TechSpot

DNS_PROBE_FINISHED_NO_INTERNET after malware removal

By Emmawii
Dec 27, 2015
  1. Hi,

    I'm not that good with computers so I apologised in advance for the terminology I use.

    I picked up a malware/trojan on my laptop and followed these steps here and was able to remove the malware by following the instructions on this forum
    https://forums.malwarebytes.org/index.php?/topic/173575-cant-install-malwarebytes-run-firefox/

    However, I now get a DNS_PROBE_FINISHED_NO_INTERNET message when I try to access the internet via Google Chrome. I've tried the ipconfig and similar command prompts to no avail. I've also tried changing the DNS to open ones but that didn't work. I've also tried these troubleshooting: instructionshttp://www.selectrealsecurity.com/fix-internet-connection

    Thanks in advance
     
  2. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    I'm tethering the internet via my phone to my laptop. The internet on my phone works fine.
     
  3. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ====================================

    Did you try different browser?
     
  4. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Yup, I've tried Internet Explorer.
     
  5. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Go on...
     
  6. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:27-12-2015
    Ran by User (administrator) on USER-PC (28-12-2015 11:04:50)
    Running from C:\Users\User\AppData\Local\Temp\WPDNSE\{00000352-0001-0001-0000-000000000000}
    Loaded Profiles: User (Available Profiles: User)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    (Microsoft Corporation) C:\Windows\System32\wlanext.exe
    () C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe
    (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Microsoft Corporation) C:\Windows\System32\StikyNot.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Comfort Software Group) C:\Program Files\HotVirtualKeyboard\hvk.exe
    (Microsoft Corporation) C:\Windows\System32\WPDShextAutoplay.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
    (Microsoft Corporation) C:\Windows\System32\DeviceDisplayObjectProvider.exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
    HKLM\...\Run: [BCSSync] => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
    HKLM-x32\...\Run: [NSU_agent] => "C:\Program Files (x86)\Nokia\Nokia Software Updater\nsu3ui_agent.exe"
    HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: F - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: G - G:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {02846309-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0284630e-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0a20fc32-0982-11e5-815c-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} - G:\NokiaPCIA_Autorun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {1e498469-cf5d-11e4-9a27-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cec-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} - G:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c71af18e-44b1-11e5-b7b1-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {ecf4d450-454b-11e5-9e34-806e6f6e6963} - G:\HTC_Sync_Manager_PC.exe

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 192.168.42.129
    Tcpip\..\Interfaces\{239856E5-60B8-4CF9-B591-8212CF9FF45A}: [DhcpNameServer] 192.168.42.129
    Tcpip\..\Interfaces\{52E928E2-4121-46AF-B14C-7362DCA0B379}: [DhcpNameServer] 192.168.42.129
    Tcpip\..\Interfaces\{627FEDE6-4E3F-41D6-A9B2-9EE5AC7E8ABE}: [DhcpNameServer] 192.168.42.129
    Tcpip\..\Interfaces\{67A0D25B-C06C-40F6-8299-4B477557511D}: [NameServer] 8.8.8.8,211.29.13.12
    Tcpip\..\Interfaces\{78575C46-E380-4208-8D11-13EC7AE2CABE}: [DhcpNameServer] 192.168.42.129
    Tcpip\..\Interfaces\{7F206FE6-B8BE-4915-ADC4-A368F11AA716}: [NameServer] 208.67.222.222,208.67.220.220,8.8.4.4
    Tcpip\..\Interfaces\{8789EBBE-4FE2-49ED-A4CA-6CB28881CAE3}: [DhcpNameServer] 192.168.1.1 192.168.1.1
    Tcpip\..\Interfaces\{8D0716F8-13A1-470D-8825-D6B5517B4D10}: [NameServer] 208.67.222.222,208.67.220.220
    Tcpip\..\Interfaces\{A65E4E33-E079-4F61-A2DF-A7CA916A206B}: [DhcpNameServer] 10.9.0.1

    Internet Explorer:
    ==================
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ninemsn.com.au/?ocid=iehp
    SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
    SearchScopes: HKU\S-1-5-21-332799431-1520625345-1691349392-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
    SearchScopes: HKU\S-1-5-21-332799431-1520625345-1691349392-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-03] (Oracle Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-03] (Oracle Corporation)

    FireFox:
    ========
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-07-31] ()
    FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2013-04-03] (Google, Inc.)
    FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-03] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-03] (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
    FF Plugin-x32: @millisecond.com/npInquisit,version=4.0 -> C:\Program Files (x86)\Millisecond Software\Inquisit 4 Web Plugin\npInquisit.dll [2014-03-14] (Millisecond Software)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-09] (Adobe Systems Inc.)

    Chrome:
    =======
    CHR HomePage: Profile 1 -> hxxp://www.omniboxes.com/?type=hp&ts=1449986746&z=9d9fee673323d90c09f13eeg2z3z1t9tbb8q9q6c9z&from=amt&uid=WDCXWD5000BPVT-60HXZT3_WD-WXG1E82MSZ15MSZ15
    CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (HP Product Detection Plugin) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp [2013-10-31]
    CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-11]
    CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-08-06]
    CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-28]
    CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-30]
    CHR Extension: (Google Docs Offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-08]
    CHR Extension: (AdBlock) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-10-06]
    CHR Extension: (Google Keep - notes and lists) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2015-10-12]
    CHR Extension: (Disconnect) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo [2015-08-06]
    CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-18]
    CHR Extension: (MailTrack for Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndnaehgpjlnokgebbaldlmgkapkpjkkb [2015-08-24]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-06]
    CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
    CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1
    CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-12]

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
    S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
    R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
    S2 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
    R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
    R2 SurfEasyVPN; C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe [3272048 2015-03-05] ()
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
    R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 copperhd; C:\Windows\System32\drivers\copperhd.sys [13824 2006-05-24] (Razer (Asia-Pacific) Pte Ltd)
    S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
    S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [249856 2010-03-24] (Huawei Technologies Co., Ltd.)
    S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114560 2010-03-20] (Huawei Technologies Co., Ltd.)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
    S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
    R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
    S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
    R3 tapse01; C:\Windows\System32\DRIVERS\tapse01.sys [39048 2015-03-05] (The OpenVPN Project)
    S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
    S1 efbamqjh; \??\C:\Windows\system32\drivers\efbamqjh.sys [X]
    S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
    S3 HtcVCom32; system32\DRIVERS\HtcVComV64.sys [X]
    S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
    S1 yqzvqapb; \??\C:\Windows\system32\drivers\yqzvqapb.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-12-27 17:16 - 2015-12-27 17:16 - 00000000 ____D C:\AdwCleaner
    2015-12-27 17:14 - 2015-12-27 17:14 - 00000000 ____D C:\zoek_backup
    2015-12-27 17:11 - 2015-12-28 11:04 - 00000000 ____D C:\FRST
    2015-12-27 17:05 - 2015-12-27 17:08 - 00389162 _____ C:\TDSSKiller.3.1.0.9_27.12.2015_17.05.35_log.txt
    2015-12-14 11:54 - 2015-12-14 11:55 - 00000720 _____ C:\DelFix.txt
    2015-12-13 23:51 - 2015-12-23 17:25 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2015-12-13 23:51 - 2015-12-13 23:51 - 00001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2015-12-13 23:51 - 2015-12-13 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2015-12-13 23:51 - 2015-12-13 23:51 - 00000000 ____D C:\ProgramData\Malwarebytes
    2015-12-13 23:51 - 2015-12-13 23:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
    2015-12-13 23:51 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
    2015-12-13 23:51 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2015-12-13 23:51 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2015-12-13 23:29 - 2015-12-13 23:49 - 00000000 ____D C:\zoek
    2015-12-13 20:11 - 2015-12-13 20:08 - 22908888 ____N (Malwarebytes ) C:\Users\User\Desktop\mbam-setup-org-2.2.0.1024.exe
    2015-12-13 19:53 - 2015-12-13 19:53 - 00003148 _____ C:\Windows\System32\Tasks\{D19222F7-393E-46E5-817F-D657D32F3978}
    2015-12-13 17:49 - 2015-12-13 22:52 - 00001258 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fc32h45r31o78m97e.lnk
    2015-12-13 17:40 - 2015-12-13 19:26 - 00944642 _____ C:\Windows\ntbtlog.txt
    2015-12-13 17:28 - 2015-12-13 17:28 - 00000000 ____D C:\Users\User\.MCTranscodingSDK
    2015-12-13 17:25 - 2015-12-13 17:48 - 00004840 _____ C:\Windows\SysWOW64\Papogaj.ini
    2015-12-13 17:25 - 2015-12-13 17:48 - 00002560 _____ C:\Windows\SysWOW64\PapogajOff.ini
    2015-12-13 17:25 - 2015-12-13 17:48 - 00002560 _____ C:\Windows\system32\PapogajOff.ini
    2015-12-13 17:24 - 2015-12-13 17:25 - 00000000 ____D C:\Users\User\AppData\Local\Tempfolder
    2015-12-13 17:24 - 2015-12-13 17:24 - 00000000 ____D C:\Windows\system32\mut
    2015-12-13 17:24 - 2015-12-13 17:24 - 00000000 ____D C:\Users\User\AppData\Roaming\WiiccuAtifi
    2015-12-13 17:23 - 2015-12-13 17:23 - 00003336 _____ C:\Windows\System32\Tasks\Dedketde
    2015-12-13 17:23 - 2015-12-13 17:23 - 00000000 ____D C:\uninst
    2015-12-13 17:21 - 2015-12-13 17:21 - 00003132 _____ C:\Windows\System32\Tasks\Web Balance
    2015-12-13 17:21 - 2015-12-13 17:21 - 00003118 _____ C:\Windows\System32\Tasks\Web Balance2
    2015-12-13 17:17 - 2015-12-13 17:17 - 00003832 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1449987422
    2015-12-13 17:14 - 2015-12-13 17:57 - 00000000 ____D C:\Program Files (x86)\Opera
    2015-12-13 17:13 - 2015-12-13 17:19 - 00000000 ____D C:\Users\User\AppData\Roaming\DivX
    2015-12-13 17:10 - 2015-12-13 17:10 - 00000973 _____ C:\Windows\system32\Drivers\etc\hp.bak
    2015-12-13 17:06 - 2015-12-13 22:22 - 00000000 ____D C:\Program Files (x86)\DivX
    2015-12-13 17:06 - 2015-12-13 17:06 - 00000000 ____D C:\ProgramData\Tmp0x0x
    2015-12-11 13:24 - 2015-12-11 13:25 - 00173281 _____ C:\Users\User\Downloads\Resume_THIS ONE.pdf
    2015-12-11 13:23 - 2015-12-11 13:23 - 00061024 _____ C:\Users\User\Downloads\passport certified.pdf
    2015-12-11 13:20 - 2015-12-11 13:21 - 00626898 _____ C:\Users\User\Downloads\counselling certified.pdf
    2015-12-11 13:16 - 2015-12-11 13:17 - 00223781 _____ C:\Users\User\Downloads\VCE certfied.pdf
    2015-12-11 13:09 - 2015-12-11 13:09 - 00457835 _____ C:\Users\User\Downloads\mentoring certified.pdf
    2015-12-09 16:50 - 2015-12-09 16:51 - 00385537 _____ C:\Users\User\Downloads\mental_status_exam (1).ppt
    2015-12-09 16:34 - 2015-12-09 16:35 - 00385537 _____ C:\Users\User\Downloads\mental_status_exam.ppt
    2015-12-09 13:06 - 2015-12-09 13:06 - 00402030 _____ C:\Users\User\Downloads\106207-148082-1-PB (1).pdf
    2015-12-08 15:53 - 2015-12-08 15:54 - 00402030 _____ C:\Users\User\Downloads\106207-148082-1-PB.pdf
    2015-12-06 16:17 - 2015-12-06 16:19 - 03127032 _____ C:\Users\User\Downloads\The_relationship_between_accul.PDF
    2015-12-02 16:10 - 2015-12-02 16:10 - 00848896 _____ C:\Users\User\Downloads\PRESENTATION WITHOUT NOTES.ppt

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-12-28 10:50 - 2009-07-14 14:20 - 00000000 ____D C:\Windows\system32\NDF
    2015-12-28 10:48 - 2013-03-02 15:20 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
    2015-12-28 10:48 - 2013-02-20 21:41 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2015-12-28 10:47 - 2009-07-14 15:45 - 00024800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-12-28 10:47 - 2009-07-14 15:45 - 00024800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-12-27 18:47 - 2009-07-14 16:13 - 00782510 _____ C:\Windows\system32\PerfStringBackup.INI
    2015-12-27 18:47 - 2009-07-14 14:20 - 00000000 ____D C:\Windows\inf
    2015-12-27 17:14 - 2009-07-14 14:20 - 00000000 ____D C:\Windows
    2015-12-27 16:40 - 2013-02-20 21:41 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-12-27 14:19 - 2009-07-14 16:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2015-12-27 12:58 - 2009-07-14 16:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
    2015-12-14 11:03 - 2009-07-14 16:32 - 00000000 ____D C:\Windows\Offline Web Pages
    2015-12-13 20:58 - 2014-11-01 12:13 - 00000000 ____D C:\Users\User\AppData\Local\ElevatedDiagnostics
    2015-12-13 20:50 - 2014-11-26 16:36 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieBrowserModeList
    2015-12-13 17:56 - 2013-02-16 12:54 - 00001413 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2015-12-13 17:33 - 2013-02-20 21:41 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
    2015-12-13 17:31 - 2013-02-16 12:54 - 00000000 ____D C:\Users\User\AppData\Local\VirtualStore
    2015-12-13 17:06 - 2015-10-06 13:52 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
    2015-12-13 17:06 - 2013-02-20 22:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
    2015-12-02 16:35 - 2013-02-20 21:41 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
    2015-12-02 16:35 - 2013-02-20 21:41 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

    ==================== Files in the root of some directories =======

    2015-10-24 17:26 - 2015-10-24 17:26 - 0003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-11-11 14:12 - 2015-11-11 14:12 - 0002157 _____ () C:\Users\User\AppData\Local\recently-used.xbel
    2014-11-01 12:00 - 2015-02-27 12:40 - 0007602 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
    2013-02-21 11:33 - 2013-02-21 11:33 - 0000057 _____ () C:\ProgramData\Ament.ini

    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-12-20 13:36

    ==================== End of FRST.txt ============================
     
  7. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Additional scan result of Farbar Recovery Scan Tool (x64) Version:27-12-2015
    Ran by User (2015-12-28 11:19:13)
    Running from C:\Users\User\AppData\Local\Temp\WPDNSE\{00000352-0001-0001-0000-000000000000}
    Windows 7 Home Premium Service Pack 1 (X64) (2013-02-16 01:53:59)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-332799431-1520625345-1691349392-500 - Administrator - Disabled)
    Guest (S-1-5-21-332799431-1520625345-1691349392-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-332799431-1520625345-1691349392-1002 - Limited - Enabled)
    User (S-1-5-21-332799431-1520625345-1691349392-1000 - Administrator - Enabled) => C:\Users\User

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Enabled - Out of date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
    AS: Microsoft Security Essentials (Enabled - Out of date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
    AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKLM-x32\...\uTorrent) (Version: 3.3.0.29126 - BitTorrent Inc.)
    µTorrent (HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\uTorrent) (Version: 3.4.3.40298 - BitTorrent Inc.)
    7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
    Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
    Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.224 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
    Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
    AVG 2013 (Version: 13.0.2641 - AVG Technologies) Hidden
    Blackboard Collaborate Launcher (HKLM-x32\...\{7D82D616-8BD8-4BE3-B19C-C4BC772E8426}) (Version: 1.2.0.0 - Blackboard)
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
    Gail Howard's Smart Luck Wheel Gold™ version Smart Luck Wheel G (HKLM-x32\...\{47D357C6-2AC9-4AC6-A46C-9C8F14ABC734}_is1) (Version: Smart Luck Wheel Gold™ Version 4.0.0.30 - Gail Howard's)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
    HandBrake 0.9.5 (HKLM-x32\...\HandBrake) (Version: 0.9.5 - )
    Hot Virtual Keyboard 8.0.1.0 (HKLM\...\{0F896F26-E9C0-4331-BB90-28CDDA490C93}_is1) (Version: 8.0 - Comfort Software Group)
    HP Deskjet 1050 J410 series Basic Device Software (HKLM\...\{F294770E-F869-400F-81C3-614B5F13CA54}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
    HP Product Detection (HKLM-x32\...\{42D10994-A566-495D-A5E7-D0C6B5C6B35C}) (Version: 11.14.0006 - HP)
    Inquisit 4 Web Plugin (HKLM-x32\...\{5C106AB3-C513-45B1-8D5A-C6DDFCE706AF}) (Version: 4.0.5.0 - Millisecond Software)
    Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed (HKLM\...\{2C0E6BD4-65B1-4E82-B2AC-43EFFC8F100C}) (Version: 15.0.0.0059 - Intel Corporation)
    Intel® PROSet/Wireless WiFi Software (HKLM\...\{DF7756DD-656A-45C3-BA71-74673E8259A9}) (Version: 15.00.0000.0642 - Intel Corporation)
    iTunes (HKLM\...\{BFEAB774-C7DC-4032-B05A-DA5F7CB7B365}) (Version: 12.2.2.25 - Apple Inc.)
    Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
    Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
    Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
    MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
    MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
    MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
    MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
    MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
    MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
    OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
    Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
    pocketwifi (HKLM-x32\...\pocketwifi) (Version: TOOL-ConnLaucher_WIN1.01.01.737 - Huawei Technologies Co.,Ltd)
    PSPP (HKLM-x32\...\PSPP) (Version: 0.8.4 - Free Software Foundation, Inc.)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.40.126.2011 - Realtek)
    SpaceSoundPro Service (HKLM-x32\...\zz.10811.ssp) (Version: 1.0.0 - CSDI) <==== ATTENTION
    SurfEasy VPN 3.1.401 (HKLM-x32\...\SurfEasy VPN) (Version: 3.1.401 - SurfEasy Inc)
    Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
    VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
    Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {0DF82C09-8B69-4D3F-8939-515027E351FB} - System32\Tasks\Dedketde => C:\PROGRA~1\SHOPPE~1\Shsiwb.bat
    Task: {1CFB57D8-BE7B-4DCB-8549-C089C812B219} - System32\Tasks\Web Balance => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll",#1 <==== ATTENTION
    Task: {3901593F-D5CC-4E8B-B5A3-A159B4C026E3} - System32\Tasks\Web Balance2 => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll",#1 <==== ATTENTION
    Task: {39F0989C-B2D7-442F-BF10-EF50D42F1028} - System32\Tasks\Opera scheduled Autoupdate 1449987422 => C:\Program Files (x86)\Opera\launcher.exe
    Task: {49C31E8F-D1CE-46E4-9561-B3CC41C91962} - System32\Tasks\{78232B2D-515F-48A0-A5C7-4A9232ED95F9} => pcalua.exe -a G:\HTCDrivers\HTCDriverInstaller.exe -d G:\HTCDrivers
    Task: {4DF498D3-9E0E-475C-B7DA-21883670BBEF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
    Task: {6C85B8EF-E941-4DBE-9518-4908C0B87B00} - \AdobeFlashPlayerUpdate -> No File <==== ATTENTION
    Task: {70784624-1E14-48DB-AB73-C07B6873506E} - System32\Tasks\VPNReactor => C:\Program Files (x86)\VPNReactor\VPNReactor.exe
    Task: {8767DBA3-A68C-4638-8D02-5F6FA8E9F894} - System32\Tasks\{D8E31926-A991-4586-AE95-F40EAE9A01A0} => pcalua.exe -a C:\Users\User\Downloads\Nokia_PC_Suite_ALL.exe -d C:\Users\User\Downloads
    Task: {8BECCAE8-8A7E-4FC9-88E0-ABA5951458F9} - System32\Tasks\{991093C2-89E5-47B0-A722-58DB69489B36} => pcalua.exe -a F:\HTCDrivers\HTCDriverInstaller.exe -d F:\HTCDrivers
    Task: {AA0A879F-6D58-49B7-954B-C5DF9C1B2ADD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
    Task: {B7092169-DE29-438D-AD92-75BE97E65CFD} - System32\Tasks\{D19222F7-393E-46E5-817F-D657D32F3978} => pcalua.exe -a C:\Users\User\AppData\Roaming\yoursearching\UninstallManager.exe -c -ptid=face
    Task: {E926BD8A-57D4-4475-9927-D8416BC58781} - System32\Tasks\{CF48E146-1385-4CC2-B076-6B9B36AF1F6E} => pcalua.exe -a C:\Users\User\Downloads\ADE_2.0_Installer.exe -d C:\Users\User\Downloads
    Task: {FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C} - \AdobeFlashPlayerUpdate 2 -> No File <==== ATTENTION

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2015-05-15 17:26 - 2015-05-15 17:26 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-05-15 17:26 - 2015-05-15 17:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2015-03-05 19:17 - 2015-03-05 19:17 - 03272048 _____ () C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe
    2012-01-10 21:12 - 2012-01-10 21:12 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
    2015-12-03 03:58 - 2015-11-17 05:32 - 00919040 _____ () C:\Windows\mod_frst.exe

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Papogaj => ""="service"

    ==================== EXE Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-14 13:34 - 2015-12-13 17:10 - 00000973 ____A C:\Windows\system32\Drivers\etc\hosts

    127.0.0.1 pc-gizmos-ssl.com www.pc-gizmos-ssl.com # added by PC-Gizmos.com
    127.0.0.1 down.baidu2016.com
    127.0.0.1 123.sogou.com

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\Control Panel\Desktop\\Wallpaper ->
    DNS Servers: 192.168.42.129
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    MSCONFIG\Services: AdobeARMservice => 2
    MSCONFIG\Services: AeLookupSvc => 3
    MSCONFIG\Services: ALG => 3
    MSCONFIG\Services: AMPPALR3 => 2
    MSCONFIG\Services: AppIDSvc => 3
    MSCONFIG\Services: Apple Mobile Device => 2
    MSCONFIG\Services: AxInstSV => 3
    MSCONFIG\Services: BDESVC => 3
    MSCONFIG\Services: Bonjour Service => 2
    MSCONFIG\Services: bthserv => 3
    MSCONFIG\Services: BTHSSecurityMgr => 2
    MSCONFIG\Services: CertPropSvc => 3
    MSCONFIG\Services: clr_optimization_v2.0.50727_32 => 3
    MSCONFIG\Services: clr_optimization_v2.0.50727_64 => 3
    MSCONFIG\Services: clr_optimization_v4.0.30319_32 => 2
    MSCONFIG\Services: clr_optimization_v4.0.30319_64 => 2
    MSCONFIG\Services: COMSysApp => 2
    MSCONFIG\Services: defragsvc => 3
    MSCONFIG\Services: dot3svc => 3
    MSCONFIG\Services: ehRecvr => 3
    MSCONFIG\Services: ehSched => 3
    MSCONFIG\Services: EventSystem => 2
    MSCONFIG\Services: Fax => 3
    MSCONFIG\Services: fdPHost => 3
    MSCONFIG\Services: FDResPub => 3
    MSCONFIG\Services: FontCache3.0.0.0 => 3
    MSCONFIG\Services: gupdate => 2
    MSCONFIG\Services: gupdatem => 3
    MSCONFIG\Services: gusvc => 3
    MSCONFIG\Services: hkmsvc => 3
    MSCONFIG\Services: HomeGroupListener => 3
    MSCONFIG\Services: HomeGroupProvider => 3
    MSCONFIG\Services: idsvc => 3
    MSCONFIG\Services: IEEtwCollectorService => 3
    MSCONFIG\Services: IPBusEnum => 3
    MSCONFIG\Services: iPod Service => 3
    MSCONFIG\Services: KtmRm => 3
    MSCONFIG\Services: lltdsvc => 3
    MSCONFIG\Services: MSDTC => 3
    MSCONFIG\Services: MSiSCSI => 3
    MSCONFIG\Services: MyWiFiDHCPDNS => 3
    MSCONFIG\Services: napagent => 3
    MSCONFIG\Services: Netlogon => 3
    MSCONFIG\Services: NlaSvc => 2
    MSCONFIG\Services: p2pimsvc => 3
    MSCONFIG\Services: p2psvc => 3
    MSCONFIG\Services: PerfHost => 3
    MSCONFIG\Services: pla => 3
    MSCONFIG\Services: PNRPAutoReg => 3
    MSCONFIG\Services: PNRPsvc => 3
    MSCONFIG\Services: PolicyAgent => 3
    MSCONFIG\Services: ProtectedStorage => 3
    MSCONFIG\Services: QWAVE => 3
    MSCONFIG\Services: RasAuto => 3
    MSCONFIG\Services: RegSrvc => 2
    MSCONFIG\Services: RemoteRegistry => 3
    MSCONFIG\Services: RpcLocator => 3
    MSCONFIG\Services: SamSs => 2
    MSCONFIG\Services: SCardSvr => 3
    MSCONFIG\Services: SCPolicySvc => 3
    MSCONFIG\Services: seclogon => 3
    MSCONFIG\Services: SensrSvc => 3
    MSCONFIG\Services: SessionEnv => 3
    MSCONFIG\Services: SharedAccess => 3
    MSCONFIG\Services: SNMPTRAP => 3
    MSCONFIG\Services: sppuinotify => 3
    MSCONFIG\Services: swprv => 3
    MSCONFIG\Services: TabletInputService => 3
    MSCONFIG\Services: TapiSrv => 3
    MSCONFIG\Services: TBS => 3
    MSCONFIG\Services: TermService => 3
    MSCONFIG\Services: THREADORDER => 3
    MSCONFIG\Services: UI0Detect => 3
    MSCONFIG\Services: VaultSvc => 3
    MSCONFIG\Services: vds => 3
    MSCONFIG\Services: VSS => 3
    MSCONFIG\Services: W32Time => 2
    MSCONFIG\Services: WatAdminSvc => 3
    MSCONFIG\Services: wbengine => 3
    MSCONFIG\Services: WbioSrvc => 3
    MSCONFIG\Services: wcncsvc => 3
    MSCONFIG\Services: WcsPlugInService => 3
    MSCONFIG\Services: WebClient => 3
    MSCONFIG\Services: Wecsvc => 3
    MSCONFIG\Services: wercplsupport => 3
    MSCONFIG\Services: WinDefend => 3
    MSCONFIG\Services: WinRM => 3
    MSCONFIG\Services: WPCSvc => 3
    MSCONFIG\Services: WPDBusEnum => 3
    MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{B214BBE2-9A6A-4139-BF8D-30C0D8DF41BD}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
    FirewallRules: [{ABBBAAA7-3934-4ED8-AF27-82414DFB8DA6}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
    FirewallRules: [{9D1D6ACF-3941-4B7D-8DD2-DE547DEC2FB6}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
    FirewallRules: [{A737ACB4-181F-4F30-9C9A-C548BBC45560}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
    FirewallRules: [{1A1FF6A0-9246-40CB-82AE-FEF4FED65C07}] => (Allow) C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe
    FirewallRules: [TCP Query User{1DF84422-4C2A-47DE-85DD-A6894227A7E8}C:\users\user\downloads\utorrent.exe] => (Allow) C:\users\user\downloads\utorrent.exe
    FirewallRules: [UDP Query User{FFE2D9CA-D743-4329-93D6-95452F0A2683}C:\users\user\downloads\utorrent.exe] => (Allow) C:\users\user\downloads\utorrent.exe
    FirewallRules: [TCP Query User{F40874A2-CFF0-430E-AD41-C260EBA1B581}C:\users\user\downloads\utorrent.exe] => (Block) C:\users\user\downloads\utorrent.exe
    FirewallRules: [UDP Query User{F6424346-DB7F-4A4A-B394-A72E136D1EF8}C:\users\user\downloads\utorrent.exe] => (Block) C:\users\user\downloads\utorrent.exe
    FirewallRules: [{443CE3C7-FCDB-4525-90F7-5C88B3059C5E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{4253A253-5FEB-462E-B174-448126245743}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{77A9C9C3-74DB-4A6D-92E9-43B5C16ABEAC}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{016A807A-972B-4BEF-A976-D53EBD82CA35}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [TCP Query User{05D4EF0C-AC7A-42C3-A071-C1641ED7CDBC}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
    FirewallRules: [UDP Query User{EDFCB7F1-7958-43AE-865D-9AA66487F779}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
    FirewallRules: [TCP Query User{F7771644-515C-4535-994A-D4F758887465}C:\users\user\documents\utorrent.exe] => (Allow) C:\users\user\documents\utorrent.exe
    FirewallRules: [UDP Query User{CDFD7497-16CC-432D-B074-C4238E93D68A}C:\users\user\documents\utorrent.exe] => (Allow) C:\users\user\documents\utorrent.exe
    FirewallRules: [TCP Query User{64D9CC18-6A03-414B-8460-4344F0C15621}C:\users\user\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe] => (Allow) C:\users\user\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe
    FirewallRules: [UDP Query User{32D5A571-E2D5-4994-9BA2-F67D1D801C24}C:\users\user\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe] => (Allow) C:\users\user\appdata\local\blackboard\blackboard collaborate launcher\embedded\java\jre1.7.0_40\bin\javaw.exe
    FirewallRules: [TCP Query User{8F1ECCB0-DB30-4F71-8FE6-C67997CFE03F}C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe
    FirewallRules: [UDP Query User{04A4F4D8-F814-4EC6-8CEA-A9444DF78E01}C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe
    FirewallRules: [{A37DBF00-3D6C-40EE-AB20-FE6A273B3F7C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{C5A94A4A-600E-4DD8-BCEF-FE73D5C47052}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
    FirewallRules: [{F8236DF2-A81D-499A-B915-5AC6D3A86E48}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Restore Points =========================


    ==================== Faulty Device Manager Devices =============

    Name: PS/2 Compatible Mouse
    Description: PS/2 Compatible Mouse
    Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: i8042prt
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    .


    Operation:
    Subscribing Writer

    Context:
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {eeaa4bb0-2ef0-4029-a9bc-a36caf61844e}

    Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 13) (User: )
    Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    ]


    Operation:
    Subscribing Writer

    Context:
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {eeaa4bb0-2ef0-4029-a9bc-a36caf61844e}

    Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    .


    Operation:
    Subscribing Writer

    Context:
    Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
    Writer Name: ASR Writer
    Writer Instance ID: {73ff2a89-01b5-4e87-9dd7-9a6193b92555}

    Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 13) (User: )
    Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    ]


    Operation:
    Subscribing Writer

    Context:
    Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
    Writer Name: ASR Writer
    Writer Instance ID: {73ff2a89-01b5-4e87-9dd7-9a6193b92555}

    Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 12346) (User: )
    Description: Volume Shadow Copy Error: An error 0x80042302, A Volume Shadow Copy Service component encountered an unexpected error.
    Check the Application event log for more information.
    was encountered while trying to initialize the Registry Writer. This may cause
    future shadow-copy creations to fail.

    Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    .


    Operation:
    Subscribing Writer

    Context:
    Writer Class Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
    Writer Name: COM+ REGDB Writer
    Writer Instance ID: {9119991c-73a0-43fe-9c1e-f79f04b370ea}

    Error: (12/28/2015 11:20:38 AM) (Source: VSS) (EventID: 13) (User: )
    Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    ]


    Operation:
    Subscribing Writer

    Context:
    Writer Class Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
    Writer Name: COM+ REGDB Writer
    Writer Instance ID: {9119991c-73a0-43fe-9c1e-f79f04b370ea}

    Error: (12/28/2015 11:20:37 AM) (Source: VSS) (EventID: 12342) (User: )
    Description: Volume Shadow Copy Error: An error 0x80042302, A Volume Shadow Copy Service component encountered an unexpected error.
    Check the Application event log for more information.
    was encountered while trying to initialize the Registry Writer. This may cause
    future shadow-copy creations to fail.

    Error: (12/28/2015 11:20:37 AM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine Subscribing the Registry server writer failed. hr = 8004230208lx. hr = 0x80042302, A Volume Shadow Copy Service component encountered an unexpected error.
    Check the Application event log for more information.
    .

    Error: (12/28/2015 11:20:36 AM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    .


    Operation:
    Subscribing Writer

    Context:
    Writer Class Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
    Writer Name: Registry Writer
    Writer Instance ID: {88615323-c5fb-4828-83f5-3e2013a558ec}


    System errors:
    =============
    Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
    %%1068

    Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Server service depends on the Security Accounts Manager service which failed to start because of the following error:
    %%1058

    Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
    %%1068

    Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Server service depends on the Security Accounts Manager service which failed to start because of the following error:
    %%1058

    Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
    %%1068

    Error: (12/28/2015 11:19:52 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Server service depends on the Security Accounts Manager service which failed to start because of the following error:
    %%1058

    Error: (12/28/2015 11:18:22 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1058

    Error: (12/28/2015 11:18:19 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1058

    Error: (12/28/2015 11:18:16 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1058

    Error: (12/28/2015 11:18:13 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1058


    CodeIntegrity:
    ===================================
    Date: 2015-12-13 17:32:54.717
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:32:54.545
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:32:22.191
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:32:21.925
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:32:11.856
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:32:11.498
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:28:27.988
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:28:27.800
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:25:46.702
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-12-13 17:25:46.400
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
    Percentage of memory in use: 93%
    Total physical RAM: 1908.56 MB
    Available physical RAM: 120.39 MB
    Total Virtual: 4117.13 MB
    Available Virtual: 1834.86 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:250 GB) (Free:89.3 GB) NTFS
    Drive d: () (Fixed) (Total:215.66 GB) (Free:192.52 GB) NTFS
    Drive g: (HTC Sync Manager) (CDROM) (Total:0.02 GB) (Free:0 GB) CDFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 45D61283)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=250 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=215.7 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
  8. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Don't know if this helps, but since the infection I get pop ups all the time saying my copy of Windows is not genuine.. I can't find the download disk to confirm it is and remove those annoying pop ups though.
     
  9. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  10. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Fix result of Farbar Recovery Scan Tool (x64) Version:27-12-2015
    Ran by User (2015-12-28 12:03:35) Run:1
    Running from C:\Users\User\Desktop
    Loaded Profiles: User (Available Profiles: User)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: F - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: G - G:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {02846309-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0284630e-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0a20fc32-0982-11e5-815c-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} - G:\NokiaPCIA_Autorun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {1e498469-cf5d-11e4-9a27-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cec-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} - G:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c71af18e-44b1-11e5-b7b1-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {ecf4d450-454b-11e5-9e34-806e6f6e6963} - G:\HTC_Sync_Manager_PC.exe
    SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
    CHR HomePage: Profile 1 -> hxxp://www.omniboxes.com/?type=hp&ts=1449986746&z=9d9fee673323d90c09f13eeg2z3z1t9tbb8q9q6c9z&from=amt&uid=WDCXWD5000BPVT-60HXZT3_WD-WXG1E82MSZ15MSZ15
    S1 efbamqjh; \??\C:\Windows\system32\drivers\efbamqjh.sys [X]
    S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
    S3 HtcVCom32; system32\DRIVERS\HtcVComV64.sys [X]
    S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
    S1 yqzvqapb; \??\C:\Windows\system32\drivers\yqzvqapb.sys [X]
    2015-10-24 17:26 - 2015-10-24 17:26 - 0003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-11-11 14:12 - 2015-11-11 14:12 - 0002157 _____ () C:\Users\User\AppData\Local\recently-used.xbel
    2014-11-01 12:00 - 2015-02-27 12:40 - 0007602 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
    2013-02-21 11:33 - 2013-02-21 11:33 - 0000057 _____ () C:\ProgramData\Ament.ini
    Task: {1CFB57D8-BE7B-4DCB-8549-C089C812B219} - System32\Tasks\Web Balance => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll",#1 <==== ATTENTION
    Task: {3901593F-D5CC-4E8B-B5A3-A159B4C026E3} - System32\Tasks\Web Balance2 => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll",#1 <==== ATTENTION
    C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll
    C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll
    Task: {6C85B8EF-E941-4DBE-9518-4908C0B87B00} - \AdobeFlashPlayerUpdate -> No File <==== ATTENTION
    Task: {FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C} - \AdobeFlashPlayerUpdate 2 -> No File <==== ATTENTION

    *****************

    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F" => key removed successfully
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G" => key removed successfully
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{02846309-d66c-11e4-8795-022824040567}" => key removed successfully
    HKCR\CLSID\{02846309-d66c-11e4-8795-022824040567} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0284630e-d66c-11e4-8795-022824040567}" => key removed successfully
    HKCR\CLSID\{0284630e-d66c-11e4-8795-022824040567} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a20fc32-0982-11e5-815c-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{0a20fc32-0982-11e5-815c-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0ea7f60d-7b01-11e2-8a0f-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e498469-cf5d-11e4-9a27-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{1e498469-cf5d-11e4-9a27-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cec-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
    HKCR\CLSID\{b2fc5cec-cbc0-11e4-ad93-02110f6f0071} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cf3-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
    HKCR\CLSID\{b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cf6-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
    HKCR\CLSID\{b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5d0d-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
    HKCR\CLSID\{b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c25fa7c7-dc71-11e2-8dc2-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c25fa7d1-dc71-11e2-8dc2-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c71af18e-44b1-11e5-b7b1-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{c71af18e-44b1-11e5-b7b1-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ecf4d450-454b-11e5-9e34-806e6f6e6963}" => key removed successfully
    HKCR\CLSID\{ecf4d450-454b-11e5-9e34-806e6f6e6963} => key not found.
    "HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}" => key removed successfully
    HKCR\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key not found.
    Chrome HomePage => removed successfully
    efbamqjh => service removed successfully
    HTCAND64 => service removed successfully
    HtcVCom32 => service removed successfully
    pccsmcfd => service removed successfully
    yqzvqapb => service removed successfully
    C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
    C:\Users\User\AppData\Local\recently-used.xbel => moved successfully
    C:\Users\User\AppData\Local\Resmon.ResmonCfg => moved successfully
    C:\ProgramData\Ament.ini => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1CFB57D8-BE7B-4DCB-8549-C089C812B219}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1CFB57D8-BE7B-4DCB-8549-C089C812B219}" => key removed successfully
    C:\Windows\System32\Tasks\Web Balance => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Balance" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3901593F-D5CC-4E8B-B5A3-A159B4C026E3}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3901593F-D5CC-4E8B-B5A3-A159B4C026E3}" => key removed successfully
    C:\Windows\System32\Tasks\Web Balance2 => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Balance2" => key removed successfully
    "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll" => not found.
    "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll" => not found.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6C85B8EF-E941-4DBE-9518-4908C0B87B00}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C85B8EF-E941-4DBE-9518-4908C0B87B00}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate 2" => key removed successfully

    ==== End of Fixlog 12:03:38 ====
     
  11. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Try to follow whatever that popup says.

    Still no connection?
     
  12. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Yup, I just click on "ask me later". Still no connection. Chrome comes up with DNS_PROBE_FINISHED_BAD_CONFIG now when I try to connect...
     
  13. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center/Action Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.
     
  14. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Fix result of Farbar Recovery Scan Tool (x64) Version:27-12-2015
    Ran by User (2015-12-28 12:03:35) Run:1
    Running from C:\Users\User\Desktop
    Loaded Profiles: User (Available Profiles: User)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: F - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: G - G:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {02846309-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0284630e-d66c-11e4-8795-022824040567} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0a20fc32-0982-11e5-815c-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} - G:\NokiaPCIA_Autorun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {1e498469-cf5d-11e4-9a27-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cec-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} - G:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} - F:\AutoRun.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {c71af18e-44b1-11e5-b7b1-90a4de1d982e} - F:\HTC_Sync_Manager_PC.exe
    HKU\S-1-5-21-332799431-1520625345-1691349392-1000\...\MountPoints2: {ecf4d450-454b-11e5-9e34-806e6f6e6963} - G:\HTC_Sync_Manager_PC.exe
    SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
    CHR HomePage: Profile 1 -> hxxp://www.omniboxes.com/?type=hp&ts=1449986746&z=9d9fee673323d90c09f13eeg2z3z1t9tbb8q9q6c9z&from=amt&uid=WDCXWD5000BPVT-60HXZT3_WD-WXG1E82MSZ15MSZ15
    S1 efbamqjh; \??\C:\Windows\system32\drivers\efbamqjh.sys [X]
    S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
    S3 HtcVCom32; system32\DRIVERS\HtcVComV64.sys [X]
    S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
    S1 yqzvqapb; \??\C:\Windows\system32\drivers\yqzvqapb.sys [X]
    2015-10-24 17:26 - 2015-10-24 17:26 - 0003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-11-11 14:12 - 2015-11-11 14:12 - 0002157 _____ () C:\Users\User\AppData\Local\recently-used.xbel
    2014-11-01 12:00 - 2015-02-27 12:40 - 0007602 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
    2013-02-21 11:33 - 2013-02-21 11:33 - 0000057 _____ () C:\ProgramData\Ament.ini
    Task: {1CFB57D8-BE7B-4DCB-8549-C089C812B219} - System32\Tasks\Web Balance => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll",#1 <==== ATTENTION
    Task: {3901593F-D5CC-4E8B-B5A3-A159B4C026E3} - System32\Tasks\Web Balance2 => Rundll32.exe "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll",#1 <==== ATTENTION
    C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll
    C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll
    Task: {6C85B8EF-E941-4DBE-9518-4908C0B87B00} - \AdobeFlashPlayerUpdate -> No File <==== ATTENTION
    Task: {FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C} - \AdobeFlashPlayerUpdate 2 -> No File <==== ATTENTION

    *****************

    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F" => key removed successfully
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G" => key removed successfully
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{02846309-d66c-11e4-8795-022824040567}" => key removed successfully
    HKCR\CLSID\{02846309-d66c-11e4-8795-022824040567} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0284630e-d66c-11e4-8795-022824040567}" => key removed successfully
    HKCR\CLSID\{0284630e-d66c-11e4-8795-022824040567} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a20fc32-0982-11e5-815c-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{0a20fc32-0982-11e5-815c-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0ea7f60d-7b01-11e2-8a0f-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{0ea7f60d-7b01-11e2-8a0f-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e498469-cf5d-11e4-9a27-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{1e498469-cf5d-11e4-9a27-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cec-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
    HKCR\CLSID\{b2fc5cec-cbc0-11e4-ad93-02110f6f0071} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cf3-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
    HKCR\CLSID\{b2fc5cf3-cbc0-11e4-ad93-02110f6f0071} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5cf6-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
    HKCR\CLSID\{b2fc5cf6-cbc0-11e4-ad93-02110f6f0071} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b2fc5d0d-cbc0-11e4-ad93-02110f6f0071}" => key removed successfully
    HKCR\CLSID\{b2fc5d0d-cbc0-11e4-ad93-02110f6f0071} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c25fa7c7-dc71-11e2-8dc2-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{c25fa7c7-dc71-11e2-8dc2-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c25fa7d1-dc71-11e2-8dc2-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{c25fa7d1-dc71-11e2-8dc2-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c71af18e-44b1-11e5-b7b1-90a4de1d982e}" => key removed successfully
    HKCR\CLSID\{c71af18e-44b1-11e5-b7b1-90a4de1d982e} => key not found.
    "HKU\S-1-5-21-332799431-1520625345-1691349392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ecf4d450-454b-11e5-9e34-806e6f6e6963}" => key removed successfully
    HKCR\CLSID\{ecf4d450-454b-11e5-9e34-806e6f6e6963} => key not found.
    "HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}" => key removed successfully
    HKCR\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key not found.
    Chrome HomePage => removed successfully
    efbamqjh => service removed successfully
    HTCAND64 => service removed successfully
    HtcVCom32 => service removed successfully
    pccsmcfd => service removed successfully
    yqzvqapb => service removed successfully
    C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
    C:\Users\User\AppData\Local\recently-used.xbel => moved successfully
    C:\Users\User\AppData\Local\Resmon.ResmonCfg => moved successfully
    C:\ProgramData\Ament.ini => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1CFB57D8-BE7B-4DCB-8549-C089C812B219}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1CFB57D8-BE7B-4DCB-8549-C089C812B219}" => key removed successfully
    C:\Windows\System32\Tasks\Web Balance => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Balance" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3901593F-D5CC-4E8B-B5A3-A159B4C026E3}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3901593F-D5CC-4E8B-B5A3-A159B4C026E3}" => key removed successfully
    C:\Windows\System32\Tasks\Web Balance2 => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Balance2" => key removed successfully
    "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\WebBalance.dll" => not found.
    "C:\Users\User\AppData\Local\Web Balance\{15FAB893-179C-CC0C-6300-022A486A3002}\hge.dll" => not found.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6C85B8EF-E941-4DBE-9518-4908C0B87B00}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C85B8EF-E941-4DBE-9518-4908C0B87B00}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA5A70F7-3EF6-4F56-9AEC-5AEB9E11FD6C}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate 2" => key removed successfully

    ==== End of Fixlog 12:03:38 ====
     
  15. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Windows Network Diagnostic says the DNS server may be unavailable,however it's detected.
     
  16. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Please read my previous reply.
     
  17. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Sorry, it didn't copy over properly.

    Farbar Service Scanner Version: 10-06-2014
    Ran by User (administrator) on 28-12-2015 at 12:19:55
    Running from "C:\Users\User\AppData\Local\Temp\WPDNSE\{00000352-0001-0001-0000-000000000000}"
    Microsoft Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Attempt to access Google.com returned error: Other errors
    Attempt to access Yahoo.com returned error: Other errors


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============


    Windows Update:
    ============
    BITS Service is not running. Checking service configuration:
    The start type of BITS service is set to Demand. The default start type is Auto.
    The ImagePath of BITS service is OK.
    The ServiceDll of BITS service is OK.

    EventSystem Service is not running. Checking service configuration:
    The start type of EventSystem service is set to Disabled. The default start type is Auto.
    The ImagePath of EventSystem service is OK.
    The ServiceDll of EventSystem service is OK.


    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => File is digitally signed
    C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\System32\dhcpcore.dll => File is digitally signed
    C:\Windows\System32\drivers\afd.sys => File is digitally signed
    C:\Windows\System32\drivers\tdx.sys => File is digitally signed
    C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\System32\dnsrslvr.dll => File is digitally signed
    C:\Windows\System32\mpssvc.dll => File is digitally signed
    C:\Windows\System32\bfe.dll => File is digitally signed
    C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\System32\SDRSVC.dll => File is digitally signed
    C:\Windows\System32\vssvc.exe => File is digitally signed
    C:\Windows\System32\wscsvc.dll => File is digitally signed
    C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\System32\wuaueng.dll => File is digitally signed
    C:\Windows\System32\qmgr.dll => File is digitally signed
    C:\Windows\System32\es.dll => File is digitally signed
    C:\Windows\System32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Windows\System32\ipnathlp.dll => File is digitally signed
    C:\Windows\System32\iphlpsvc.dll => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed


    **** End of log ****
     
  18. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Go Start and in "Start search" type:
    services.msc
    Press Enter.

    Services window will open.
    Find Background Intelligent Transfer Service (BITS) and COM+ Event System services.
    In each case right click on the service, click "Properties" and under "Startup type" select "Automatic" from drop, down menu.
    Restart computer, post fresh FSS log and check internet connection.
     
  19. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    Still no internet connection.

    Farbar Service Scanner Version: 10-06-2014
    Ran by User (administrator) on 28-12-2015 at 13:47:04
    Running from "C:\Users\User\Desktop"
    Microsoft Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Attempt to access Google.com returned error: Other errors
    Attempt to access Yahoo.com returned error: Other errors


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============

    wscsvc Service is not running. Checking service configuration:
    The start type of wscsvc service is OK.
    The ImagePath of wscsvc service is OK.
    The ServiceDll of wscsvc service is OK.


    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => File is digitally signed
    C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\System32\dhcpcore.dll => File is digitally signed
    C:\Windows\System32\drivers\afd.sys => File is digitally signed
    C:\Windows\System32\drivers\tdx.sys => File is digitally signed
    C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\System32\dnsrslvr.dll => File is digitally signed
    C:\Windows\System32\mpssvc.dll => File is digitally signed
    C:\Windows\System32\bfe.dll => File is digitally signed
    C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\System32\SDRSVC.dll => File is digitally signed
    C:\Windows\System32\vssvc.exe => File is digitally signed
    C:\Windows\System32\wscsvc.dll => File is digitally signed
    C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\System32\wuaueng.dll => File is digitally signed
    C:\Windows\System32\qmgr.dll => File is digitally signed
    C:\Windows\System32\es.dll => File is digitally signed
    C:\Windows\System32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Windows\System32\ipnathlp.dll => File is digitally signed
    C:\Windows\System32\iphlpsvc.dll => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed


    **** End of log ****
     
  20. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Please download MiniToolBox, save it to your desktop and run it.

    Checkmark following boxes:
    • Flush DNS
    • Reset IE Proxy Settings
    • Reset FF Proxy Settings
    • List content of Hosts
    • List IP configuration
    • List Winsock Entries
    • List Devices (do NOT change any settings)
    Click Go and post the result.
     
  21. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    MiniToolBox by Farbar Version: 02-11-2015
    Ran by User (administrator) on 28-12-2015 at 13:57:50
    Running from "C:\Users\User\AppData\Local\Temp\WPDNSE\{00000352-0001-0001-0000-000000000000}"
    Microsoft Windows 7 Home Premium Service Pack 1 (X64)
    Model: RV411/RV511/E3511/S3511/RV711 Manufacturer: SAMSUNG ELECTRONICS CO., LTD.
    Boot Mode: Normal
    ***************************************************************************

    ========================= Flush DNS: ===================================

    Windows IP Configuration

    Successfully flushed the DNS Resolver Cache.

    "Reset IE Proxy Settings": IE Proxy Settings were reset.
    ========================= Hosts content: =================================
    127.0.0.1 pc-gizmos-ssl.com www.pc-gizmos-ssl.com # added by PC-Gizmos.com
    127.0.0.1 down.baidu2016.com
    127.0.0.1 123.sogou.com
    ========================= IP Configuration: ================================

    Broadcom 802.11n Network Adapter = Wireless Network Connection (Connected)
    HTC Remote NDIS based Device = Local Area Connection 5 (Connected)
    Bluetooth Device (Personal Area Network) = Bluetooth Network Connection (Media disconnected)
    Realtek PCIe GBE Family Controller = Local Area Connection (Media disconnected)
    Microsoft Virtual WiFi Miniport Adapter = Wireless Network Connection 2 (Media disconnected)


    # ----------------------------------
    # IPv4 Configuration
    # ----------------------------------
    pushd interface ipv4

    reset
    set global icmpredirects=enabled taskoffload=disabled


    popd
    # End of IPv4 configuration



    Windows IP Configuration

    Host Name . . . . . . . . . . . . : User-PC
    Primary Dns Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No

    Ethernet adapter Local Area Connection 5:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : HTC Remote NDIS based Device #2
    Physical Address. . . . . . . . . : 02-28-2C-04-71-7E
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    Link-local IPv6 Address . . . . . : fe80::98d4:198:b15c:1b30%21(Preferred)
    IPv4 Address. . . . . . . . . . . : 192.168.42.231(Preferred)
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Lease Obtained. . . . . . . . . . : Monday, 28 December 2015 1:56:37 PM
    Lease Expires . . . . . . . . . . : Monday, 28 December 2015 2:56:37 PM
    Default Gateway . . . . . . . . . : 192.168.42.129
    DHCP Server . . . . . . . . . . . : 192.168.42.129
    DHCPv6 IAID . . . . . . . . . . . : 402794540
    DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-B0-E0-4E-E8-11-32-5A-21-2F
    DNS Servers . . . . . . . . . . . : 192.168.42.129
    NetBIOS over Tcpip. . . . . . . . : Enabled

    Ethernet adapter Local Area Connection* 11:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : SurfEasy TAP-Windows Adapter V9
    Physical Address. . . . . . . . . : 00-FF-A6-5E-4E-33
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes

    Wireless LAN adapter Wireless Network Connection 2:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
    Physical Address. . . . . . . . . : 90-A4-DE-58-DB-67
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes

    Wireless LAN adapter Wireless Network Connection:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Broadcom 802.11n Network Adapter
    Physical Address. . . . . . . . . : 90-A4-DE-58-DB-67
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    Link-local IPv6 Address . . . . . : fe80::b41c:9b76:accf:63a1%14(Preferred)
    Autoconfiguration IPv4 Address. . : 169.254.99.161(Preferred)
    Subnet Mask . . . . . . . . . . . : 255.255.0.0
    Default Gateway . . . . . . . . . :
    DHCPv6 IAID . . . . . . . . . . . : 361800926
    DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-B0-E0-4E-E8-11-32-5A-21-2F
    DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
    fec0:0:0:ffff::2%1
    fec0:0:0:ffff::3%1
    NetBIOS over Tcpip. . . . . . . . : Enabled

    Ethernet adapter Local Area Connection:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
    Physical Address. . . . . . . . . : E8-11-32-5A-21-2F
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes

    Ethernet adapter Bluetooth Network Connection:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
    Physical Address. . . . . . . . . : 90-A4-DE-1D-98-2E
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    Server: UnKnown
    Address: 192.168.42.129

    Ping request could not find host google.com. Please check the name and try again.
    Server: UnKnown
    Address: 192.168.42.129

    Ping request could not find host yahoo.com. Please check the name and try again.

    Pinging 127.0.0.1 with 32 bytes of data:
    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

    Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
    ===========================================================================
    Interface List
    21...02 28 2c 04 71 7e ......HTC Remote NDIS based Device #2
    19...00 ff a6 5e 4e 33 ......SurfEasy TAP-Windows Adapter V9
    15...90 a4 de 58 db 67 ......Microsoft Virtual WiFi Miniport Adapter
    14...90 a4 de 58 db 67 ......Broadcom 802.11n Network Adapter
    13...e8 11 32 5a 21 2f ......Realtek PCIe GBE Family Controller
    12...90 a4 de 1d 98 2e ......Bluetooth Device (Personal Area Network)
    1...........................Software Loopback Interface 1
    ===========================================================================

    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination Netmask Gateway Interface Metric
    0.0.0.0 0.0.0.0 192.168.42.129 192.168.42.231 10
    127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
    127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
    127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
    169.254.0.0 255.255.0.0 On-link 169.254.99.161 281
    169.254.99.161 255.255.255.255 On-link 169.254.99.161 281
    169.254.255.255 255.255.255.255 On-link 169.254.99.161 281
    192.168.42.0 255.255.255.0 On-link 192.168.42.231 266
    192.168.42.231 255.255.255.255 On-link 192.168.42.231 266
    192.168.42.255 255.255.255.255 On-link 192.168.42.231 266
    224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
    224.0.0.0 240.0.0.0 On-link 169.254.99.161 281
    224.0.0.0 240.0.0.0 On-link 192.168.42.231 266
    255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
    255.255.255.255 255.255.255.255 On-link 169.254.99.161 281
    255.255.255.255 255.255.255.255 On-link 192.168.42.231 266
    ===========================================================================
    Persistent Routes:
    None

    IPv6 Route Table
    ===========================================================================
    Active Routes:
    If Metric Network Destination Gateway
    1 306 ::1/128 On-link
    14 281 fe80::/64 On-link
    21 266 fe80::/64 On-link
    21 266 fe80::98d4:198:b15c:1b30/128
    On-link
    14 281 fe80::b41c:9b76:accf:63a1/128
    On-link
    1 306 ff00::/8 On-link
    14 281 ff00::/8 On-link
    21 266 ff00::/8 On-link
    ===========================================================================
    Persistent Routes:
    None
    ========================= Winsock entries =====================================

    Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation)
    Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
    Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
    Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
    Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
    Catalog5 07 C:\Windows\SysWOW64\wshbth.dll [36352] (Microsoft Corporation)
    Catalog5 08 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
    Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    Catalog9 11 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
    x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation)
    x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
    x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
    x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
    x64-Catalog5 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
    x64-Catalog5 07 C:\Windows\System32\wshbth.dll [47104] (Microsoft Corporation)
    x64-Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
    x64-Catalog9 01 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 02 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 03 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 04 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 06 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 07 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 08 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 09 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 10 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
    x64-Catalog9 11 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

    ========================= Devices: ================================

    Name: PS/2 Compatible Mouse
    Description: PS/2 Compatible Mouse
    Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: i8042prt
    Device ID: ACPI\ETD0B00\4&1B3AD2B5&0
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Device ID: ROOT\WPD\0000
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Device ID: ROOT\WPD\0001
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Device ID: ROOT\WPD\0002
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Device ID: ROOT\WPD\0003
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Device ID: ROOT\WPD\0004
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


    **** End of log ****
     
  22. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    • Please download comintrep.zip and save it to your desktop
    • Unzip downloaded file. It'll create cintrepair folder. Inside that folder you'll find CIntRep.exe file
    • Double click on CIntRep.exe to run the tool
    • Place a checkmark next to the following entries:
    • Reset Internet Protocol (TCP/IP)
    • Repair Winsock (Reset Catalog)
    • Renew Internet Connections
    • Flush DNS Resolver Cache
    • Repair Internet Explorer xxxx
    • Clear Windows Update History
    • Repair Windows / Automatic Updates
    • Repair SSL / HTTPS / Cryptography
    • Reset Windows Firewall Configuration
    • Restore the default hosts file
    • Repair Workgroup Computers view
    • Click Go!
    • Ignore any error messages for now
    • Click OK to reboot your computer
    • Check your internet access
     
  23. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    No internet connection. Error message is now DNS_PROBE_FINISHED_NXDOMAIN
     
  24. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    What about IE and Firefox?
    What happens there?
     
  25. Emmawii

    Emmawii TS Rookie Topic Starter Posts: 26

    On USB internet, When I click Fix connection problems on IE Windows Network Diagnostic says it cannot diagnose the problem.

    On WiFi internet from phone, it says Wireless Network connection doesn't have a valid IP connection. I've reset the LAN on my phone to no avail.

    I don't have Firefox.
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...