Solved DNS_PROBE_FINISHED_NO_INTERNET after malware removal

[Emmawii]

Hi,

I'm not that good with computers so I apologised in advance for the terminology I use.

I picked up a malware/trojan on my laptop and followed these steps here and was able to remove the malware by following the instructions on this forum
https://forums.malwarebytes.org/index.php?/topic/173575-cant-install-malwarebytes-run-firefox/

However, I now get a DNS_PROBE_FINISHED_NO_INTERNET message when I try to access the internet via Google Chrome. I've tried the ipconfig and similar command prompts to no avail. I've also tried changing the DNS to open ones but that didn't work. I've also tried these troubleshooting: instructionshttp://www.selectrealsecurity.com/fix-internet-connection

Thanks in advance

 

[Emmawii]

I'm tethering the internet via my phone to my laptop. The internet on my phone works fine.

 

[Broni]

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

====================================

Did you try different browser?

 

[Emmawii]

Yup, I've tried Internet Explorer.

 

[Broni]

Go on...

 

[Emmawii]

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:27-12-2015
Ran by User (administrator) on USER-PC (28-12-2015 11:04:50)
Running from C:\Users\User\AppData\Local\Temp\WPDNSE\{00000352-0001-0001-0000-000000000000}
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Comfort Software Group) C:\Program Files\HotVirtualKeyboard\hvk.exe
(Microsoft Corporation) C:\Windows\System32\WPDShextAutoplay.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\DeviceDisplayObjectProvider.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [BCSSync] => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [NSU_agent] => "C:\Program Files (x86)\Nokia\Nokia Software Updater\nsu3ui_agent.exe"
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: F - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: G - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {02846309-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0284630e-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0a20fc32-0982-11e5-815c-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} - G:\NokiaPCIA_Autorun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {1e498469-cf5d-11e4-9a27-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cec-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c71af18e-44b1-11e5-b7b1-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {ecf4d450-454b-11e5-9e34-806e6f6e6963} - G:\HTC_Sync_Manager_PC.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{239856E5-60B8-4CF9-B591-8212CF9FF45A}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{52E928E2-4121-46AF-B14C-7362DCA0B379}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{627FEDE6-4E3F-41D6-A9B2-9EE5AC7E8ABE}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{67A0D25B-C06C-40F6-8299-4B477557511D}: [NameServer] 8.8.8.8,211.29.13.12
Tcpip\..\Interfaces\{78575C46-E380-4208-8D11-13EC7AE2CABE}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{7F206FE6-B8BE-4915-ADC4-A368F11AA716}: [NameServer] 208.67.222.222,208.67.220.220,8.8.4.4
Tcpip\..\Interfaces\{8789EBBE-4FE2-49ED-A4CA-6CB28881CAE3}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{8D0716F8-13A1-470D-8825-D6B5517B4D10}: [NameServer] 208.67.222.222,208.67.220.220
Tcpip\..\Interfaces\{A65E4E33-E079-4F61-A2DF-A7CA916A206B}: [DhcpNameServer] 10.9.0.1

Internet Explorer:
==================
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ninemsn.com.au/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-332799431-1520625345-1691349392-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-332799431-1520625345-1691349392-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-03] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-03] (Oracle Corporation)

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-07-31] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2013-04-03] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-03] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-03] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @millisecond.com/npInquisit,version=4.0 -> C:\Program Files (x86)\Millisecond Software\Inquisit 4 Web Plugin\npInquisit.dll [2014-03-14] (Millisecond Software)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-09] (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Profile 1 -> hxxp://www.omniboxes.com/?type=hp&ts=1449986746&z=9d9fee673323d90c09f13eeg2z3z1t9tbb8q9q6c9z&from=amt&uid=WDCXWD5000BPVT-60HXZT3_WD-WXG1E82MSZ15MSZ15
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (HP Product Detection Plugin) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp [2013-10-31]
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-11]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-08-06]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-28]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-30]
CHR Extension: (Google Docs Offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-08]
CHR Extension: (AdBlock) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-10-06]
CHR Extension: (Google Keep - notes and lists) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2015-10-12]
CHR Extension: (Disconnect) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo [2015-08-06]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-18]
CHR Extension: (MailTrack for Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndnaehgpjlnokgebbaldlmgkapkpjkkb [2015-08-24]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-06]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-12]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
S2 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 SurfEasyVPN; C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe [3272048 2015-03-05] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 copperhd; C:\Windows\System32\drivers\copperhd.sys [13824 2006-05-24] (Razer (Asia-Pacific) Pte Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [249856 2010-03-24] (Huawei Technologies Co., Ltd.)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114560 2010-03-20] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
R3 tapse01; C:\Windows\System32\DRIVERS\tapse01.sys [39048 2015-03-05] (The OpenVPN Project)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S1 efbamqjh; \??\C:\Windows\system32\drivers\efbamqjh.sys [X]
S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
S3 HtcVCom32; system32\DRIVERS\HtcVComV64.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S1 yqzvqapb; \??\C:\Windows\system32\drivers\yqzvqapb.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-27 17:16 - 2015-12-27 17:16 - 00000000 ____D C:\AdwCleaner
2015-12-27 17:14 - 2015-12-27 17:14 - 00000000 ____D C:\zoek_backup
2015-12-27 17:11 - 2015-12-28 11:04 - 00000000 ____D C:\FRST
2015-12-27 17:05 - 2015-12-27 17:08 - 00389162 _____ C:\TDSSKiller.3.1.0.9_27.12.2015_17.05.35_log.txt
2015-12-14 11:54 - 2015-12-14 11:55 - 00000720 _____ C:\DelFix.txt
2015-12-13 23:51 - 2015-12-23 17:25 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-12-13 23:51 - 2015-12-13 23:51 - 00001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-12-13 23:51 - 2015-12-13 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-12-13 23:51 - 2015-12-13 23:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-12-13 23:51 - 2015-12-13 23:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-12-13 23:51 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-12-13 23:51 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-12-13 23:51 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2015-12-13 23:29 - 2015-12-13 23:49 - 00000000 ____D C:\zoek
2015-12-13 20:11 - 2015-12-13 20:08 - 22908888 ____N (Malwarebytes ) C:\Users\User\Desktop\mbam-setup-org-2.2.0.1024.exe
2015-12-13 19:53 - 2015-12-13 19:53 - 00003148 _____ C:\Windows\System32\Tasks\{D19222F7-393E-46E5-817F-D657D32F3978}
2015-12-13 17:49 - 2015-12-13 22:52 - 00001258 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fc32h45r31o78m97e.lnk
2015-12-13 17:40 - 2015-12-13 19:26 - 00944642 _____ C:\Windows\ntbtlog.txt
2015-12-13 17:28 - 2015-12-13 17:28 - 00000000 ____D C:\Users\User\.MCTranscodingSDK
2015-12-13 17:25 - 2015-12-13 17:48 - 00004840 _____ C:\Windows\SysWOW64\Papogaj.ini
2015-12-13 17:25 - 2015-12-13 17:48 - 00002560 _____ C:\Windows\SysWOW64\PapogajOff.ini
2015-12-13 17:25 - 2015-12-13 17:48 - 00002560 _____ C:\Windows\system32\PapogajOff.ini
2015-12-13 17:24 - 2015-12-13 17:25 - 00000000 ____D C:\Users\User\AppData\Local\Tempfolder
2015-12-13 17:24 - 2015-12-13 17:24 - 00000000 ____D C:\Windows\system32\mut
2015-12-13 17:24 - 2015-12-13 17:24 - 00000000 ____D C:\Users\User\AppData\Roaming\WiiccuAtifi
2015-12-13 17:23 - 2015-12-13 17:23 - 00003336 _____ C:\Windows\System32\Tasks\Dedketde
2015-12-13 17:23 - 2015-12-13 17:23 - 00000000 ____D C:\uninst
2015-12-13 17:21 - 2015-12-13 17:21 - 00003132 _____ C:\Windows\System32\Tasks\Web Balance
2015-12-13 17:21 - 2015-12-13 17:21 - 00003118 _____ C:\Windows\System32\Tasks\Web Balance2
2015-12-13 17:17 - 2015-12-13 17:17 - 00003832 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1449987422
2015-12-13 17:14 - 2015-12-13 17:57 - 00000000 ____D C:\Program Files (x86)\Opera
2015-12-13 17:13 - 2015-12-13 17:19 - 00000000 ____D C:\Users\User\AppData\Roaming\DivX
2015-12-13 17:10 - 2015-12-13 17:10 - 00000973 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-12-13 17:06 - 2015-12-13 22:22 - 00000000 ____D C:\Program Files (x86)\DivX
2015-12-13 17:06 - 2015-12-13 17:06 - 00000000 ____D C:\ProgramData\Tmp0x0x
2015-12-11 13:24 - 2015-12-11 13:25 - 00173281 _____ C:\Users\User\Downloads\Resume_THIS ONE.pdf
2015-12-11 13:23 - 2015-12-11 13:23 - 00061024 _____ C:\Users\User\Downloads\passport certified.pdf
2015-12-11 13:20 - 2015-12-11 13:21 - 00626898 _____ C:\Users\User\Downloads\counselling certified.pdf
2015-12-11 13:16 - 2015-12-11 13:17 - 00223781 _____ C:\Users\User\Downloads\VCE certfied.pdf
2015-12-11 13:09 - 2015-12-11 13:09 - 00457835 _____ C:\Users\User\Downloads\mentoring certified.pdf
2015-12-09 16:50 - 2015-12-09 16:51 - 00385537 _____ C:\Users\User\Downloads\mental_status_exam (1).ppt
2015-12-09 16:34 - 2015-12-09 16:35 - 00385537 _____ C:\Users\User\Downloads\mental_status_exam.ppt
2015-12-09 13:06 - 2015-12-09 13:06 - 00402030 _____ C:\Users\User\Downloads\106207-148082-1-PB (1).pdf
2015-12-08 15:53 - 2015-12-08 15:54 - 00402030 _____ C:\Users\User\Downloads\106207-148082-1-PB.pdf
2015-12-06 16:17 - 2015-12-06 16:19 - 03127032 _____ C:\Users\User\Downloads\The_relationship_between_accul.PDF
2015-12-02 16:10 - 2015-12-02 16:10 - 00848896 _____ C:\Users\User\Downloads\PRESENTATION WITHOUT NOTES.ppt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-28 10:50 - 2009-07-14 14:20 - 00000000 ____D C:\Windows\system32\NDF
2015-12-28 10:48 - 2013-03-02 15:20 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2015-12-28 10:48 - 2013-02-20 21:41 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-28 10:47 - 2009-07-14 15:45 - 00024800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-28 10:47 - 2009-07-14 15:45 - 00024800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-27 18:47 - 2009-07-14 16:13 - 00782510 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-27 18:47 - 2009-07-14 14:20 - 00000000 ____D C:\Windows\inf
2015-12-27 17:14 - 2009-07-14 14:20 - 00000000 ____D C:\Windows
2015-12-27 16:40 - 2013-02-20 21:41 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-27 14:19 - 2009-07-14 16:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-27 12:58 - 2009-07-14 16:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-12-14 11:03 - 2009-07-14 16:32 - 00000000 ____D C:\Windows\Offline Web Pages
2015-12-13 20:58 - 2014-11-01 12:13 - 00000000 ____D C:\Users\User\AppData\Local\ElevatedDiagnostics
2015-12-13 20:50 - 2014-11-26 16:36 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieBrowserModeList
2015-12-13 17:56 - 2013-02-16 12:54 - 00001413 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-12-13 17:33 - 2013-02-20 21:41 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2015-12-13 17:31 - 2013-02-16 12:54 - 00000000 ____D C:\Users\User\AppData\Local\VirtualStore
2015-12-13 17:06 - 2015-10-06 13:52 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-13 17:06 - 2013-02-20 22:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-02 16:35 - 2013-02-20 21:41 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-02 16:35 - 2013-02-20 21:41 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2015-10-24 17:26 - 2015-10-24 17:26 - 0003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-11-11 14:12 - 2015-11-11 14:12 - 0002157 _____ () C:\Users\User\AppData\Local\recently-used.xbel
2014-11-01 12:00 - 2015-02-27 12:40 - 0007602 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
2013-02-21 11:33 - 2013-02-21 11:33 - 0000057 _____ () C:\ProgramData\Ament.ini

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-12-20 13:36

==================== End of FRST.txt ============================

 

[Emmawii]

Additional scan result of Farbar Recovery Scan Tool (x64) Version:27-12-2015
Ran by User (2015-12-28 11:19:13)
Running from C:\Users\User\AppData\Local\Temp\WPDNSE\{00000352-0001-0001-0000-000000000000}
Windows 7 Home Premium Service Pack 1 (X64) (2013-02-16 01:53:59)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-332799431-1520625345-1691349392-500 - Administrator - Disabled)
Guest (S-1-5-21-332799431-1520625345-1691349392-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-332799431-1520625345-1691349392-1002 - Limited - Enabled)
User (S-1-5-21-332799431-1520625345-1691349392-1000 - Administrator - Enabled) => C:\Users\User

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Out of date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Out of date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\...\uTorrent) (Version: 3.3.0.29126 - BitTorrent Inc.)
µTorrent (HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\uTorrent) (Version: 3.4.3.40298 - BitTorrent Inc.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.224 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
AVG 2013 (Version: 13.0.2641 - AVG Technologies) Hidden
Blackboard Collaborate Launcher (HKLM-x32\...\{7D82D616-8BD8-4BE3-B19C-C4BC772E8426}) (Version: 1.2.0.0 - Blackboard)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
Gail Howard's Smart Luck Wheel Gold™ version Smart Luck Wheel G (HKLM-x32\...\{47D357C6-2AC9-4AC6-A46C-9C8F14ABC734}_is1) (Version: Smart Luck Wheel Gold™ Version 4.0.0.30 - Gail Howard's)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
HandBrake 0.9.5 (HKLM-x32\...\HandBrake) (Version: 0.9.5 - )
Hot Virtual Keyboard 8.0.1.0 (HKLM\...\{0F896F26-E9C0-4331-BB90-28CDDA490C93}_is1) (Version: 8.0 - Comfort Software Group)
HP Deskjet 1050 J410 series Basic Device Software (HKLM\...\{F294770E-F869-400F-81C3-614B5F13CA54}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Product Detection (HKLM-x32\...\{42D10994-A566-495D-A5E7-D0C6B5C6B35C}) (Version: 11.14.0006 - HP)
Inquisit 4 Web Plugin (HKLM-x32\...\{5C106AB3-C513-45B1-8D5A-C6DDFCE706AF}) (Version: 4.0.5.0 - Millisecond Software)
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed (HKLM\...\{2C0E6BD4-65B1-4E82-B2AC-43EFFC8F100C}) (Version: 15.0.0.0059 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{DF7756DD-656A-45C3-BA71-74673E8259A9}) (Version: 15.00.0000.0642 - Intel Corporation)
iTunes (HKLM\...\{BFEAB774-C7DC-4032-B05A-DA5F7CB7B365}) (Version: 12.2.2.25 - Apple Inc.)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
pocketwifi (HKLM-x32\...\pocketwifi) (Version: TOOL-ConnLaucher_WIN1.01.01.737 - Huawei Technologies Co.,Ltd)
PSPP (HKLM-x32\...\PSPP) (Version: 0.8.4 - Free Software Foundation, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.40.126.2011 - Realtek)
SpaceSoundPro Service (HKLM-x32\...\zz.10811.ssp) (Version: 1.0.0 - CSDI) <==== ATTENTION
SurfEasy VPN 3.1.401 (HKLM-x32\...\SurfEasy VPN) (Version: 3.1.401 - SurfEasy Inc)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0DF82C09-8B69-4D3F-8939-515027E351FB} - System32\Tasks\Dedketde => C:\PROGRA~1\SHOPPE~1\Shsiwb.bat
Task: {1CFB57D8-BE7B-4DCB-8549-C089C812B219} - System32\Tasks\Web Balance => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll",#1 <==== ATTENTION
Task: {3901593F-D5CC-4E8B-B5A3-A159B4C026E3} - System32\Tasks\Web Balance2 => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll",#1 <==== ATTENTION
Task: {39F0989C-B2D7-442F-BF10-EF50D42F1028} - System32\Tasks\Opera scheduled Autoupdate 1449987422 => C:\Program Files (x86)\Opera\launcher.exe
Task: {49C31E8F-D1CE-46E4-9561-B3CC41C91962} - System32\Tasks\{78232B2D-515F-48A0-A5C7-4A9232ED95F9} => pcalua.exe -a G:\HTCDrivers\HTCDriverInstaller.exe -d G:\HTCDrivers
Task: {4DF498D3-9E0E-475C-B7DA-21883670BBEF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {6C85B8EF-E941-4DBE-9518-4908C0B87B00} - \AdobeFlashPlayerUpdate -> No File <==== ATTENTION
Task: {70784624-1E14-48DB-AB73-C07B6873506E} - System32\Tasks\VPNReactor => C:\Program Files (x86)\VPNReactor\VPNReactor.exe
Task: {8767DBA3-A68C-4638-8D02-5F6FA8E9F894} - System32\Tasks\{D8E31926-A991-4586-AE95-F40EAE9A01A0} => pcalua.exe -a C:\Users\User\Downloads\Nokia_PC_Suite_ALL.exe -d C:\Users\User\Downloads
Task: {8BECCAE8-8A7E-4FC9-88E0-ABA5951458F9} - System32\Tasks\{991093C2-89E5-47B0-A722-58DB69489B36} => pcalua.exe -a F:\HTCDrivers\HTCDriverInstaller.exe -d F:\HTCDrivers
Task: {AA0A879F-6D58-49B7-954B-C5DF9C1B2ADD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {B7092169-DE29-438D-AD92-75BE97E65CFD} - System32\Tasks\{D19222F7-393E-46E5-817F-D657D32F3978} => pcalua.exe -a C:\Users\User\AppData\Roaming\yoursearching\UninstallManager.exe -c -ptid=face
Task: {E926BD8A-57D4-4475-9927-D8416BC58781} - System32\Tasks\{CF48E146-1385-4CC2-B076-6B9B36AF1F6E} => pcalua.exe -a C:\Users\User\Downloads\ADE_2.0_Installer.exe -d C:\Users\User\Downloads
Task: {FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C} - \AdobeFlashPlayerUpdate 2 -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-05-15 17:26 - 2015-05-15 17:26 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 17:26 - 2015-05-15 17:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-03-05 19:17 - 2015-03-05 19:17 - 03272048 _____ () C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe
2012-01-10 21:12 - 2012-01-10 21:12 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-12-03 03:58 - 2015-11-17 05:32 - 00919040 _____ () C:\Windows\mod_frst.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Papogaj => ""="service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 13:34 - 2015-12-13 17:10 - 00000973 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 pc-gizmos-ssl.com www.pc-gizmos-ssl.com # added by PC-Gizmos.com
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-332799431-1520625345-1691349392-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.42.129
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AeLookupSvc => 3
MSCONFIG\Services: ALG => 3
MSCONFIG\Services: AMPPALR3 => 2
MSCONFIG\Services: AppIDSvc => 3
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: AxInstSV => 3
MSCONFIG\Services: BDESVC => 3
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: BTHSSecurityMgr => 2
MSCONFIG\Services: CertPropSvc => 3
MSCONFIG\Services: clr_optimization_v2.0.50727_32 => 3
MSCONFIG\Services: clr_optimization_v2.0.50727_64 => 3
MSCONFIG\Services: clr_optimization_v4.0.30319_32 => 2
MSCONFIG\Services: clr_optimization_v4.0.30319_64 => 2
MSCONFIG\Services: COMSysApp => 2
MSCONFIG\Services: defragsvc => 3
MSCONFIG\Services: dot3svc => 3
MSCONFIG\Services: ehRecvr => 3
MSCONFIG\Services: ehSched => 3
MSCONFIG\Services: EventSystem => 2
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: fdPHost => 3
MSCONFIG\Services: FDResPub => 3
MSCONFIG\Services: FontCache3.0.0.0 => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: gusvc => 3
MSCONFIG\Services: hkmsvc => 3
MSCONFIG\Services: HomeGroupListener => 3
MSCONFIG\Services: HomeGroupProvider => 3
MSCONFIG\Services: idsvc => 3
MSCONFIG\Services: IEEtwCollectorService => 3
MSCONFIG\Services: IPBusEnum => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: KtmRm => 3
MSCONFIG\Services: lltdsvc => 3
MSCONFIG\Services: MSDTC => 3
MSCONFIG\Services: MSiSCSI => 3
MSCONFIG\Services: MyWiFiDHCPDNS => 3
MSCONFIG\Services: napagent => 3
MSCONFIG\Services: Netlogon => 3
MSCONFIG\Services: NlaSvc => 2
MSCONFIG\Services: p2pimsvc => 3
MSCONFIG\Services: p2psvc => 3
MSCONFIG\Services: PerfHost => 3
MSCONFIG\Services: pla => 3
MSCONFIG\Services: PNRPAutoReg => 3
MSCONFIG\Services: PNRPsvc => 3
MSCONFIG\Services: PolicyAgent => 3
MSCONFIG\Services: ProtectedStorage => 3
MSCONFIG\Services: QWAVE => 3
MSCONFIG\Services: RasAuto => 3
MSCONFIG\Services: RegSrvc => 2
MSCONFIG\Services: RemoteRegistry => 3
MSCONFIG\Services: RpcLocator => 3
MSCONFIG\Services: SamSs => 2
MSCONFIG\Services: SCardSvr => 3
MSCONFIG\Services: SCPolicySvc => 3
MSCONFIG\Services: seclogon => 3
MSCONFIG\Services: SensrSvc => 3
MSCONFIG\Services: SessionEnv => 3
MSCONFIG\Services: SharedAccess => 3
MSCONFIG\Services: SNMPTRAP => 3
MSCONFIG\Services: sppuinotify => 3
MSCONFIG\Services: swprv => 3
MSCONFIG\Services: TabletInputService => 3
MSCONFIG\Services: TapiSrv => 3
MSCONFIG\Services: TBS => 3
MSCONFIG\Services: TermService => 3
MSCONFIG\Services: THREADORDER => 3
MSCONFIG\Services: UI0Detect => 3
MSCONFIG\Services: VaultSvc => 3
MSCONFIG\Services: vds => 3
MSCONFIG\Services: VSS => 3
MSCONFIG\Services: W32Time => 2
MSCONFIG\Services: WatAdminSvc => 3
MSCONFIG\Services: wbengine => 3
MSCONFIG\Services: WbioSrvc => 3
MSCONFIG\Services: wcncsvc => 3
MSCONFIG\Services: WcsPlugInService => 3
MSCONFIG\Services: WebClient => 3
MSCONFIG\Services: Wecsvc => 3
MSCONFIG\Services: wercplsupport => 3
MSCONFIG\Services: WinDefend => 3
MSCONFIG\Services: WinRM => 3
MSCONFIG\Services: WPCSvc => 3
MSCONFIG\Services: WPDBusEnum => 3
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B214BBE2-9A6A-4139-BF8D-30C0D8DF41BD}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{ABBBAAA7-3934-4ED8-AF27-82414DFB8DA6}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{9D1D6ACF-3941-4B7D-8DD2-DE547DEC2FB6}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{A737ACB4-181F-4F30-9C9A-C548BBC45560}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{1A1FF6A0-9246-40CB-82AE-FEF4FED65C07}] => (Allow) C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe
FirewallRules: [TCP Query User{1DF84422-4C2A-47DE-85DD-A6894227A7E8}C:\users\user\downloads\utorrent.exe] => (Allow) C:\users\user\downloads\utorrent.exe
FirewallRules: [UDP Query User{FFE2D9CA-D743-4329-93D6-95452F0A2683}C:\users\user\downloads\utorrent.exe] => (Allow) C:\users\user\downloads\utorrent.exe
FirewallRules: [TCP Query User{F40874A2-CFF0-430E-AD41-C260EBA1B581}C:\users\user\downloads\utorrent.exe] => (Block) C:\users\user\downloads\utorrent.exe
FirewallRules: [UDP Query User{F6424346-DB7F-4A4A-B394-A72E136D1EF8}C:\users\user\downloads\utorrent.exe] => (Block) C:\users\user\downloads\utorrent.exe
FirewallRules: [{443CE3C7-FCDB-4525-90F7-5C88B3059C5E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4253A253-5FEB-462E-B174-448126245743}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{77A9C9C3-74DB-4A6D-92E9-43B5C16ABEAC}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{016A807A-972B-4BEF-A976-D53EBD82CA35}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{05D4EF0C-AC7A-42C3-A071-C1641ED7CDBC}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{EDFCB7F1-7958-43AE-865D-9AA66487F779}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [TCP Query User{F7771644-515C-4535-994A-D4F758887465}C:\users\user\documents\utorrent.exe] => (Allow) C:\users\user\documents\utorrent.exe
FirewallRules: [UDP Query User{CDFD7497-16CC-432D-B074-C4238E93D68A}C:\users\user\documents\utorrent.exe] => (Allow) C:\users\user\documents\utorrent.exe
FirewallRules: [TCP Query User{64D9CC18-6A03-414B-8460-4344F0C15621}C:\users\user\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe] => (Allow) C:\users\user\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe
FirewallRules: [UDP Query User{32D5A571-E2D5-4994-9BA2-F67D1D801C24}C:\users\user\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe] => (Allow) C:\users\user\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe
FirewallRules: [TCP Query User{8F1ECCB0-DB30-4F71-8FE6-C67997CFE03F}C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe
FirewallRules: [UDP Query User{04A4F4D8-F814-4EC6-8CEA-A9444DF78E01}C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe
FirewallRules: [{A37DBF00-3D6C-40EE-AB20-FE6A273B3F7C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{C5A94A4A-600E-4DD8-BCEF-FE73D5C47052}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{F8236DF2-A81D-499A-B915-5AC6D3A86E48}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================


==================== Faulty Device Manager Devices =============

Name: PS/2 Compatible Mouse
Description: PS/2 Compatible Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
.


Operation:
Subscribing Writer

Context:
Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Name: Shadow Copy Optimization Writer
Writer Instance ID: {eeaa4bb0-2ef0-4029-a9bc-a36caf61844e}

Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
]


Operation:
Subscribing Writer

Context:
Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Name: Shadow Copy Optimization Writer
Writer Instance ID: {eeaa4bb0-2ef0-4029-a9bc-a36caf61844e}

Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
.


Operation:
Subscribing Writer

Context:
Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Name: ASR Writer
Writer Instance ID: {73ff2a89-01b5-4e87-9dd7-9a6193b92555}

Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
]


Operation:
Subscribing Writer

Context:
Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Name: ASR Writer
Writer Instance ID: {73ff2a89-01b5-4e87-9dd7-9a6193b92555}

Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 12346) (User: )
Description: Volume Shadow Copy Error: An error 0x80042302, A Volume Shadow Copy Service component encountered an unexpected error.
Check the Application event log for more information.
was encountered while trying to initialize the Registry Writer. This may cause
future shadow-copy creations to fail.

Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
.


Operation:
Subscribing Writer

Context:
Writer Class Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Name: COM+ REGDB Writer
Writer Instance ID: {9119991c-73a0-43fe-9c1e-f79f04b370ea}

Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
]


Operation:
Subscribing Writer

Context:
Writer Class Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Name: COM+ REGDB Writer
Writer Instance ID: {9119991c-73a0-43fe-9c1e-f79f04b370ea}

Error: (12/28/2015 11:20:37 AM) (Source: VSS) (EventID: 12342) (User: )
Description: Volume Shadow Copy Error: An error 0x80042302, A Volume Shadow Copy Service component encountered an unexpected error.
Check the Application event log for more information.
was encountered while trying to initialize the Registry Writer. This may cause
future shadow-copy creations to fail.

Error: (12/28/2015 11:20:37 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine Subscribing the Registry server writer failed. hr = 8004230208lx. hr = 0x80042302, A Volume Shadow Copy Service component encountered an unexpected error.
Check the Application event log for more information.
.

Error: (12/28/2015 11:20:36 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
.


Operation:
Subscribing Writer

Context:
Writer Class Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Name: Registry Writer
Writer Instance ID: {88615323-c5fb-4828-83f5-3e2013a558ec}


System errors:
=============
Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Server service depends on the Security Accounts Manager service which failed to start because of the following error:
%%1058

Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Server service depends on the Security Accounts Manager service which failed to start because of the following error:
%%1058

Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Server service depends on the Security Accounts Manager service which failed to start because of the following error:
%%1058

Error: (12/28/2015 11:18:22 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1058

Error: (12/28/2015 11:18:19 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1058

Error: (12/28/2015 11:18:16 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1058

Error: (12/28/2015 11:18:13 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1058


CodeIntegrity:
===================================
Date: 2015-12-13 17:32:54.717
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:32:54.545
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:32:22.191
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:32:21.925
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:32:11.856
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:32:11.498
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:28:27.988
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:28:27.800
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:25:46.702
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-13 17:25:46.400
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
Percentage of memory in use: 93%
Total physical RAM: 1908.56 MB
Available physical RAM: 120.39 MB
Total Virtual: 4117.13 MB
Available Virtual: 1834.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:250 GB) (Free:89.3 GB) NTFS
Drive d: () (Fixed) (Total:215.66 GB) (Free:192.52 GB) NTFS
Drive g: (HTC Sync Manager) (CDROM) (Total:0.02 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 45D61283)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=250 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=215.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

 

[Emmawii]

Don't know if this helps, but since the infection I get pop ups all the time saying my copy of Windows is not genuine.. I can't find the download disk to confirm it is and remove those annoying pop ups though.

 

[Broni]

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

[Emmawii]

Fix result of Farbar Recovery Scan Tool (x64) Version:27-12-2015
Ran by User (2015-12-28 12:03:35) Run:1
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: F - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: G - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {02846309-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0284630e-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0a20fc32-0982-11e5-815c-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} - G:\NokiaPCIA_Autorun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {1e498469-cf5d-11e4-9a27-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cec-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c71af18e-44b1-11e5-b7b1-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {ecf4d450-454b-11e5-9e34-806e6f6e6963} - G:\HTC_Sync_Manager_PC.exe
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
CHR HomePage: Profile 1 -> hxxp://www.omniboxes.com/?type=hp&ts=1449986746&z=9d9fee673323d90c09f13eeg2z3z1t9tbb8q9q6c9z&from=amt&uid=WDCXWD5000BPVT-60HXZT3_WD-WXG1E82MSZ15MSZ15
S1 efbamqjh; \??\C:\Windows\system32\drivers\efbamqjh.sys [X]
S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
S3 HtcVCom32; system32\DRIVERS\HtcVComV64.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S1 yqzvqapb; \??\C:\Windows\system32\drivers\yqzvqapb.sys [X]
2015-10-24 17:26 - 2015-10-24 17:26 - 0003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-11-11 14:12 - 2015-11-11 14:12 - 0002157 _____ () C:\Users\User\AppData\Local\recently-used.xbel
2014-11-01 12:00 - 2015-02-27 12:40 - 0007602 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
2013-02-21 11:33 - 2013-02-21 11:33 - 0000057 _____ () C:\ProgramData\Ament.ini
Task: {1CFB57D8-BE7B-4DCB-8549-C089C812B219} - System32\Tasks\Web Balance => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll",#1 <==== ATTENTION
Task: {3901593F-D5CC-4E8B-B5A3-A159B4C026E3} - System32\Tasks\Web Balance2 => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll",#1 <==== ATTENTION
C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll
C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll
Task: {6C85B8EF-E941-4DBE-9518-4908C0B87B00} - \AdobeFlashPlayerUpdate -> No File <==== ATTENTION
Task: {FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C} - \AdobeFlashPlayerUpdate 2 -> No File <==== ATTENTION

*****************

"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F" => key removed successfully
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G" => key removed successfully
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{02846309-d66c-11e4-8795-022824040567}" => key removed successfully
HKCR\CLSID\{02846309-d66c-11e4-8795-022824040567} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0284630e-d66c-11e4-8795-022824040567}" => key removed successfully
HKCR\CLSID\{0284630e-d66c-11e4-8795-022824040567} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a20fc32-0982-11e5-815c-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{0a20fc32-0982-11e5-815c-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0ea7f60d-7b01-11e2-8a0f-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e498469-cf5d-11e4-9a27-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{1e498469-cf5d-11e4-9a27-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cec-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
HKCR\CLSID\{b2fc5cec-cbc0-11e4-ad93-02110f6f0071} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cf3-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
HKCR\CLSID\{b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cf6-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
HKCR\CLSID\{b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5d0d-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
HKCR\CLSID\{b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c25fa7c7-dc71-11e2-8dc2-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c25fa7d1-dc71-11e2-8dc2-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c71af18e-44b1-11e5-b7b1-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{c71af18e-44b1-11e5-b7b1-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ecf4d450-454b-11e5-9e34-806e6f6e6963}" => key removed successfully
HKCR\CLSID\{ecf4d450-454b-11e5-9e34-806e6f6e6963} => key not found.
"HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}" => key removed successfully
HKCR\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key not found.
Chrome HomePage => removed successfully
efbamqjh => service removed successfully
HTCAND64 => service removed successfully
HtcVCom32 => service removed successfully
pccsmcfd => service removed successfully
yqzvqapb => service removed successfully
C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\Users\User\AppData\Local\recently-used.xbel => moved successfully
C:\Users\User\AppData\Local\Resmon.ResmonCfg => moved successfully
C:\ProgramData\Ament.ini => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1CFB57D8-BE7B-4DCB-8549-C089C812B219}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1CFB57D8-BE7B-4DCB-8549-C089C812B219}" => key removed successfully
C:\Windows\System32\Tasks\Web Balance => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Balance" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3901593F-D5CC-4E8B-B5A3-A159B4C026E3}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3901593F-D5CC-4E8B-B5A3-A159B4C026E3}" => key removed successfully
C:\Windows\System32\Tasks\Web Balance2 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Balance2" => key removed successfully
"C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll" => not found.
"C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll" => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6C85B8EF-E941-4DBE-9518-4908C0B87B00}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C85B8EF-E941-4DBE-9518-4908C0B87B00}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate 2" => key removed successfully

==== End of Fixlog 12:03:38 ====

 

[Broni]

since the infection I get pop ups all the time saying my copy of Windows is not genuine.

Try to follow whatever that popup says.

Still no connection?

 

[Emmawii]

Yup, I just click on "ask me later". Still no connection. Chrome comes up with DNS_PROBE_FINISHED_BAD_CONFIG now when I try to connect...

 

[Broni]

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender
  • Other Services
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

 

[Emmawii]

Fix result of Farbar Recovery Scan Tool (x64) Version:27-12-2015
Ran by User (2015-12-28 12:03:35) Run:1
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: F - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: G - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {02846309-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0284630e-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0a20fc32-0982-11e5-815c-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} - G:\NokiaPCIA_Autorun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {1e498469-cf5d-11e4-9a27-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cec-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c71af18e-44b1-11e5-b7b1-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {ecf4d450-454b-11e5-9e34-806e6f6e6963} - G:\HTC_Sync_Manager_PC.exe
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
CHR HomePage: Profile 1 -> hxxp://www.omniboxes.com/?type=hp&ts=1449986746&z=9d9fee673323d90c09f13eeg2z3z1t9tbb8q9q6c9z&from=amt&uid=WDCXWD5000BPVT-60HXZT3_WD-WXG1E82MSZ15MSZ15
S1 efbamqjh; \??\C:\Windows\system32\drivers\efbamqjh.sys [X]
S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
S3 HtcVCom32; system32\DRIVERS\HtcVComV64.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S1 yqzvqapb; \??\C:\Windows\system32\drivers\yqzvqapb.sys [X]
2015-10-24 17:26 - 2015-10-24 17:26 - 0003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-11-11 14:12 - 2015-11-11 14:12 - 0002157 _____ () C:\Users\User\AppData\Local\recently-used.xbel
2014-11-01 12:00 - 2015-02-27 12:40 - 0007602 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
2013-02-21 11:33 - 2013-02-21 11:33 - 0000057 _____ () C:\ProgramData\Ament.ini
Task: {1CFB57D8-BE7B-4DCB-8549-C089C812B219} - System32\Tasks\Web Balance => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll",#1 <==== ATTENTION
Task: {3901593F-D5CC-4E8B-B5A3-A159B4C026E3} - System32\Tasks\Web Balance2 => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll",#1 <==== ATTENTION
C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll
C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll
Task: {6C85B8EF-E941-4DBE-9518-4908C0B87B00} - \AdobeFlashPlayerUpdate -> No File <==== ATTENTION
Task: {FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C} - \AdobeFlashPlayerUpdate 2 -> No File <==== ATTENTION

*****************

"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F" => key removed successfully
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G" => key removed successfully
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{02846309-d66c-11e4-8795-022824040567}" => key removed successfully
HKCR\CLSID\{02846309-d66c-11e4-8795-022824040567} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0284630e-d66c-11e4-8795-022824040567}" => key removed successfully
HKCR\CLSID\{0284630e-d66c-11e4-8795-022824040567} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a20fc32-0982-11e5-815c-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{0a20fc32-0982-11e5-815c-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0ea7f60d-7b01-11e2-8a0f-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e498469-cf5d-11e4-9a27-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{1e498469-cf5d-11e4-9a27-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cec-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
HKCR\CLSID\{b2fc5cec-cbc0-11e4-ad93-02110f6f0071} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cf3-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
HKCR\CLSID\{b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cf6-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
HKCR\CLSID\{b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5d0d-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
HKCR\CLSID\{b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c25fa7c7-dc71-11e2-8dc2-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c25fa7d1-dc71-11e2-8dc2-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c71af18e-44b1-11e5-b7b1-90a4de1d982e}" => key removed successfully
HKCR\CLSID\{c71af18e-44b1-11e5-b7b1-90a4de1d982e} => key not found.
"HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ecf4d450-454b-11e5-9e34-806e6f6e6963}" => key removed successfully
HKCR\CLSID\{ecf4d450-454b-11e5-9e34-806e6f6e6963} => key not found.
"HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}" => key removed successfully
HKCR\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key not found.
Chrome HomePage => removed successfully
efbamqjh => service removed successfully
HTCAND64 => service removed successfully
HtcVCom32 => service removed successfully
pccsmcfd => service removed successfully
yqzvqapb => service removed successfully
C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\Users\User\AppData\Local\recently-used.xbel => moved successfully
C:\Users\User\AppData\Local\Resmon.ResmonCfg => moved successfully
C:\ProgramData\Ament.ini => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1CFB57D8-BE7B-4DCB-8549-C089C812B219}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1CFB57D8-BE7B-4DCB-8549-C089C812B219}" => key removed successfully
C:\Windows\System32\Tasks\Web Balance => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Balance" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3901593F-D5CC-4E8B-B5A3-A159B4C026E3}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3901593F-D5CC-4E8B-B5A3-A159B4C026E3}" => key removed successfully
C:\Windows\System32\Tasks\Web Balance2 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Balance2" => key removed successfully
"C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll" => not found.
"C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll" => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6C85B8EF-E941-4DBE-9518-4908C0B87B00}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C85B8EF-E941-4DBE-9518-4908C0B87B00}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate 2" => key removed successfully

==== End of Fixlog 12:03:38 ====

 

[Emmawii]

Windows Network Diagnostic says the DNS server may be unavailable,however it's detected.

 

[Broni]

Please read my previous reply.

 

[Emmawii]

Sorry, it didn't copy over properly.

Farbar Service Scanner Version: 10-06-2014
Ran by User (administrator) on 28-12-2015 at 12:19:55
Running from "C:\Users\User\AppData\Local\Temp\WPDNSE\{00000352-0001-0001-0000-000000000000}"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo.com returned error: Other errors


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============
BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is set to Disabled. The default start type is Auto.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

[Broni]

Go Start and in "Start search" type:
services.msc
Press Enter.

Services window will open.
Find Background Intelligent Transfer Service (BITS) and COM+ Event System services.
In each case right click on the service, click "Properties" and under "Startup type" select "Automatic" from drop, down menu.
Restart computer, post fresh FSS log and check internet connection.

 

[Emmawii]

Still no internet connection.

Farbar Service Scanner Version: 10-06-2014
Ran by User (administrator) on 28-12-2015 at 13:47:04
Running from "C:\Users\User\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo.com returned error: Other errors


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

[Broni]

Please download MiniToolBox, save it to your desktop and run it.

Checkmark following boxes:

• Flush DNS
• Reset IE Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List Devices (do NOT change any settings)

Click Go and post the result.

 

[Emmawii]

MiniToolBox by Farbar Version: 02-11-2015
Ran by User (administrator) on 28-12-2015 at 13:57:50
Running from "C:\Users\User\AppData\Local\Temp\WPDNSE\{00000352-0001-0001-0000-000000000000}"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Model: RV411/RV511/E3511/S3511/RV711 Manufacturer: SAMSUNG ELECTRONICS CO., LTD.
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

"Reset IE Proxy Settings": IE Proxy Settings were reset.
========================= Hosts content: =================================
127.0.0.1 pc-gizmos-ssl.com www.pc-gizmos-ssl.com # added by PC-Gizmos.com
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
========================= IP Configuration: ================================

Broadcom 802.11n Network Adapter = Wireless Network Connection (Connected)
HTC Remote NDIS based Device = Local Area Connection 5 (Connected)
Bluetooth Device (Personal Area Network) = Bluetooth Network Connection (Media disconnected)
Realtek PCIe GBE Family Controller = Local Area Connection (Media disconnected)
Microsoft Virtual WiFi Miniport Adapter = Wireless Network Connection 2 (Media disconnected)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled taskoffload=disabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : User-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 5:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : HTC Remote NDIS based Device #2
Physical Address. . . . . . . . . : 02-28-2C-04-71-7E
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::98d4:198:b15c:1b30%21(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.42.231(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, 28 December 2015 1:56:37 PM
Lease Expires . . . . . . . . . . : Monday, 28 December 2015 2:56:37 PM
Default Gateway . . . . . . . . . : 192.168.42.129
DHCP Server . . . . . . . . . . . : 192.168.42.129
DHCPv6 IAID . . . . . . . . . . . : 402794540
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-B0-E0-4E-E8-11-32-5A-21-2F
DNS Servers . . . . . . . . . . . : 192.168.42.129
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection* 11:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : SurfEasy TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-A6-5E-4E-33
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
Physical Address. . . . . . . . . : 90-A4-DE-58-DB-67
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom 802.11n Network Adapter
Physical Address. . . . . . . . . : 90-A4-DE-58-DB-67
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::b41c:9b76:accf:63a1%14(Preferred)
Autoconfiguration IPv4 Address. . : 169.254.99.161(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 361800926
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-B0-E0-4E-E8-11-32-5A-21-2F
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
Physical Address. . . . . . . . . : E8-11-32-5A-21-2F
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : 90-A4-DE-1D-98-2E
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Server: UnKnown
Address: 192.168.42.129

Ping request could not find host google.com. Please check the name and try again.
Server: UnKnown
Address: 192.168.42.129

Ping request could not find host yahoo.com. Please check the name and try again.

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
21...02 28 2c 04 71 7e ......HTC Remote NDIS based Device #2
19...00 ff a6 5e 4e 33 ......SurfEasy TAP-Windows Adapter V9
15...90 a4 de 58 db 67 ......Microsoft Virtual WiFi Miniport Adapter
14...90 a4 de 58 db 67 ......Broadcom 802.11n Network Adapter
13...e8 11 32 5a 21 2f ......Realtek PCIe GBE Family Controller
12...90 a4 de 1d 98 2e ......Bluetooth Device (Personal Area Network)
1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.42.129 192.168.42.231 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
169.254.0.0 255.255.0.0 On-link 169.254.99.161 281
169.254.99.161 255.255.255.255 On-link 169.254.99.161 281
169.254.255.255 255.255.255.255 On-link 169.254.99.161 281
192.168.42.0 255.255.255.0 On-link 192.168.42.231 266
192.168.42.231 255.255.255.255 On-link 192.168.42.231 266
192.168.42.255 255.255.255.255 On-link 192.168.42.231 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 169.254.99.161 281
224.0.0.0 240.0.0.0 On-link 192.168.42.231 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 169.254.99.161 281
255.255.255.255 255.255.255.255 On-link 192.168.42.231 266
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
14 281 fe80::/64 On-link
21 266 fe80::/64 On-link
21 266 fe80::98d4:198:b15c:1b30/128
On-link
14 281 fe80::b41c:9b76:accf:63a1/128
On-link
1 306 ff00::/8 On-link
14 281 ff00::/8 On-link
21 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation)
Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
Catalog5 07 C:\Windows\SysWOW64\wshbth.dll [36352] (Microsoft Corporation)
Catalog5 08 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 11 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
x64-Catalog5 07 C:\Windows\System32\wshbth.dll [47104] (Microsoft Corporation)
x64-Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 11 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

========================= Devices: ================================

Name: PS/2 Compatible Mouse
Description: PS/2 Compatible Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Device ID: ACPI\ETD0B00\4&1B3AD2B5&0
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Device ID: ROOT\WPD\0000
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Device ID: ROOT\WPD\0001
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Device ID: ROOT\WPD\0002
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Device ID: ROOT\WPD\0003
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Device ID: ROOT\WPD\0004
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


**** End of log ****

 

[Broni]

• Please download comintrep.zip and save it to your desktop
• Unzip downloaded file. It'll create cintrepair folder. Inside that folder you'll find CIntRep.exe file
• Double click on CIntRep.exe to run the tool
• Place a checkmark next to the following entries:

• Reset Internet Protocol (TCP/IP)
• Repair Winsock (Reset Catalog)
• Renew Internet Connections
• Flush DNS Resolver Cache
• Repair Internet Explorer xxxx
• Clear Windows Update History
• Repair Windows / Automatic Updates
• Repair SSL / HTTPS / Cryptography
• Reset Windows Firewall Configuration
• Restore the default hosts file
• Repair Workgroup Computers view

• Click Go!
• Ignore any error messages for now
• Click OK to reboot your computer
• Check your internet access

 

[Emmawii]

No internet connection. Error message is now DNS_PROBE_FINISHED_NXDOMAIN

 

[Broni]

What about IE and Firefox?
What happens there?

 

[Emmawii]

On USB internet, When I click Fix connection problems on IE Windows Network Diagnostic says it cannot diagnose the problem.

On WiFi internet from phone, it says Wireless Network connection doesn't have a valid IP connection. I've reset the LAN on my phone to no avail.

I don't have Firefox.