Windows Defender Turns Itself Off

[ColMac]

Nine times out of ten, when I log off, or when the screen saver kicks in, Windows Defender turns itself off.


Possibly, this is a malfunction built into my Dell Inspiron 5720 laptop, which has other peculiar abnormal operational characteristics.


If, however, this is a problem encountered by other users, I would surely be grateful to learn how to fix it.

 

[andrew129260]

* Download the Farbar Service Scanner.

* Once download, right click the fss.exe file, and choose run as administrator.

*Checkmark the following boxes:

-Internet services
-Windows firewall
-System Restore
-Security center/action center
-Windows Update
-Windows defender

*Click Scan. A notepad window will appear with your log file. Save it to the desktop. Then upload the log here in your next reply using the paperclip on the reply box.

 

[ColMac]

andrew129260:

Thank you. Here's what I got:

***************************************************************

Farbar Service Scanner Version: 10-06-2014
Ran by LAPTOP2 (administrator) on 02-07-2014 at 17:03:49
Running from "C:\Users\LAPTOP2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RK91D6VH"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
Firewall Disabled Policy:
==================

System Restore:
============
System Restore Disabled Policy:
========================

Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is set to Disabled. The default start type is Auto.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.

Windows Update:
============
Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed

 

[andrew129260]

1.)Download security check below.

This will show me what security software you use and what the status is of services such as windows firewall:

Downloading SecurityCheck

Open and run: SecurityCheck.exe
Follow the instructions inside the window that appears.

When done, a Notepad report opens automatically, called: checkup.txt

Please post the checkup.txt in your reply using the paperclip:

_____________________________________________________________________________________


Please Run sfc /scan now using option 2 in this tutorial: SFC /SCANNOW Command - System File Checker

Please post back the results.
Please indicate what message was displayed at the end:

Windows found no integrity violations

OR

Corrupt files were found, and windows was unable to fix them.

OR

Corrupt files were found, and windows successfully repaired them

 

[ColMac]

OBTW, when I attempt to go there, I am advised, "Windows Security Center can't be started."

Results from running Security Check (and I believe I uninstalled the McAfee software six or eight months ago):

Results of screen317's Security Check version 0.99.85
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
McAfee Anti-Virus and Anti-Spyware
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
McAfee SiteAdvisor
Java 7 Update 25
Java version out of Date!
Adobe Flash Player 12.0.0.77 Flash Player out of Date!
Adobe Reader 10.1.10 Adobe Reader out of Date!
Google Chrome 35.0.1916.114
Google Chrome 35.0.1916.153
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 4%
``

 

[ColMac]

When I attempt to run sfc /scannow I am advised, "You must be an administrator running a console session in order to use the sfc utility."

I am the onlyh user of this PC, and I am the Administrator.

 

[derekimo]

When I attempt to run sfc /scannow I am advised, "You must be an administrator running a console session in order to use the sfc utility."

I am the onlyh user of this PC, and I am the Administrator.

Yeah, that confuses some folks, what you are doing by running as administrator is elevating from the user level to the system root level.

http://www.sevenforums.com/tutorials/783-elevated-command-prompt.html

So to run the SFC you need to elevate and "Run as Admin" before it will work because you are checking system files.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Just right click before launching the cmd and select "Run as Admin" and it will work.

 

[Layback Bear]

From post # 5.

Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
McAfee Anti-Virus and Anti-Spyware
Microsoft Security Essentials
Antivirus up to date!

I see two anti virus programs. That will cause all kinds of problems.
McAfee is probably turning off the firewall.

I will go back to lurking.

 

[derekimo]

Good eye Jack, MSE will turn off defender.

Two AV's aren't a good idea either, it looks like it says the firewall is enabled though.

 

[andrew129260]

1.) Good job guys. Just as mentioned above please do the following:

-Uninstall mcafee.
-Uninstall Java. Java is a huge security risk and is unnecessary for the average user.
-Uninstall adobe reader and flash. Adobe reader is an unnecessary program and additional security risk as most web browsers can open pdfs without adobe reader. We can install adobe flash later once we clean you from malware.

2.) Click rb: start, type services in the search box. Click services. When the service window opens, browse and look for a service called security center. Click the name of the service, and click start on the left hand side. If it starts with no errors, double click the service and change the startup type to automatic (delayed start) as that is the default state the service is set to startup as.

3.) I suspect you to be infected with malware.

Please read this entirely before we begin malware removal:


Before we start with malware assistance, I want to inform you of a few things:

1.) I am not a recognized malware removal expert. I do not have a certification from a malware removal school. Having said that, I have removed a lot of malware with PCs and have years of experience.
But just like no antivirus program is 100% effective, neither am I. My goal is to simply clean up your PC from any malware, and assist you in any way possible to help you secure your PC.

2.) Sevenforums (This forum)and I will NOT be held responsible for anything that might go wrong with your pc.

3.) You agree to follow all directions given, until I advise that your pc is clean and you are free of threats. You will not abandon the thread.

4.)

Do you agree to these terms?​

If yes, reply with a Yes. If not, please state so and I will flag an official malware remover, or I will recommend another place for malware removal assistance.

 

[Jacee]

Uninstall McAfee Anti-Virus and Anti-Spyware
Supports all McAfee home consumer products between 2005 and 2013.
Download McAfee Consumer Products Removal tool
Note: The CAPTCHA appears to be case sensitive.




Download DDS from one of these links:
DDS.com

DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.

 

[ColMac]

Windows defender Turns Itself Off

First, thanks to all of you who have pitched in and are trying to help. I do need help, and your efforts are appreciated. An item or two:

I uninstalled the McAfee antivirus programs several months ago. They do not show up in Control Panel, nor in Program Files or in Program Files (x86). Why the diagnostic software detects McAfee apps is a bit of a mystery.

SFC /SCANNOW Command - System File Checker will not open from "Run". The window simply disappears when "OK" is clicked. Right clicking anywhere in the window produces some options, but "Run as administrator" is not one of them.

I have regularly run full system scans with both Windows Defender and Microsoft Security Essentials. No malware has been detected by either program. I run WinZip Registry Optimizer occasionally, and typically pick up two or five anomalies that get cleaned up. So, considering all that, is it still likely that there is a malware infestation somewhere in this computer?

I'm a bit gunshy considering the cautionary statement about possible hazards inherent in your proposed malware removal steps. Will have to think about that a bit.

Otherwise, does Microsoft Security Essentials actually turn off Windows Defender? If that's the cause of the problem, perhaps I should turn off or uninstall MSE, and see if that fixes the problem.

 

[ColMac]

Results of DDS scan:


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 9/27/2012 5:43:31 PM
System Uptime: 7/6/2014 10:22:31 AM (1 hours ago)
.
Motherboard: Dell Inc. | | 023HTX
Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz | CPU Socket - U3E1 | 2501/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 918 GiB total, 864.238 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Teredo Tunneling Adapter
Device ID: ROOT\*TEREDO\0001
Manufacturer: Microsoft
Name: Teredo Tunneling Pseudo-Interface
PNP Device ID: ROOT\*TEREDO\0001
Service: tunnel
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
4 Elements II
Adblock IE 3.0
Adobe AIR
Adobe Flash Player 12 Plugin
Adobe Flash Player 14 ActiveX
Adobe Reader X (10.1.10) MUI
Advanced Audio FX Engine
Bad Piggies
Banctec Service Agreement
Bejeweled 2 Deluxe
Blackhawk Striker 2
Bounce Symphony
Brickshooter Egypt 1.0
Build-a-lot 2
Cake Mania
CCleaner
Chuzzle Deluxe
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Complete Care Business Service Agreement
Consumer In-Home Service Agreement
CWA Reminder by We-Care.com v4.1.21.3
D3DX10
DefaultTab
Defense Grid: The Awakening
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dell DataSafe Local Backup
Dell DataSafe Local Backup - Support Software
Dell DataSafe Online
Dell Digital Delivery
Dell Edoc Viewer
Dell MusicStage
Dell PhotoStage
Dell Product Registration
Dell Stage
Dell Stage Remote
Dell System Detect
Dell Touchpad
Dell VideoStage
Dell Webcam Central
Diner Dash 2 Restaurant Rescue
Dora's World Adventure
DW WLAN Card Utility
Escape Whisper Valley (TM)
Farm Frenzy
FATE
Final Drive Fury
Final Drive Nitro
Google Chrome
Google Chrome Frame
Google Toolbar for Internet Explorer
Google Update Helper
High-Definition Video Playback
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) OpenCL CPU Runtime
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Intel(R) Turbo Boost Technology Monitor 2.0
Intel(R) USB 3.0 eXtensible Host Controller Driver
Intel® Trusted Connect Service Client
Java 7 Update 25
Java Auto Updater
Jewel Quest
Jewel Quest Solitaire 2
Junk Mail filter update
Luxor
Mesh Runtime
Microsoft .NET Framework 4.5.1
Microsoft Application Error Reporting
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared 64-bit MUI (English) 2010
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
MSVCRT
MSVCRT_amd64
Namco All-Stars PAC-MAN
Nero 10 Movie ThemePack Basic
Nero Control Center 10
Nero ControlCenter 10 Help (CHM)
Nero Core Components 10
Oceanis
Penguins!
Photo Collage Creator 3.31
Plants vs. Zombies - Game of the Year
PlayReady PC Runtime x86
Poker Superstars III
Polar Bowler
Polar Golfer
Quickset64
Rapport
Samantha Swift
SavingsBull
SavingsbullFilter
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
Security Update for Microsoft Excel 2010 (KB2826033) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2767915) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2810073) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2826023) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2826035) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2878284) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition
Security Update for Microsoft Outlook 2010 (KB2837597) 32-Bit Edition
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
Shared C Run-time for x64
Skype™ 5.10
Snowy - The Bear's Adventure
Steam
SyncUP
System Checkup 3.3
Torchlight
Torchlight II
Trusteer Endpoint Protection
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition
Update Installer for WildTangent Games App
Virtual Villagers 4 - The Tree of Life
Wedding Dash - Ready, Aim, Love!
WildTangent Games
WildTangent Games App
WildTangent Games App (Dell Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinZip 18.0
WinZip Registry Optimizer
Yahoo! Software Update
Yontoo 1.10.02
Zuma Deluxe

 

[Jacee]

Please download AdwCleaner by Xplode and save to your Desktop.
Step 1.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Step 2.
Using AdwCleaner v3: Scan & Clean:
This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder
******Post both .txt logs

 

[derekimo]

Stick with Jacee's instructions as she is a security expert, I'm just answering these below for clarity.

SFC /SCANNOW Command - System File Checker will not open from "Run". The window simply disappears when "OK" is clicked. Right clicking anywhere in the window produces some options, but "Run as administrator" is not one of them.

I think this will explain how to run sfc...

Otherwise, does Microsoft Security Essentials actually turn off Windows Defender? If that's the cause of the problem, perhaps I should turn off or uninstall MSE, and see if that fixes the problem.

A reader recently asked us if she needed Windows Defender, antispyware software from Microsoft that comes with Windows Vista and Windows 7, if she had downloaded Microsoft Security Essentials (free antivirus and antispyware software).

If you use Microsoft Security Essentials, you don't need Windows Defender. When you download Microsoft Security Essentials, it will turn off (but not uninstall) Windows Defender automatically. It does this so that you don't have two programs on your computer that are doing the same thing. If you ever decided to uninstall Microsoft Security Essentials, Windows Defender will be turned back on again.

Microsoft Security Essentials vs. Windows Defender - Security Tips & Talk - Site Home - MSDN Blogs

 

[ColMac]

I have some work to do, in response to your most helpful posts. Which I will do.

I also have a question:

There seems to be consensus that Windows Security Essentials will turn off / disable Windows Defender. Possibly, that's all that's happening on my laptop? Depending on which Web site you visit, there are some folks who believe WSE is the only anti-virus, anti-malware software needed by Windows 7 users.

What, if any, negative consequences would result if I simply uninstalled Windows Defender, and carried on depending only on Windows Security Essentials?

I do appreciate that would mean you all have gone to some length to try to help me resolve the situation, to no avail, and can only thank you again for your efforts. And I wonder if we're over-engineering the problem.

 

[derekimo]

There seems to be consensus that Windows Security Essentials will turn off / disable Windows Defender. Possibly, that's all that's happening on my laptop?

That is a possibility, since that is the nature of installing MSE, it turns off defender when installed.

Depending on which Web site you visit, there are some folks who believe WSE is the only anti-virus, anti-malware software needed by Windows 7 users.

You will find differing opinions all over the web, people have their preferences for AV products.

I think a good minimum is an AV you are happy with and Malwarebytes for an on demand scanner.

I use MSE for real time protection, and Malwarebytes as an on demand scanner, others here use the premium version of MBAM for real time protection, which runs well along side most all AV products.

What, if any, negative consequences would result if I simply uninstalled Windows Defender, and carried on depending only on Windows Security Essentials?

Actually, you don't uninstall windows defender, like internet explorer it is part of the operating system.

Letting it sit as is is perfectly fine.

And I wonder if we're over-engineering the problem.

Not really, you can never be too careful, but I understand why you may think that if defender was turned off because it was actually supposed to be when MSE was installed.

I won't second guess what Jacee is doing, she is a well respected security expert.

I think she is handling your situation. The AdwCleaner recommended above is always a good idea in my opinion.

My personal opinion about your security programs are I use MSE as well with Malwarebytes as an on demand scanner and without trying to open the flood gates on which is the best protection,

I am quite happy with that combination and with safe browsing habits have not had any problems.

 

[ColMac]

1) As suggested by Jacee on 7/6, I have finally downloaded and run a scan using ADwCleaner. The scan results include the recommendation to uninstall WinZip Registry Optimizer, which I would prefer not to do, as well as a considerable list of other folders and programs, virtually none of which I recognize.

Additionally, there is a long list of Registry items which I am very reluctant to remove, having been indoctrinated since birth to not mess with the Registry if there is any possible way to avoid it.

A copy of the ADwCleaner scan logfile is at the bottom of this post.

What to do?


2) If the root cause of the problem that started this thread is the fact that Microsoft Security Essentials turns off Windows Defender, there must be a reason why it does that. Is the reason that MSE performs the anti-virus and anti-malware functions satisfactorily, and there is no need to use Windows Defender if MSE is functioning normally? Perhaps I really don't need Windows Defender to be operating?


Logfile ADwCleaner[R0].txt:

# AdwCleaner v3.215 - Report created 09/07/2014 at 16:33:16
# Updated 09/07/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : LAPTOP2 - LAPTOP2-PC
# Running from : C:\Users\LAPTOP2\Downloads\AdwCleaner.exe
# Option : Scan
***** [ Services ] *****
Service Found : DefaultTabUpdate
Service Found : SavingsbullFilterService64
***** [ Files / Folders ] *****
File Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
File Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal
File Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
File Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.livelyrics00.live-lyrics.com_0.localstorage
File Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.livelyrics00.live-lyrics.com_0.localstorage-journal
File Found : C:\Windows\System32\roboot64.exe
File Found : C:\Windows\System32\Tasks\DTReg
Folder Found : C:\Program Files (x86)\internethelper3.1
Folder Found : C:\Program Files (x86)\MyPC Backup
Folder Found : C:\Program Files (x86)\PC Health Kit
Folder Found : C:\Program Files (x86)\SavingsBull
Folder Found : C:\Program Files (x86)\Trusted Saver
Folder Found : C:\Program Files (x86)\VideoDownloadConverter_4z
Folder Found : C:\Program Files (x86)\WebSparkle
Folder Found : C:\Program Files (x86)\WinZip Registry Optimizer
Folder Found : C:\Program Files (x86)\Yontoo
Folder Found : C:\Program Files\Level Quality Watcher
Folder Found : C:\Program Files\SavingsBull
Folder Found : C:\Program Files\SavingsbullFilter
Folder Found : C:\ProgramData\apn
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Registry Optimizer
Folder Found : C:\ProgramData\speedypc software
Folder Found : C:\ProgramData\Tarma Installer
Folder Found : C:\ProgramData\WeCareReminder
Folder Found : C:\Users\LAPTOP2\AppData\Local\Browsersafeguard
Folder Found : C:\Users\LAPTOP2\AppData\Local\getsav-in
Folder Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm
Folder Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Extensions\cakimmoclemogopdpkmnhnhlbdbhople
Folder Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ippkomaaonokjnfjoikaemidanojkfmm
Folder Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjildcbkilmkddbbpbjljljdmmlfeppl
Folder Found : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngaeinfoeljecnggcbonnohnjpepenmb
Folder Found : C:\Users\LAPTOP2\AppData\LocalLow\Conduit
Folder Found : C:\Users\LAPTOP2\AppData\LocalLow\iac
Folder Found : C:\Users\LAPTOP2\AppData\LocalLow\internethelper3.1
Folder Found : C:\Users\LAPTOP2\AppData\Roaming\DefaultTab
Folder Found : C:\Users\LAPTOP2\AppData\Roaming\DriverCure
Folder Found : C:\Users\LAPTOP2\AppData\Roaming\Nico Mak Computing
Folder Found : C:\Users\LAPTOP2\AppData\Roaming\OpenCandy
Folder Found : C:\Users\LAPTOP2\AppData\Roaming\PC Health Kit
Folder Found : C:\Users\LAPTOP2\AppData\Roaming\SearchProtect
Folder Found : C:\Users\LAPTOP2\AppData\Roaming\speedypc software
Folder Found : C:\Users\LAPTOP2\Documents\ShopToWin
Folder Found : C:\Users\Public\util
Folder Found : C:\Windows\Installer\{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}
Folder Found : C:\Windows\Installer\{813BA625-B0FA-48D8-9B75-59759C88C219}
***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\AppDataLow\Software\DefaultTab
Key Found : HKCU\Software\AppDataLow\Software\Freecause
Key Found : HKCU\Software\AppDataLow\Software\Savings Bull
Key Found : HKCU\Software\AppDataLow\Software\SavingsBull
Key Found : HKCU\Software\Default Tab
Key Found : HKCU\Software\DefaultTab
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10AD2C61-0898-4348-8600-14A342F22AC3}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10AD2C61-0898-4348-8600-14A342F22AC3}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKCU\Software\SavingsBull
Key Found : HKCU\Software\speedypc software
Key Found : HKCU\Software\wecarereminder
Key Found : [x64] HKCU\Software\APN PIP
Key Found : [x64] HKCU\Software\Default Tab
Key Found : [x64] HKCU\Software\DefaultTab
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Found : [x64] HKCU\Software\SavingsBull
Key Found : [x64] HKCU\Software\speedypc software
Key Found : [x64] HKCU\Software\wecarereminder
Key Found : HKLM\SOFTWARE\Classes\AppID\{38495740-0035-4471-851E-F5BBB86AB085}
Key Found : HKLM\SOFTWARE\Classes\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36}
Key Found : HKLM\SOFTWARE\Classes\AppID\{72D89EBF-0C5D-4190-91FD-398E45F1D007}
Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Found : HKLM\SOFTWARE\Classes\AppID\{EB583FE1-9458-4EDA-AC68-24D24F17C70F}
Key Found : HKLM\SOFTWARE\Classes\AppID\DefaultTabBHO.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\ShoppingBHO.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{10AD2C61-0898-4348-8600-14A342F22AC3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser
Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser.1
Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX
Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX.1
Key Found : HKLM\SOFTWARE\Classes\FCSB000063449.JSOptionsImpl
Key Found : HKLM\SOFTWARE\Classes\FCSB000063449.JSOptionsImpl.1
Key Found : HKLM\SOFTWARE\Classes\FCSB000063449.Shopping
Key Found : HKLM\SOFTWARE\Classes\FCSB000063449.Shopping.1
Key Found : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder
Key Found : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder.1
Key Found : HKLM\Software\Classes\Installer\Features\1708EDD6AB4EB164A86999D0AF0ABE1D
Key Found : HKLM\Software\Classes\Installer\Features\526AB318AF0B8D84B9579557C9882C91
Key Found : HKLM\Software\Classes\Installer\Products\1708EDD6AB4EB164A86999D0AF0ABE1D
Key Found : HKLM\Software\Classes\Installer\Products\526AB318AF0B8D84B9579557C9882C91
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3}
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{FEB62B15-CC00-4736-AAEC-BA046C9DFF73}
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Default Tab
Key Found : HKLM\Software\Freeze.com
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\ippkomaaonokjnfjoikaemidanojkfmm
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Found : HKLM\Software\InstallIQ
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab
Key Found : HKLM\Software\PIP
Key Found : HKLM\Software\SavingsBullFilter
Key Found : HKLM\Software\speedypc software
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : [x64] HKLM\SOFTWARE\LevelQualityWatcher
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{813BA625-B0FA-48D8-9B75-59759C88C219}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Found : [x64] HKLM\SOFTWARE\Savings Bull
Key Found : [x64] HKLM\SOFTWARE\SavingsBull Filter
Key Found : [x64] HKLM\SOFTWARE\Tarma Installer
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BrowserSafeguard]
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17126

-\\ Google Chrome v35.0.1916.153
[ File : C:\Users\LAPTOP2\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Found [Extension] : adpkifcfcacgmnggcbpbjbkdijciiigm
Found [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
Found [Extension] : cakimmoclemogopdpkmnhnhlbdbhople
Found [Extension] : flpcjncodpafbgdpnkljologafpionhb
Found [Extension] : ippkomaaonokjnfjoikaemidanojkfmm
Found [Extension] : kmifjikmkjppnomadkpaopmlcjdnohjd
Found [Extension] : mjildcbkilmkddbbpbjljljdmmlfeppl
Found [Extension] : ngaeinfoeljecnggcbonnohnjpepenmb
*************************
AdwCleaner[R0].txt - [16004 octets] - [09/07/2014 16:33:16]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [16065 octets] ##########