Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Owen: Torpig Virus on my Computer

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Owen: Torpig Virus on my Computer

Unread postby CpOwen-1919 » December 22nd, 2017, 6:39 pm

As instructed, I downloaded and created the follow FRST and Addition txt.
Can you advise how I can eliminate the Torpig and any other virus's you see in the following information?
Thanks

FRST:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-12-2017
Ran by carri (administrator) on DESKTOP-4D0CECB (20-12-2017 07:08:32)
Running from C:\Users\carri\AppData\Local\Microsoft\Windows\INetCache\IE\1VC9U4H0
Loaded Profiles: carri (Available Profiles: carri)
Platform: Windows 10 Home Version 1703 15063.726 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_2848511bc3f67d29\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Windows\System32\AdminService.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_2848511bc3f67d29\IntelCpHDCPSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Lenovo) C:\Program Files\Lenovo\YMC\ymc.exe
() C:\ProgramData\Lenovo\PLHotkeyService\PLHotkeyService.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_2848511bc3f67d29\IntelCpHeciSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\MsMpEng.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wimserv.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_2848511bc3f67d29\igfxEM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.10.572.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8730.21155.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8730.21155.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(SweetLabs, Inc) C:\Users\carri\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.CompanionApp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16776704 2016-12-08] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1483264 2016-12-08] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1483264 2016-12-08] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1483264 2016-12-08] (Realtek Semiconductor)
HKLM\...\Run: [DAX2_APP] => C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe [849928 2016-09-19] ()
HKLM\...\Run: [LenovoUtility] => C:\ProgramData\Lenovo\ImController\Plugins\IdeaOSDPackage\x64\utility.exe [911272 2017-07-27] (Lenovo(beijing) Limited)
HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\...\MountPoints2: {01688c78-503d-11e7-83db-3c95095cec8c} - "D:\DTLplus_Launcher.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Notifier.lnk [2017-06-13]
ShortcutTarget: Update Notifier.lnk -> C:\Program Files\WinZip\WZUpdateNotifier.exe (WinZip)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2017-06-13]
ShortcutTarget: WinZip Preloader.lnk -> C:\Program Files\WinZip\WzPreloader.exe (WinZip Computing, S.L.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.203.226
Tcpip\..\Interfaces\{ee0c183d-4f58-48b7-a2f3-3c0908d4857a}: [DhcpNameServer] 192.168.0.1 205.171.203.226
Tcpip\..\Interfaces\{fc44deff-1344-4a6c-9c9d-05f9dd1d60d1}: [DhcpNameServer] 150.100.0.10

Internet Explorer:
==================
HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/
HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo17swin10.msn.com/?pc=LSJE
SearchScopes: HKU\S-1-5-21-3777521122-4028487815-3530221622-1001 -> DefaultScope {99CA344A-5609-4075-A4A3-F9821EF047E8} URL =
SearchScopes: HKU\S-1-5-21-3777521122-4028487815-3530221622-1001 -> {99CA344A-5609-4075-A4A3-F9821EF047E8} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-12-15] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-12-15] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-12-15] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-12-15] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-12-15] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: h8hrvkh6.default
FF ProfilePath: C:\Users\carri\AppData\Roaming\Mozilla\Firefox\Profiles\h8hrvkh6.default [2017-09-27]
FF Homepage: Mozilla\Firefox\Profiles\h8hrvkh6.default -> hxxps://www.google.com
FF Extension: (Adblock Plus) - C:\Users\carri\AppData\Roaming\Mozilla\Firefox\Profiles\h8hrvkh6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-08-22] [Legacy]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-12-15] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-3777521122-4028487815-3530221622-1001: tdameritrade.com/thinkorswim -> C:\Users\carri\AppData\Local\thinkorswim\npthinkorswim.dll [2017-12-18] (TD Ameritrade)
FF Plugin HKU\S-1-5-21-3777521122-4028487815-3530221622-1001: tdameritrade.com/tossc -> C:\Users\carri\AppData\Local\thinkorswim\nptossc.dll [2017-12-18] (TD Ameritrade)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7760552 2017-12-07] (Microsoft Corporation)
R2 DAX2API; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [163336 2016-09-19] ()
R2 ImControllerService; C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [68408 2017-11-12] (Lenovo Group Limited)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [267360 2017-01-23] (Synaptics Incorporated)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\NisSrv.exe [356176 2017-12-12] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\MsMpEng.exe [105792 2017-12-12] (Microsoft Corporation)
R2 ymc; C:\Program Files\Lenovo\YMC\ymc.exe [49032 2016-11-22] (Lenovo)
R2 YogaPLService; C:\ProgramData\Lenovo\PLHotkeyService\PLHotkeyService.exe [29112 2015-06-27] ()

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 MpKsl52479c6b; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{468EDAF9-2C3B-4EF8-AB89-CD7570B4FBD4}\MpKsl52479c6b.sys [58120 2017-12-19] (Microsoft Corporation)
R3 RSP2STOR; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [329184 2016-08-15] (Realtek Semiconductor Corp.)
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [3138056 2016-08-04] (Realtek Semiconductor Corp.)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [72800 2017-01-23] (Synaptics Incorporated)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46072 2017-12-12] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [288848 2017-12-12] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [129616 2017-12-12] (Microsoft Corporation)
R3 WirelessKeyboardFilter; C:\WINDOWS\System32\drivers\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-20 07:08 - 2017-12-20 07:08 - 000000000 ____D C:\FRST
2017-12-15 09:25 - 2017-12-15 09:25 - 000000000 ____D C:\WINDOWS\LastGood
2017-12-12 09:09 - 2017-12-12 10:09 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2017-12-08 08:51 - 2017-12-08 08:51 - 000003541 _____ C:\Users\carri\Desktop\anypia32.exe - Shortcut.lnk
2017-12-08 08:38 - 2017-12-08 08:38 - 000000000 ____D C:\Windows.old
2017-12-03 23:44 - 2017-12-03 23:44 - 000641696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp140.dll
2017-12-03 23:44 - 2017-12-03 23:44 - 000389296 _____ (Microsoft Corporation) C:\WINDOWS\system32\vccorlib140.dll
2017-12-03 23:44 - 2017-12-03 23:44 - 000331432 _____ (Microsoft Corporation) C:\WINDOWS\system32\concrt140.dll
2017-12-03 23:44 - 2017-12-03 23:44 - 000087728 _____ (Microsoft Corporation) C:\WINDOWS\system32\vcruntime140.dll
2017-12-03 23:38 - 2017-12-03 23:38 - 000440128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp140.dll
2017-12-03 23:38 - 2017-12-03 23:38 - 000263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vccorlib140.dll
2017-12-03 23:38 - 2017-12-03 23:38 - 000242496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\concrt140.dll
2017-12-03 23:38 - 2017-12-03 23:38 - 000083792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vcruntime140.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-20 06:54 - 2017-06-13 08:39 - 000077619 _____ C:\WINDOWS\system32\InstallUtil.InstallLog
2017-12-20 06:52 - 2017-06-13 08:40 - 000000000 ____D C:\Users\carri\AppData\Local\Host App Service
2017-12-20 06:49 - 2017-06-13 08:46 - 000000000 __SHD C:\Users\carri\IntelGraphicsProfiles
2017-12-20 04:46 - 2017-09-28 12:38 - 000004168 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2C1F92A8-5E49-494B-939A-59FC89E76DA8}
2017-12-20 04:42 - 2017-08-22 10:10 - 000000000 ____D C:\Program Files (x86)\LogMeIn Rescue Applet
2017-12-19 14:25 - 2017-06-13 20:42 - 000000000 ____D C:\Temp
2017-12-19 13:57 - 2017-03-18 16:03 - 000000000 ___HD C:\Program Files\WindowsApps
2017-12-19 13:57 - 2017-03-18 16:03 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-12-18 19:43 - 2017-08-09 12:43 - 000000000 ____D C:\Users\carri\.thinkorswim
2017-12-18 19:41 - 2017-08-09 12:43 - 000000000 ____D C:\Users\carri\AppData\Local\thinkorswim
2017-12-18 08:16 - 2017-06-13 08:48 - 000000000 ____D C:\Users\carri\AppData\Local\Comms
2017-12-17 07:28 - 2017-09-28 12:32 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-12-15 09:37 - 2017-03-18 16:03 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-12-15 09:36 - 2017-04-27 07:19 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-12-15 09:25 - 2017-03-18 16:01 - 000000000 ____D C:\WINDOWS\INF
2017-12-15 07:35 - 2017-09-28 12:34 - 000000000 ____D C:\Users\carri
2017-12-15 07:06 - 2017-03-18 15:51 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-12-15 07:05 - 2017-06-25 14:48 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-12-15 07:00 - 2017-10-11 12:43 - 133326408 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2017-12-15 07:00 - 2017-06-25 14:48 - 133326408 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-12-15 06:06 - 2017-09-28 12:39 - 000041913 _____ C:\WINDOWS\diagwrn.xml
2017-12-15 06:06 - 2017-09-28 12:39 - 000041913 _____ C:\WINDOWS\diagerr.xml
2017-12-12 13:29 - 2017-03-18 06:40 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-12-12 13:25 - 2017-09-29 10:04 - 000000000 ___HD C:\$WINDOWS.~BT
2017-12-12 13:25 - 2017-03-18 16:03 - 000000000 ____D C:\WINDOWS\Registration
2017-12-12 10:45 - 2017-09-05 07:36 - 000000000 ___DC C:\WINDOWS\Panther
2017-12-12 10:25 - 2017-06-13 08:46 - 000000000 ____D C:\Users\carri\AppData\Local\Packages
2017-12-08 12:00 - 2017-03-18 16:03 - 000000000 ____D C:\WINDOWS\rescache
2017-12-01 21:25 - 2017-03-18 16:06 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-12-01 21:25 - 2017-03-18 16:06 - 000177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-11-30 11:36 - 2017-09-28 12:42 - 000928066 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-11-30 11:30 - 2017-09-28 12:38 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-11-30 11:30 - 2017-09-28 12:32 - 000248536 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-11-30 11:30 - 2016-07-29 12:27 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-11-28 13:59 - 2017-03-18 06:40 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2017-11-28 13:58 - 2017-03-18 16:03 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-11-28 13:58 - 2017-03-18 16:03 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-11-28 13:58 - 2017-03-18 16:03 - 000000000 ____D C:\WINDOWS\Provisioning
2017-11-28 13:58 - 2017-03-18 16:03 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-11-28 13:58 - 2017-03-18 16:03 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-11-23 07:47 - 2017-06-15 10:32 - 000545440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

Some files in TEMP:
====================
2017-11-28 08:41 - 2017-12-17 06:42 - 000036864 _____ () C:\Users\carri\AppData\Local\Temp\DTLocker+ G3-D-ParaDelay.exe
2017-11-10 08:55 - 2017-11-10 08:57 - 020992472 _____ (SweetLabs,Inc.) C:\Users\carri\AppData\Local\Temp\octDC91.tmp.exe
2017-10-02 07:55 - 2017-10-02 07:56 - 006457520 _____ (Microsoft Corporation) C:\Users\carri\AppData\Local\Temp\Windows10Upgrade.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-12-08 11:56

==================== End of FRST.txt ============================
ADDITION:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-12-2017
Ran by carri (20-12-2017 07:09:08)
Running from C:\Users\carri\AppData\Local\Microsoft\Windows\INetCache\IE\1VC9U4H0
Windows 10 Home Version 1703 15063.726 (X64) (2017-09-28 17:41:10)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3777521122-4028487815-3530221622-500 - Administrator - Disabled)
carri (S-1-5-21-3777521122-4028487815-3530221622-1001 - Administrator - Enabled) => C:\Users\carri
DefaultAccount (S-1-5-21-3777521122-4028487815-3530221622-503 - Limited - Disabled)
Guest (S-1-5-21-3777521122-4028487815-3530221622-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Cisco WebEx Meetings (HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
Dolby Audio X2 Windows API SDK (HKLM\...\{AA950AA4-CD9B-4D81-B6C0-BFABB7A24261}) (Version: 0.7.5.65 - Dolby Laboratories, Inc.)
Dolby Audio X2 Windows APP (HKLM\...\{DBC4388A-9417-41DB-85CF-DF4993B84D5A}) (Version: 0.7.5.67 - Dolby Laboratories, Inc.)
Intel(R) Chipset Device Software (HKLM-x32\...\{226be6c3-8e08-4d52-bd3a-d361008448c5}) (Version: 10.1.1.37 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.6.0.1025 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 21.20.16.4550 - Intel Corporation) Hidden
KB4023057 (HKLM\...\{ED06689A-33B7-4D35-8F76-36A82CD03406}) (Version: 2.3.0.0 - Microsoft Corporation)
Lenovo App Explorer (HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\...\Host App Service) (Version: 0.273.2.419 - SweetLabs for Lenovo)
Lenovo Yoga Mode Control (HKLM\...\{3F2E25D6-49D3-45D5-A7BD-13F5D6F64171}_is1) (Version: 2.0.0.6 - Lenovo)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.8730.2127 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\...\OneDriveSetup.exe) (Version: 17.3.7076.1026 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 55.0.3 (x64 en-US) (HKLM\...\Mozilla Firefox 55.0.3 (x64 en-US)) (Version: 55.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 55.0.2 - Mozilla)
MY Pc123 (HKLM-x32\...\{FDE07CEF-90BC-BB81-47E2-333C169299C7}) (Version: 7.8.658 - LogMeIn, Inc.)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8730.2127 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8730.2127 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8730.2127 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.8730.2127 - Microsoft Corporation) Hidden
SSA Benefit Calculator (HKLM-x32\...\{340D61BB-350A-40F4-8CFD-4F860E12066E}) (Version: 1.17.0002 - Social Security Administration)
thinkorswim (HKLM\...\9968-4488-2169-7623) (Version: desktop - thinkorswim, Inc)
Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
Windows 10 Update Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22243 - Microsoft Corporation)
WinZip 21.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C2410D}) (Version: 21.0.12288 - WinZip Computing, S.L. )
YouTube (HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\...\HostAppService_322460fb8f47d8cb14cd883b17b5e0dd233a7768) (Version: v1.0.1 - YouTube)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3777521122-4028487815-3530221622-1001_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 -> C:\Program Files\WinZip\adxloader64.dll ()
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\ShellExt.dll [2017-03-18] (Microsoft Corporation)
ContextMenuHandlers1: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshls64.dll [2017-02-10] (WinZip Computing, S.L.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\ShellExt.dll [2017-03-18] (Microsoft Corporation)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\ShellExt.dll [2017-03-18] (Microsoft Corporation)
ContextMenuHandlers4: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshls64.dll [2017-02-10] (WinZip Computing, S.L.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_2848511bc3f67d29\igfxDTCM.dll [2016-12-15] (Intel Corporation)
ContextMenuHandlers6: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshls64.dll [2017-02-10] (WinZip Computing, S.L.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {188E36F5-7E22-4B63-965D-813D1F047618} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\ef14d53c-0a11-4dc1-9538-13079cd19324 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2017-11-12] (Lenovo Group Limited)
Task: {40CB3051-FF8F-4CEB-8940-B10CA7B365F7} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\MpCmdRun.exe [2017-12-12] (Microsoft Corporation)
Task: {41B467EE-753B-4BD2-83B0-840ADFFB14E3} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-12-15] (Microsoft Corporation)
Task: {4EDF1A3B-BF5F-451E-81F3-C84638A9E648} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-12-15] (Microsoft Corporation)
Task: {64276598-9A49-4F00-BD0C-278D324A98C2} - System32\Tasks\WinZip Update Notifier => C:\Program Files\WinZip\WZUpdateNotifier.exe [2017-02-10] (WinZip)
Task: {7412CA78-D4DF-4954-81A7-8CD0FFF0A63D} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-12-07] (Microsoft Corporation)
Task: {74C95CA3-E9D0-4336-90E6-657C54F8E6E9} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-12-07] (Microsoft Corporation)
Task: {75E0A681-FB23-4C6E-9451-D4D3EEB6191A} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-12-15] (Microsoft Corporation)
Task: {782C56AE-0CFE-4F68-AEEA-162DEBD9B1BA} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\aa715270-ce6b-41ba-a456-30cf51b9392e => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2017-11-12] (Lenovo Group Limited)
Task: {93EF60F4-40F4-4C4F-925D-4CBBA2D0F263} - System32\Tasks\App Explorer => C:\Users\carri\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [2017-10-17] (SweetLabs, Inc) <==== ATTENTION
Task: {968F0BD0-0CA0-4BC8-A382-938CF384F3B2} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance => %windir%\system32\sc.exe START ImControllerService
Task: {9CEC8184-9DC8-4C82-9DCC-52DDF900AD1E} - System32\Tasks\Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask => %windir%\System32\reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler /v start /t reg_dword /d 1 /f /reg:32
Task: {C1CD3A62-74F4-4F52-9BA1-3CB1D77BE1E3} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\MpCmdRun.exe [2017-12-12] (Microsoft Corporation)
Task: {C24C1232-1312-4AA4-B4F9-0BB47EE6EAF4} - System32\Tasks\S-1-5-21-3777521122-4028487815-3530221622-1001\DataSenseLiveTileTask => C:\WINDOWS\System32\DataUsageLiveTileTask.exe [2017-11-01] (Microsoft Corporation)
Task: {D391489B-A305-43C2-88BC-6F50D3D6D99D} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\475060e6-e26c-4103-b244-cc664d24d97c => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2017-11-12] (Lenovo Group Limited)
Task: {D5B3B041-76C3-4DFD-9626-ABC86CE55F56} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\MpCmdRun.exe [2017-12-12] (Microsoft Corporation)
Task: {ECAE905B-A6E1-4C67-9D13-481FE5DD05E5} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\c015bf1b-8062-46f0-b3b3-ed1d206215f1 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2017-11-12] (Lenovo Group Limited)
Task: {F33192CD-1148-4E7D-927E-8DC29D10498D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\MpCmdRun.exe [2017-12-12] (Microsoft Corporation)
Task: {FB8B1DAA-9863-4A2C-9BFD-AB0A00F6A012} - System32\Tasks\WinZipBackGroundToolsTask => C:\Program Files\WinZip\WzBGTools.exe [2017-02-10] (WinZip Computing, S.L.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2017-04-27 07:26 - 2015-06-27 04:34 - 000029112 _____ () C:\ProgramData\Lenovo\PLHotkeyService\PLHotkeyService.exe
2016-09-19 03:02 - 2016-09-19 03:02 - 000163336 _____ () C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
2017-03-18 15:58 - 2017-03-18 15:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-18 15:59 - 2017-03-18 21:31 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-12-12 09:54 - 2017-12-12 10:14 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.10.572.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-12-12 09:54 - 2017-12-12 10:14 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.10.572.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-12-12 09:54 - 2017-12-12 10:14 - 024735744 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.10.572.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-12-12 09:54 - 2017-12-12 10:14 - 002551808 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.10.572.0_x64__kzf8qxf38zg5c\skypert.dll
2017-12-12 09:54 - 2017-12-12 10:14 - 000671744 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.10.572.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2017-11-01 12:42 - 2017-11-01 12:53 - 001919680 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8730.21155.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
2017-12-08 08:22 - 2017-12-08 08:30 - 001231528 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8730.21155.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Word.dll
2017-09-27 09:12 - 2017-09-27 10:15 - 003553704 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8730.21155.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2016-09-19 06:13 - 2016-09-19 06:13 - 000849928 _____ () C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2016-07-16 06:47 - 2016-07-16 06:45 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Signature\Signature01.jpg
DNS Servers: 192.168.0.1 - 205.171.203.226
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\StartupFolder: => "WinZip Preloader.lnk"
HKLM\...\StartupApproved\StartupFolder: => "Update Notifier.lnk"
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKLM\...\StartupApproved\Run: => "LenovoUtility"
HKU\S-1-5-21-3777521122-4028487815-3530221622-1001\...\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [UDP Query User{FB3960E8-2739-463B-B39E-E95A1E5E9C15}C:\program files (x86)\logmein rescue calling card\yq6sat\callingcard.exe] => (Allow) C:\program files (x86)\logmein rescue calling card\yq6sat\callingcard.exe
FirewallRules: [TCP Query User{FB169557-EE3F-4ABE-94D7-21546716C8A9}C:\program files (x86)\logmein rescue calling card\yq6sat\callingcard.exe] => (Allow) C:\program files (x86)\logmein rescue calling card\yq6sat\callingcard.exe
FirewallRules: [{F4D4EE17-F76A-4D72-8ACC-A072074544D5}] => (Allow) C:\Users\carri\AppData\Local\Temp\7zS5C4B\HP.EasyStart.exe
FirewallRules: [{3D31D2CB-CA5E-42EB-9D7A-1A5653F6CF3E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{623E475A-B2BF-4D70-B0FB-431C7BE3C4E3}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{F72D2CB2-0B95-4020-8127-4DB57FD69EE5}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe

==================== Restore Points =========================

28-11-2017 08:53:41 Windows Update
03-12-2017 08:46:12 Windows Update
08-12-2017 08:30:06 Installed SSA Benefit Calculator
12-12-2017 10:11:55 Windows Update
17-12-2017 06:46:32 Windows Update

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/15/2017 07:05:03 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (12/12/2017 10:15:05 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-4D0CECB)
Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2147009280 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (12/12/2017 10:15:05 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-4D0CECB)
Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2147009280 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (12/12/2017 10:15:05 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-4D0CECB)
Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2147009280 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (12/04/2017 02:25:34 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.15063.608 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 2204

Start Time: 01d36d3597c4db9e

Termination Time: 31

Application Path: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Report Id: fcf93f02-7809-4b15-9daa-d6f45fb292ae

Faulting package full name:

Faulting package-relative application ID:

Error: (11/30/2017 11:52:30 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (11/28/2017 10:35:12 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "C:\Program Files\WinZip\adxloader.dll.Manifest".Error in manifest or policy file "C:\Program Files\WinZip\adxloader.dll.Manifest" on line 2.
The manifest file root element must be assembly.

Error: (11/28/2017 10:35:03 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\program files (x86)\microsoft office\root\office16\odbc drivers\salesforce\lib\libcurl32.dlla\libcurl.dll".
Dependent Assembly OpenSSL.DllA,processorArchitecture="&#x2a;",type="win32",version="1.0.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (11/28/2017 08:58:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: svchost.exe, version: 10.0.15063.0, time stamp: 0x02799ef5
Faulting module name: ntdll.dll, version: 10.0.15063.608, time stamp: 0x8274fd8b
Exception code: 0xc0000409
Fault offset: 0x00000000000aa020
Faulting process id: 0x2754
Faulting application start time: 0x01d3678c40a4d5dd
Faulting application path: c:\windows\system32\svchost.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: af64fde2-4c3b-48b0-92d9-e0d664310dd6
Faulting package full name:
Faulting package-relative application ID:

Error: (11/27/2017 08:35:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: svchost.exe, version: 10.0.15063.0, time stamp: 0x02799ef5
Faulting module name: ntdll.dll, version: 10.0.15063.608, time stamp: 0x8274fd8b
Exception code: 0xc0000409
Fault offset: 0x00000000000aa020
Faulting process id: 0x5c4
Faulting application start time: 0x01d3616bb5ab1853
Faulting application path: c:\windows\system32\svchost.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 2edb19d7-f245-4a15-a6cc-0b47dba2c487
Faulting package full name:
Faulting package-relative application ID:


System errors:
=============
Error: (12/20/2017 06:49:39 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/20/2017 06:49:39 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/20/2017 04:42:56 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/20/2017 04:42:56 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/19/2017 02:28:13 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/19/2017 01:58:30 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070103: Lenovo Ltd. - Firmware - 2/23/2017 12:00:00 AM - 1.28.0.0.

Error: (12/19/2017 01:53:11 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/19/2017 01:53:11 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/18/2017 07:40:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/18/2017 07:40:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


CodeIntegrity:
===================================
Date: 2017-12-12 09:09:56.075
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\Drivers\WdBoot.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2017-12-12 09:09:56.072
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.17123-0\Drivers\WdBoot.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz
Percentage of memory in use: 39%
Total physical RAM: 8036.01 MB
Available physical RAM: 4898.9 MB
Total Virtual: 9316.01 MB
Available Virtual: 5811.28 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:237.23 GB) (Free:179.88 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: 31694E0B)

Partition: GPT.

==================== End of Addition.txt ============================
CpOwen-1919
Active Member
 
Posts: 3
Joined: December 20th, 2017, 8:15 am
Advertisement
Register to Remove

Re: Owen: Torpig Virus on my Computer

Unread postby pgmigg » December 22nd, 2017, 8:05 pm

Hello CpOwen-1919,

Welcome to the forum! :)

I am pgmigg and I'll be helping you with any malware problems.

Before we begin, please read and follow these important guidelines, so things will proceed smoothly.
  1. The instructions being given are for YOUR computer and system only!
    Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
  2. You must have Administrator rights, permissions for this computer.
  3. DO NOT run any other fix or removal tools unless instructed to do so!
  4. DO NOT install any other software (or hardware) during the cleaning process until we are done as well as
    DO NOT Remove, or Scan with anything on your system unless I ask. This adds more items to be researched.
    Extra Additions and Removals of files make the analysis more difficult.
  5. Only post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
  6. Print each set of instructions if possible - your Internet connection will not be available during some fix processes.
  7. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  8. Only reply to this thread, do not start another one. Please, continue responding, until I give you the "All Clean!" :cheers:
    Absence of symptoms does not mean that everything is clear.

I am currently reviewing your logs and will return, as soon as possible, with additional instructions. In the meantime...

Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.

Please read all instructions carefully before executing and perform the steps, in the order given.
lf you have any questions or problems executing these instructions, <<STOP>> do not proceed, post back with the question or problem.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start


Failure to post replies within 72 hours will result in this thread being closed
User avatar
pgmigg
Admin/Teacher
Admin/Teacher
 
Posts: 5039
Joined: July 8th, 2008, 1:25 pm
Location: GMT-05:00

Re: Owen: Torpig Virus on my Computer

Unread postby pgmigg » December 22nd, 2017, 9:21 pm

Hello CpOwen-1919,

Step 1.
Run CKScanner
  1. Please download CKScanner from Here
  2. Important: - Save it to your Desktop.
  3. Double-click CKScanner.exe and click Search For Files.
  4. After a very short time, when the cursor hourglass disappears, click Save List To File.
  5. A message box will verify the file saved.
  6. Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

Step 2.
TSG - SysInfo utility
  1. Please download SysInfo utility and save it to your Desktop.
  2. Right click on SysInfo.exe, select "Run As Administrator..." to run it... if UAC prompts, please allow it.
  3. Right click, select copy and then paste in your next post.

Step 3.
Run CodeCheck Scan
  1. Please download codecheck from here to your Desktop.
  2. Make sure that codecheck.exe is on the your Desktop before running the application!
  3. Right-click on codecheck.exe and select "Run as administrator..." to run it.
  4. After a very short time a codecheck.txt icon will appear on your Desktop
  5. Double-click on the codecheck.txt icon on your Desktop and copy/paste the contents in your next reply.

Step 4.
Please tell me in detail why you decided that your computer is infected with Torpig virus. What kind of symptoms did you observe?

Then:
Please tell me is this computer used for business purposes and connected to a business or educational network?
I need to know it - so I can provide the proper instructions.

Please include in your next reply:
  1. Do you have any problems executing the instructions?
  2. Contents of CKFiles.txt log file
  3. Contents of SysInfo scan
  4. Contents of a log created by codecheck.txt
  5. Answers to my question related to Tropig virus.
  6. Answers to my question related to type of using of your computer

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed
User avatar
pgmigg
Admin/Teacher
Admin/Teacher
 
Posts: 5039
Joined: July 8th, 2008, 1:25 pm
Location: GMT-05:00

Re: Owen: Torpig Virus on my Computer

Unread postby CpOwen-1919 » December 23rd, 2017, 12:58 pm

CKFiles.txt:
CKScanner 2.5 - Additional Security Risks - These are not necessarily bad
scanner sequence 3.RP.11.SFNADZ
----- EOF -----


SysInfo:
Tech Support Guy System Info Utility version 1.0.0.4
OS Version: Microsoft Windows 10 Home, 64 bit
Processor: Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz, Intel64 Family 6 Model 142 Stepping 9
Processor Count: 4
RAM: 8036 Mb
Graphics Card: Intel(R) HD Graphics 620, 1024 Mb
Hard Drives: C: 237 GB (179 GB Free);
Motherboard: LENOVO, Lenovo YOGA 710-15IKB
Antivirus: Windows Defender, Enabled and Updated

CodeCheck.txt:
Codecheck Version 1.0

12023


Reason why I feel computer is infected:
I fell into the trap and agreed to let Gemini Techies handle my security. Last week they contacted me and told me I had the Torpig virus and needed to speen $229.00 with them and get a new IP address. I felt this was suspicious and decided to see another remedy to validate I had the virus and to protect myself in the future. I will not work with Gemini Techies again. I good friend of mine told me about Malware and suggested I contact you.

Computer Connections:
This computer is not connected to any network.

Symptoms:
At this time I'm not experiencing any issues with my computer that I'm aware of. Gemini Techies took me to Task Manager > Users and told me I had other users on my computer. The told me the proof of this is the number of users who show up after my admin name. Here's and example of todays:
Carriepowen@gmail.com(40)
The number 40 is suppose to imply I have this many unauthorized users on my computer.
CpOwen-1919
Active Member
 
Posts: 3
Joined: December 20th, 2017, 8:15 am

Re: Owen: Torpig Virus on my Computer

Unread postby pgmigg » December 23rd, 2017, 2:25 pm

Hello CpOwen-1919,
CpOwen-1919 wrote:This computer is not connected to any network.
Well, but my question contained two parts and the first one "is this computer used for business purposes?" still is unclear for me. Please clarify.

Related questions:
Do you have any business or other connections with Japan?
Have you ever had an Internet provider from Japan?

Then:
Users List
  1. Please type notepad.exe in the Search Windows box and click Enter - a blank Notepad page should open.
    • Copy and Paste the following script into Notepad, but do not include the words Code: Select all.
    • (Click the Select all button next to Code: to select the entire script).
    Code: Select all
    @echo off
    net user >> %userprofile%\Desktop\AllUsers.txt
    
  2. Save it as userlist.bat (select "All Files (*.*) for Save as type:) on the Desktop and run it by double-click on saved file icon. In a short time the file AllUsers.txt will be created on your Desktop.
  3. Please navigate to your Desktop where you should find AllUsers.txt. Double-click on it and it will be opened in Notepad. Copy and paste the contents in your reply...

Please include in your next reply:
  1. Answers to my question related to type of using of your computer.
  2. Answers to my questions related to Japan.
  3. Do you have any problems executing the instructions?
  4. Contents of AllUsers.txt log file

Thank you,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed
User avatar
pgmigg
Admin/Teacher
Admin/Teacher
 
Posts: 5039
Joined: July 8th, 2008, 1:25 pm
Location: GMT-05:00

Re: Owen: Torpig Virus on my Computer

Unread postby CpOwen-1919 » December 25th, 2017, 10:24 am

Hello and thank you for your quick responses. Below is the information you requested

A. I use the computer for personal use only.
B. The computer is a Lenovo YOGA
C. I have never used an internet provider from Japan
D. I have had no problem executing the instructions. They have been very clear.
E. Here's the information from Allusers.txt

User accounts for \\DESKTOP-4D0CECB

-------------------------------------------------------------------------------
Administrator carri DefaultAccount
Guest
The command completed successfully.
CpOwen-1919
Active Member
 
Posts: 3
Joined: December 20th, 2017, 8:15 am

Re: Owen: Torpig Virus on my Computer

Unread postby pgmigg » December 25th, 2017, 2:12 pm

Hello CpOwen-1919,

Well... lets run one more scan.

TDSSKiller - Rootkit Removal Tool
Please download the TDSSKiller.exe by Kaspersky... save it to your Desktop. <-Important!!!
  1. Right-click on TDSSKiller.exe and select "Run As Administrator...".
    If TDSSKiller does not run... rename it. Right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. ektfhtw.com).
    If you don't see file extensions, please see: How to change the file extension.
  2. Click on Accept button for End User License Agreement.
  3. Click on Decline button for KSN Statement.
  4. Click Change parameters
  5. Under Additional Options CHECK Verify file digital signatures
  6. IMPORTANT: Ensure Detect TDLFS file system remains UNCHECKED.
  7. Click OK if changes were made.
  8. Click Start scan and allow it to scan for Malicious objects. Do not use the computer during the scan!
    • If Malicious objects are detected, the default action will be Cure, ensure SKIP is selected... then click Continue
    • If Suspicious objects are detected, the default action will be Skip, ensure Skip is selected... then click Continue
    • If Unsigned files are detected, the default action will be Skip, ensure Skip is selected... then click Continue
    DO NOT change the default actions, other than CURE to SKIP.
  9. You may be asked to reboot the computer to complete the process. Click on Reboot Now and allow the computer to reboot.
  10. A log will be created on your root drive (usually C:) drive. The log will have a name like Name.Version_Date_Time_log.txt.
    for example, C:\TDSSKiller.2.4.1.2_20.04.2010_15.31.43_log.txt. Please post the contents of the log file in your next reply
  11. If no reboot is required, click on Report. A Report log window should appear - please copy/paste the contents of it in your next reply

Please include in your next reply:
  1. Do you have any problems executing the instructions?
  2. Contents of the TDSSKiller_version_dd.mm.yyyy_hh.mm.ss_log.txt log file or the contents of the Report log window
  3. Do you see any changes in computer behavior?

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed
User avatar
pgmigg
Admin/Teacher
Admin/Teacher
 
Posts: 5039
Joined: July 8th, 2008, 1:25 pm
Location: GMT-05:00

Re: Owen: Torpig Virus on my Computer

Unread postby pgmigg » December 29th, 2017, 12:13 am

Hello CpOwen-1919,

Аgainst the background of the fact that the presence or absence of this infection has not been proven, remember that:

Torpig (or Mebroot) is an extremely serious infection involving the Master Boot Record of the hard drives.
(This infection can come from the use of P2P programs like utorrent, Limewire, etc. used to download shared "free" music, etc.)

The infected computer becomes part of a "zombie" network under complete control of outside criminals.
Any computer thus infected with this "worm", can spread it to any other machine on the same network.
So, all the machines would have to be removed from the network, and they can only be put back, one at a time, as they are cleaned up.
One mistake about the connection of an infected one, and the whole process would have to start over.

Any of the computers need to be cleaned by a experienced technician AFTER being brought offline.
For this infection, this will usually involve "wiping" the drive, removing the partitions, then re-installing and reformatting the partitions.
Then Windows can be re-installed, updated and supplied with an up to date antivirus.

Due to a lack of response within the specified allowable time period, this topic is now closed.

Although we understand a poster may have difficulty responding to a helper's posts and following the instructions therein in a timely manner, that is the way we and most of the other free online help forums function.
Online help forums are usually not the most suitable choice for those who must be away from their infected computers for a period of time that exceeds the posted parameters for receiving assistance.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.

Thank you,
pgmigg
User avatar
pgmigg
Admin/Teacher
Admin/Teacher
 
Posts: 5039
Joined: July 8th, 2008, 1:25 pm
Location: GMT-05:00
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 91 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware