O22 - Task (Ready): \Microsoft\Windows\EDP\EDP Inaccessible Credentials Task - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},MissingCredentials - C:\WINDOWS\System32\edptask.dll
                  O22 - Task (Ready): \Microsoft\Windows\EDP\StorageCardEncryption Task - {61BCD1B9-340C-40EC-9D41-D7F1C0632F05},SDCardEncryptionPolicy - C:\WINDOWS\System32\edptask.dll
                  O22 - Task (Ready): \Microsoft\Windows\Management\Provisioning\Cellula r - C:\WINDOWS\system32\ProvTool.exe /turn 7 /source CellStateChangeTask
                  O22 - Task (Ready): \Microsoft\Windows\Management\Provisioning\Logon - C:\WINDOWS\system32\ProvTool.exe /turn 5 /source LogonIdleTask
                  O22 - Task (Ready): \Microsoft\Windows\Maps\MapsToastTask - {9885AEF2-BD9F-41E0-B15E-B3141395E803},$(Arg0);$(Arg1);$(Arg2);$(Arg3);$(Ar g4);$(Arg5);$(Arg6);$(Arg7) - C:\WINDOWS\System32\mapstoasttask.dll
                  O22 - Task (Ready): \Microsoft\Windows\Subscription\EnableLicenseAcqui sition - C:\WINDOWS\system32\ClipRenew.exe -e
                  O22 - Task (Ready): \Microsoft\Windows\UNP\RunCampaignManager - C:\WINDOWS\System32\UNP\UNPCampaignManager.exe
                  O22 - Task (Ready): \Microsoft\Windows\WwanSvc\NotificationTask - C:\WINDOWS\System32\WiFiTask.exe wwan
                  O22 - Task (Running): GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
                  O22 - Task (Running): \AVAST Software\Avast settings backup - C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs
                  O23 - Service R2: Adobe Genuine Software Integrity Service - (AGSService) - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
                  O23 - Service R2: Avast Antivirus - (avast! Antivirus) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
                  O23 - Service R2: Avast Firewall Service - (avast! Firewall) - C:\Program Files\AVAST Software\Avast\afwServ.exe
                  O23 - Service R2: FastbootService - C:\Program Files (x86)\Lenovo\LenovoPortal\FastBoot\FbService.exe
                  O23 - Service R2: Intel(R) Security Assist Helper - (isaHelperSvc) - C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe
                  O23 - Service R2: JME Keyboard Driver - (JME Keyboard) - C:\Windows\jmesoft\Service.exe
                  O23 - Service R2: LenovoPortalService - C:\Program Files (x86)\Lenovo\LenovoPortal\LenovoPortalService.exe
                  O23 - Service R2: Malwarebytes Service - (MBAMService) - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
                  O23 - Service R2: NVIDIA Display Container LS - (NVDisplay.ContainerLocalSystem) - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Containe r.exe
                  O23 - Service R2: ZAM Controller Service - (ZAMSvc) - C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
                  O23 - Service R3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
                  O23 - Service R3: aswbIDSAgent - C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
                  O23 - Service S2: Google Update Service (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                  O23 - Service S2: Intel(R) Dynamic Application Loader Host Interface Service - (jhi_service) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
                  O23 - Service S2: Intel(R) Management and Security Application Local Management Service - (LMS) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
                  O23 - Service S2: Intel(R) Rapid Storage Technology - (IAStorDataMgrSvc) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
                  O23 - Service S2: System Interface Foundation Service - (ImControllerService) - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.Im Controller.exe
                  O23 - Service S3: Google Update Service (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                  O23 - Service S3: Intel(R) Capability Licensing Service TCP IP Interface - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
                  O23 - Service S3: Intel(R) Security Assist - C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
                  O23 - Service S3: LSCWinService - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
                  O23 - Service S3: ShareItSvc - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe
                  O23 - Service S3: Windows Defender Antivirus Network Inspection Service - (WdNisSvc) - C:\Program Files\Windows Defender\NisSrv.exe
                  O23 - Service S3: Windows Defender Antivirus Service - (WinDefend) - C:\Program Files\Windows Defender\MsMpEng.exe
                  O23 - Service S3: nProtect GameGuard Service - (npggsvc) - C:\WINDOWS\SysWow64\GameMon.des


                  End of file - Time spent: 35 sec. - 30044 bytes, CRC32: FFFFFFFF. Sign: 쐇ꯋ

                  Will let you know how things are going. Thanks for your help.

                  Comment

                  • Malnutrition
                    PCHF Moderator
                    • Jul 2016
                    • 7041

                    #24
                    Originally posted by GamerGirl74
                    Will let you know how things are going. Thanks for your help.
                    Ok, to keep your temp files in check, I’d suggest having CCleaner run at startup.

                    Clean up temp files and reduce startup load with CCleaner.


                    Note: This tool will clean your browsing history as well.
                    [ul]
                    [li]Download CCleaner from here.[/li][li]After install Click Options.[/li][li]Go to monitoring.[/li][li]Uncheck All Monitoring items.[/li][li]Go to advanced – Click close program after cleaning.[/li][li]Go to settings – click run ccleaner when the computer starts.[/li][li]Now that you have ccleaner installed and set-up:[/li][li]Open the program.[/li][li]Go to Tools[/li][li]Go to Startup[/li][li]Now double click each item. To Disable.[/li][li]Leave only your antivirus enabled.[/li][li]Then disable All items in your scheduled task as well.[/li][li]Unless they are related to windows defender.Or your antivirus.[/li][li]Reboot the machine.[/li][/ul]
                    As well, a final couple of scans on the machine to ensure that there is no malware hiding.



                    Adware Removal Tool Scan.

                    Download Adware removal tool to your desktop, right click the icon and select Run as Administrator.

                    [MEDIA=imgur]LOr0Gd7[/MEDIA]

                    Hit Ok.

                    [MEDIA=imgur]sYFsqHx[/MEDIA]

                    Hit next make sure to leave all items checked, for removal.

                    [MEDIA=imgur]8NcZjGc[/MEDIA]

                    The Program will close all open programs to complete the removal, so save any work and hit OK. Then hit OK after the removal process is complete, thenOK again to finish up. Post log generated by tool.


                    9-Lab Scan.


                    [ul]
                    [li]Download 9-Lab Removal Tool. [/li][li]CLICK HERE to determine whether you’re running 32-bit or 64-bit for Windows.[/li][li]Disable your antivirus prior to this scan.[/li]
                    [li]Install the program onto your computer, then right click the icon run as administrator.[/li][li]Update the program and then run a Quick scan![/li][li]Make sure the program updates, might be better to install it update reboot and check for updates again.[/li][li]You need to make sure the database updates!!![/li][li]Upon Scan Completion Click on Show Results.[/li][li]Then Click On Clean[/li][li]Then Click on Save Log.[/li][li]Save it to your desktop, copy and paste the contents of the log here in your next reply.[/li][/ul]

                    Comment

                    • system
                      PCHF Owner
                      • Jan 2015
                      • 7635

                      #25
                      Adware Removal Tool 5.1
                      Time: 2017_05_25_21_34_23
                      OS: Windows 10 Home - x64 Bit
                      Account Name: Doneff Family
                      Adware Definition: 05222017.1
                      Elapsed time: 07:25
                      Scan Status:- Automatic Done

                      \\\\\\\\\\\\ Scan Logs \\\\\\\\\\\

                      Browser: Chrome Found : Adware.Conduit : C:\Users\Doneff Family\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data

                      Comment

                      • system
                        PCHF Owner
                        • Jan 2015
                        • 7635

                        #26
                        9-lab Removal Tool 1.0.0.39 BETA

                        [URL unfurl="true"]https://9-lab.com/[/URL]

                        Database version: 167.49509

                        Windows 8 (Version 6.2, Build 0, 64-bit Edition)
                        Internet Explorer 9.11.15063.0
                        Doneff Family :: DESKTOP-DOB72OG

                        5/25/2017 10:06:53 PM
                        9lab-log-2017-05-25 (22-06-53).txt

                        Scan type: Quick
                        Objects scanned: 29827
                        Time Elapsed: 18 m 16 s

                        Files detected: 2
                        [48ED7180F4C0E72B39EABEC42DA21F21] Malware.Win32.Gen.sm [c:\users\doneff family\desktop\Games\nester - Shortcut.lnk]
                        [83FB09C407EB4D2B3742B1CCC95626F5] Malware.Win32.Gen.sm [c:\users\doneff family\desktop\Toolbox\SupRestric.exe]

                        Comment

                        • system
                          PCHF Owner
                          • Jan 2015
                          • 7635

                          #27
                          So far, things are going well. No more extra window popups without our wanting them to.

                          Comment

                          • Malnutrition
                            PCHF Moderator
                            • Jul 2016
                            • 7041

                            #28
                            Your machine is clean…

                            Glad to have helped!! Please tell a friend … or two about us. https://forum.windowsinstructed.com/...cons/smile.png

                            Optimize your internet connection.

                            Click here for instructions.


                            suggest the following in place of adblock.
                            Alternate DNS Server. Ad Blocking DNS.
                            Ublock Origin.
                            Anti Ad Block Killer.

                            Also, keep your browsing private with these tools:

                            Self Destructing Cookies.
                            Self Destructing Cookies Chrome.

                            Some items to keep you safe on the internet.

                            VooDoo Shield. control of what is running on your machine
                            Qualys BrowserCheck To update plugins.
                            Unchecky To Avoid Bundled Software.
                            Privazer To Clean up your mahcine.

                            Now Lets Clean up the tools we used and remove old restore points.

                            Downloads - DelFix - Download Now - ToolsLib’]

                            Download DelFix by “Xplode” to your Desktop.[/URL]
                            Right Click the tool and Run as Admin ( Xp Users Double Click)
                            Put a check mark next the items below:

                            Remove disinfection tools
                            Create registry backup
                            Purge System Restore

                            Now click on “Run” button.
                            allow the program to complete its work.
                            all the tools we used will be removed.
                            Tool will create and open a log report (DelFix.txt)
                            Note: The report can be located at the following location C:\DelFix.txt

                            Comment

                            Working...