Spyware / Malware / Virus Removal

system has slowed to a crawl [Solved]

8 min read

Looking for the outcome? Ask AI

kevin_czarnota Topic Starter

Post #1August 23, 2014, 1:23 PM UTC

My system has slowed to a crawl, anything I click on gives me a spinning icon and I literally have to wait 20 seconds or more for the application to load.

I have run Kapersky rescue disk

I have superantispyware running

I have cleaned out cashes

So now I need help from the experts

Below is my highjack this file.

Thank you for any help you can give.

Highjack this file:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:00:37 AM, on 8/23/2014
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16563)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE
C:\Program Files (x86)\Common Files\aol\1232141495\ee\aolsoftware.exe
C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
c:\users\kevin\Desktop\highjackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.techsupportalert.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: ArcadeFrontier Addon - {6C8DB2EC-499B-4897-A784-0E3186C97E9D} - C:\Users\kevin\AppData\Local\ArcadeFrontier\ArcadeFrontier.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [HostManager] "C:\Program Files (x86)\Common Files\AOL\1232141495\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [Carbonite Backup] "C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [KSS] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun
O4 - Startup: Stoic Joker's T-Clock x64.lnk = C:\Program Files (x86)\Tclock\tclock-x64\Clock.exe
O4 - Global Startup: Intuit Data Protect.lnk = C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: QuickBooks_Standard_21.lnk = C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.dell.com
O16 - DPF: {0AD584EB-F10F-46F7-BCB8-1085C386BEAE} (IntuitRecurPayCom2009.UserControl1) - https://merchantaccount.quickbooks.com/recurchrg/IntuitRecurPayCom2009.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files%20(x86)/Virtual%20Families/Images/stg_drm.ocx
O16 - DPF: {5C709EEC-DDE1-4738-8E57-7564E2637891} (QBMASSyncCom1_2009.UserControl1) - https://merchantaccount.quickbooks.com/sync/QBMASSyncCom1_2009.cab
O16 - DPF: {788539E8-002D-4E59-9089-40B694A99C9A} (QBMASSyncCom2_2008.UserControl1) - https://merchantaccount.quickbooks.com/sync/QBMASSyncCom2_2008.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} (DellSystemLite.Scanner) - http://support.dell.com/systemprofiler/DellSystemLite.CAB
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files%20(x86)/Peggle/Images/armhelper.ocx
O18 - Protocol: intu-help-qb5 - {867FCB77-9823-4CD6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL Inc. - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Motorola Device Manager Service (Motorola Device Manager) - Motorola Mobility LLC - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PST Service - Motorola - C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QBIDPService (QBVSS) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - C:\Program Files\Macrium\Reflect\ReflectService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ShowAnalyzerMaster - Dragon Global - C:\Program Files (x86)\Dragon Global\ShowAnalyzerSuite\ShowAnalyzerMaster.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 10156 bytes

ken545

Post #2August 24, 2014, 5:21 PM UTC

Dont know if your issue is malware or windows related, all we can do is run a few scans and make sure your clean and if the problem still exists than I can refer you to our windows forum.

Hijackthis is a very old tool and not used much anymore, we have better scanners now that tell us a whole lot more, run these programs in the order listed please

[external image: 1QYkxTZ.jpg] Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.

Click the Scan button to start scan.

If you are asked to update the Avast Virus database please allow it to do so.

When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

I just want to see the report….Please Do Not Fix Anything

============================================================================

Download Malwarebytes' Anti-Malware to your desktop.

Windows XP : Double click on the icon to run it.

Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

[external image: MBAMDashboard_zpsddef9b5f.gif]

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Treat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up…select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

===========================================================

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

A simple way to check your system: Start –> Computer (right click) –> Properties

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

Please make sure All Users is checked

Do not check

*List BCD

*Drivers MD5

*Shortcut txt

Press Scan button.

It will produce a log called FRST.txt in the same directory the tool is run from.

Please copy and paste log back here.

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

kevin_czarnota

Post #3August 25, 2014, 11:27 PM UTC

Here is aswMBR report:

aswMBR version 1.0.1.2041 Copyright© 2014 AVAST Software
Run date: 2014-08-25 09:07:11
—————————–
09:07:11.532    OS Version: Windows x64 6.0.6002 Service Pack 2
09:07:11.532    Number of processors: 2 586 0x1706
09:07:11.533    ComputerName: CZARNOTA-FAMILY UserName: kevin
09:07:17.595    Initialize success
09:07:18.087    VM: initialized successfully
09:07:18.845    VM: Intel CPU virtualization not supported
09:11:11.584    AVAST engine defs: 14082500
09:11:15.801    Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
09:11:15.806    Disk 0 Vendor: WDC_WD2500AAKS-00VSA0 01.01B01 Size: 238475MB BusType: 3
09:11:15.811    Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-4
09:11:15.815    Disk 1 Vendor: WDC_WD1002FAEX-00Z3A0 05.01D05 Size: 953869MB BusType: 3
09:11:15.821    Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T0L0-5
09:11:15.826    Disk 2 Vendor: WDC_WD5000AACS-00G8B1 05.04C05 Size: 476940MB BusType: 3
09:11:16.038    Disk 1 MBR read successfully
09:11:16.044    Disk 1 MBR scan
09:11:16.085    Disk 1 Windows VISTA default MBR code
09:11:16.094    Disk 1 Partition 1 00     DE Dell Utility Dell 8.0      109 MB offset 63
09:11:16.142    Disk 1 Partition 2 00     07    HPFS/NTFS NTFS        30718 MB offset 224910
09:11:16.203    Disk 1 Partition 3 80 (A) 07    HPFS/NTFS NTFS       923039 MB offset 63135450
09:11:16.396    Disk 1 scanning C:\Windows\system32\drivers
09:11:39.270    Service scanning
09:12:23.761    Disk 1 MBR has been saved successfully to "C:\Users\kevin\Desktop\MBR.dat"
09:12:38.061    Modules scanning
09:12:38.071    Disk 1 trace - called modules:
09:12:38.109    ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
09:12:38.115    1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0xfffffa8004b0a790]
09:12:38.123    3 CLASSPNP.SYS[fffffa60010e6c33] -> nt!IofCallDriver -> [0xfffffa800489b930]
09:12:38.129    5 acpi.sys[fffffa60008e4fde] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-4[0xfffffa80048b8060]
09:12:40.622    AVAST engine scan C:\Windows
09:12:49.197    AVAST engine scan C:\Windows\system32
09:22:19.419    AVAST engine scan C:\Windows\system32\drivers
09:23:19.483    AVAST engine scan C:\Users\kevin
09:36:18.841    AVAST engine scan C:\ProgramData
09:45:01.379    Scan finished successfully
17:54:47.719    Disk 1 MBR has been saved successfully to "C:\Users\kevin\Desktop\MBR.dat"
17:54:47.768    The log file has been saved successfully to "C:\Users\kevin\Desktop\aswMBR.txt"

Here is the Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/25/2014
Scan Time: 6:01:20 PM
Logfile: malwareLog.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.25.05
Rootkit Database: v2014.08.21.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x64
File System: NTFS
User: kevin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 482046
Time Elapsed: 16 min, 56 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

Last one to be in next reply

kevin_czarnota

Post #4August 25, 2014, 11:52 PM UTC

here is the additions and the FRSt file

Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2014 01
Ran by [removed] at 2014-08-25 18:45:39
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

10 Talismans (HKLM-x32\…\BFG-10 Talismans) (Version: - )
3DVIA player 5.0 (HKLM-x32\…\{4E868D3D-6EEB-4273-926C-2287236B5B79}) (Version: 5.0.0.15 - 3DVIA)
Acrobat.com (HKLM-x32\…\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 2.0.0.0 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 2.0.0 - Adobe Systems Incorporated) Hidden
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\…\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.7) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.7 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
Agatha Christie: 4:50 from Paddington (HKLM-x32\…\BFG-Agatha Christie - 450 from Paddington) (Version: - )
Age of Emerald (HKLM-x32\…\BFG-Age of Emerald) (Version: - )
Age Of Oracles: Tara`s Journey (HKLM-x32\…\BFG-Age Of Oracles - Taras Journey) (Version: - )
Alex Gordon (HKLM-x32\…\BFG-Alex Gordon) (Version: - )
Amazing Adventures: The Caribbean Secret (HKLM-x32\…\BFG-Amazing Adventures - The Caribbean Secret) (Version: - )
Amazing Pyramids (HKLM-x32\…\BFG-Amazing Pyramids) (Version: - )
AOL Registration (HKLM-x32\…\AOL Regclient) (Version: - )
AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\…\AOL Uninstaller) (Version: - AOL Inc.)
ATI AVIVO64 Codecs (Version: 10.0.0.31121 - ATI Technologies Inc.) Hidden
Atlantis (HKLM-x32\…\BFG-Atlantis) (Version: - )
Auslogics Disk Defrag (HKLM-x32\…\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: version 3.1 - Auslogics Software Pty Ltd)
Avery Template (HKLM-x32\…\{A760067A-C07E-1033-0000-A764AC000008}) (Version: 2.0.0.0 - Avery)
Avidemux 2.5 (HKLM-x32\…\Avidemux 2.5 (64-bit)) (Version: 2.5.6.7716 - )
AxCrypt 1.7.2126.0 (HKLM\…\{4316E318-85EC-42C3-9535-C7B49B8CAD21}) (Version: 1.7.2126.0 - Axantum Software AB)
Big City Adventure: Sydney, Australia (HKLM-x32\…\BFG-Big City Adventure - Sydney Australia) (Version: - )
Big Fish Games: Game Manager (HKLM-x32\…\BFGC) (Version: 3.0.1.60 - )
Bus Driver (HKLM-x32\…\BFG-Bus Driver) (Version: - )
Carbonite (HKLM-x32\…\Carbonite Backup) (Version: 5.5.5 build 4151 (Jun-27-2014) - Carbonite)
CCleaner (HKLM\…\CCleaner) (Version: 4.00 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
ConvertHelper 2.2 (HKLM-x32\…\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version: - DownloadHelper)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2433A103-9EC3-49EA-9AD1-58A35F27EE56}) (Version: - Microsoft)
Dell Getting Started Guide (HKLM-x32\…\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell System Detect (HKCU\…\9204f5692a8faf3b) (Version: 5.7.0.6 - Dell)
Dell System Detect Bootstrapper (HKCU\…\8e3135b376bd523e) (Version: 1.1.0.15 - Dell)
DVD Flick 1.3.0.7 (HKLM-x32\…\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
DVRMSToolbox (HKLM-x32\…\{E7ECD072-02DF-4F24-B5C9-7928A2867B14}) (Version: 1.2.1 - babgvant.com)
EasyCleaner (HKLM-x32\…\{F5346614-B7C4-4E94-826A-E2363155233D}) (Version: 2.0.6.380 - ToniArts)
EPSON Printer Software (HKLM\…\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\…\EPSON Scanner) (Version: - )
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
EssentialPIM (HKLM-x32\…\EssentialPIM) (Version: 4.23 - )
Exact Audio Copy 0.99pb5 (HKLM-x32\…\Exact Audio Copy) (Version: 0.99pb5 - Andre Wiethoff)
Farm Frenzy 3: Madagascar (HKLM-x32\…\BFG-Farm Frenzy 3 - Madagascar) (Version: - )
ffdshow [rev 2527] [2008-12-19] (HKLM-x32\…\ffdshow_is1) (Version: 1.0 - )
Gardenscapes (HKLM-x32\…\BFG-Gardenscapes) (Version: - )
Geisha: The Secret Garden (HKLM-x32\…\BFG-Geisha - The Secret Garden) (Version: - )
Gemsweeper (HKLM-x32\…\BFG-Gemsweeper) (Version: - )
Google Calendar Sync (HKLM-x32\…\Google Calendar Sync) (Version: - )
Great Escapes Solitaire Collection (HKLM-x32\…\BFG-Great Escapes Solitaire Collection) (Version: - )
Hidden Expedition: Everest ™ (HKLM-x32\…\BFG-Hidden Expedition - Everest) (Version: - )
Inkscape 0.48.4 (HKLM-x32\…\Inkscape) (Version: 0.48.4 - )
Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: - Intel Corporation)
Jar of Marbles (HKLM-x32\…\BFG-Jar of Marbles) (Version: - )
Java 7 Update 25 (64-bit) (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F86417025FF}) (Version: 7.0.250 - Oracle)
Java 7 Update 67 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Kingdom Chronicles (HKLM-x32\…\BFG-Kingdom Chronicles) (Version: - )
Liong: The Dragon Dance (HKLM-x32\…\BFG-Liong - The Dragon Dance) (Version: - )
Logitech QuickCam (HKLM\…\{192E85C6-2B8A-4217-AD30-ECA5CE19DB23}) (Version: 10.51.2029 - Logitech Inc.)
Logitech Video Enumerator (x32 Version: 10.51.2027 - Logitech Inc.) Hidden
Logitech® Camera Driver (HKLM-x32\…\QcDrv) (Version: - )
Macrium Reflect - Free Edition (HKLM\…\{AC1B58BB-55ED-43F0-98D9-6CEB24C2C5CD}) (Version: 4.2.2098 - Macrium)
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\…\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft Corporation (x32 Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft LifeCam (HKLM\…\{5CE7E3F5-9803-4F32-AA89-2D8848A80109}) (Version: 3.60.253.0 - Microsoft Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
Microsoft Office 2010 Service Pack 1 (SP1) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\…\Office14.PROPLUSR) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.3.0215.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.3.215.0 - Microsoft Corporation)
Microsoft VC9 runtime libraries (x32 Version: 1.0.0 - AOL Inc.) Hidden
Microsoft VC9 runtime libraries (x32 Version: 1.0.0 - AOL LLC) Hidden
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\…\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\…\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Million Dollar Quest (HKLM-x32\…\BFG-Million Dollar Quest) (Version: - )
MotoCast (HKLM-x32\…\{5401CEE8-3C2D-4835-A802-213306537FF4}) (Version: 2.0.31 - Motorola Mobility)
MotoHelper MergeModules (x32 Version: 1.2.0 - Motorola) Hidden
Motorola Device Manager (HKLM-x32\…\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.4.5 - Motorola Mobility)
Motorola Device Software Update (x32 Version: 13.09.3001 - Motorola Mobility) Hidden
Motorola Mobile Drivers Installation 6.3.0 (HKLM\…\{759E6A2F-1F01-45EF-A0C4-22F1B56CB975}) (Version: 6.3.0 - Motorola Mobility LLC)
Mozilla Firefox 31.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 31.0 (x86 en-US)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\…\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\…\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\…\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
My Kingdom for the Princess II (HKLM-x32\…\BFG-My Kingdom for the Princess II) (Version: - )
My Kingdom for the Princess III (HKLM-x32\…\BFG-My Kingdom for the Princess III) (Version: - )
Nick Jr. Bingo (HKLM-x32\…\BFG-Nick Jr. Bingo) (Version: - )
NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version: - )
Pac-Man (HKLM-x32\…\BFG-Pac-Man) (Version: - )
Pantheon (HKLM-x32\…\BFG-Pantheon) (Version: - )
Paradise Quest (HKLM-x32\…\BFG-Paradise Quest) (Version: - )
PDF Annotator 5.0.0.502 (HKLM-x32\…\PDFAnnotator_is1) (Version: 5.0.0.502 - GRAHL software design)
PDF-Viewer (HKLM\…\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.200.0 - Tracker Software Products Ltd)
Peggle (HKLM-x32\…\Peggle) (Version: - Spintop Media, Inc)
Peggle Deluxe (HKLM-x32\…\BFG-Peggle Deluxe) (Version: - )
Pioneer Lands (HKLM-x32\…\BFG-Pioneer Lands) (Version: - )
Print to PDF Annotator (novaPDF OEM 7.7 printer) (HKLM\…\Print to PDF Annotator_is1) (Version: 7.7.400 - Softland)
Puzzle Park (HKLM-x32\…\BFG-Puzzle Park) (Version: - )
QuickBooks (x32 Version: 22.0.4015.2206 - Intuit Inc.) Hidden
QuickBooks Pro 2012 (HKLM-x32\…\{22057D8D-7CC8-46FF-AD8C-9BD24F9014F3}) (Version: 22.0.4015.2206 - Intuit Inc.)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - Realtek Semiconductor Corp.)
RTC Client API v1.2 (HKLM-x32\…\{44CDBD1B-89FB-4E02-8319-2A4C550F664A}) (Version: 1.2.0000 - Microsoft)
Season of Mystery: The Cherry Blossom Murders (HKLM-x32\…\BFG-Season of Mystery - The Cherry Blossom Murders) (Version: - )
ShopSafe (x32 Version: 1.4.3.0 - ShopSafe) Hidden
ShowAnalyzerSuite (HKLM-x32\…\{230B46CD-A035-484C-BB8B-1FE46DA0724F}) (Version: 1.0.59.783 - Dragon Global)
Skype™ 5.10 (HKLM-x32\…\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}) (Version: 5.10.116 - Skype Technologies S.A.)
Slingo Quest (HKLM-x32\…\BFG-Slingo Quest) (Version: - )
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
SUPERAntiSpyware (HKLM\…\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 4.47.1000 - SUPERAntiSpyware.com)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab for Intel (HKLM-x32\…\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
The Timebuilders: Caveman's Prophecy (HKLM-x32\…\BFG-The Timebuilders - Caveman's Prophecy) (Version: - )
The Timebuilders: Pyramid Rising (HKLM-x32\…\BFG-The Timebuilders - Pyramid Rising) (Version: - )
Trinklit Supreme (HKLM-x32\…\BFG-Trinklit Supreme) (Version: - )
TurboTax Deluxe 2007 (HKLM-x32\…\TurboTax Deluxe 2007) (Version: - )
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\…\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\…\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553065) (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{A8686D24-1E89-43A1-973E-05A258D2B3F8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553157) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{97C39B81-3054-4AB4-B11D-A656DE619982}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{48E1B6C2-7299-4F3F-AA63-42F0ACE55AA4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{18B3CF2A-73F7-4716-B1AE-86D68726D408}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (HKLM-x32\…\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{73E67A3A-8D61-44EF-90C2-1697C3DBE668}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2566458) (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{EFB525A0-E1C0-4E32-9968-FE401BC87363}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589370) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{150A0FF0-AF69-4132-BD93-1E34F63FC8A3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ED31DE9A-3E13-4E2C-9106-E0D8AFFB9FA6}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (HKLM-x32\…\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{C4F26A9B-B121-4135-8084-A0D9C780C7C8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (HKLM-x32\…\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{460FF681-BC66-4C38-99DF-7012E03F1EBA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (HKLM-x32\…\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{C633216E-FF30-45B6-B2AB-21922A9353EF}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\…\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760758) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{24BD08F8-FF6E-4DD8-BE49-3659AE78A819}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9CFD026D-EB1C-48C2-9DD2-8E8875F251B2}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (HKLM-x32\…\{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{9865DC3A-2898-48D9-B96A-46397571C934}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (HKLM-x32\…\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{3EFF1957-7DEA-4C7A-8E9C-2D6D58E4B2ED}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{3EFF1957-7DEA-4C7A-8E9C-2D6D58E4B2ED}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (HKLM-x32\…\{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{47894754-0FEC-4920-9A65-6C1E732587AC}) (Version: - Microsoft)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (HKLM-x32\…\{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{1EEFF749-6F29-4F0B-AB08-4C6EA52AA110}) (Version: - Microsoft)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BC6DFBFD-16DD-47E1-A7EF-2C062930FA4F}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\…\{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{DA2F7ECE-6629-4A80-9CDE-EC95261B75E2}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{190EC86F-5867-4D7A-B9F3-D14D82C26F3D}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (HKLM-x32\…\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{5DA2D071-A54C-47C0-83E5-43C63DBFD936}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5DA2D071-A54C-47C0-83E5-43C63DBFD936}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Viewpoint Media Player (HKLM-x32\…\ViewpointMediaPlayer) (Version: - )
Virtual Families (HKLM-x32\…\Virtual Families) (Version: - Spintop Media, Inc)
VLC media player 2.0.8 (HKLM-x32\…\VLC media player) (Version: 2.0.8 - VideoLAN)
VTech Download Agent Library (x32 Version: 1.00.0000 - VTech) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\…\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinZip (HKLM-x32\…\WinZip) (Version: 8.1 (4331) - WinZip Computing, Inc.)
WinZip 16.5 (HKLM\…\{CD95F661-A5C4-44F5-A6AA-ECDD91C240D5}) (Version: 16.5.10096 - WinZip Computing, S.L. )
XBMC (HKCU\…\XBMC) (Version: - Team XBMC)
Yahoo! Messenger (HKLM-x32\…\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Youda Farmer 2: Save the Village (HKLM-x32\…\BFG-Youda Farmer 2 - Save the Village) (Version: - )
Youda Survivor (HKLM-x32\…\BFG-Youda Survivor) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> "C:\Users\Bricks4Kidz\AppData\Local\Facebook\Update\FacebookUpdate.exe" No File
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{4CA41277-032D-4a20-B225-371EBA96ABF2}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{8E590317-1329-11D1-B70B-00805F29CD16}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{C9448C44-BEFB-4941-8457-E5C4314D3D96}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{CD89D352-5A13-49F8-9EB5-7E6D1FB0CD57}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{DB20D0C0-4CEF-11D0-8B17-00AA00211961}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{DB20D0C3-4CEF-11D0-8B17-00AA00211961}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{DEBB9B79-B3DD-47F4-9E5C-EA6975BAB611}\InprocServer32 -> C:\Program Files\Macrium\Reflect\RShellExt.dll (Paramount Software UK Ltd)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{E8ACF719-FFDE-4EE1-8923-48BDA8569FCC}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{FAC93D42-FFC2-11d1-9DEB-0008C7A08EBA}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)

==================== Restore Points =========================

07-08-2014 19:42:06 Windows Update
08-08-2014 23:25:19 Scheduled Checkpoint
10-08-2014 05:00:01 Scheduled Checkpoint
11-08-2014 05:00:02 Scheduled Checkpoint
11-08-2014 20:39:29 Installed Java 7 Update 67
12-08-2014 18:08:56 Windows Update
12-08-2014 21:59:29 Windows Update
14-08-2014 08:37:15 Scheduled Checkpoint
15-08-2014 05:00:11 Scheduled Checkpoint
15-08-2014 22:32:44 Windows Update
17-08-2014 05:00:06 Scheduled Checkpoint
18-08-2014 05:00:01 Scheduled Checkpoint
19-08-2014 05:00:03 Scheduled Checkpoint
20-08-2014 05:19:07 Scheduled Checkpoint
20-08-2014 14:02:03 Windows Update
21-08-2014 06:08:02 Scheduled Checkpoint
22-08-2014 08:13:17 Scheduled Checkpoint
24-08-2014 05:17:24 Scheduled Checkpoint
24-08-2014 06:42:24 Windows Update
25-08-2014 05:00:01 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-11-15 08:14 - 2012-11-15 08:14 - 00000822 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0530C8C5-89DF-4E77-A15D-6E157BC50A9D} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1875D461-928A-4E63-B3A0-0B3BBA6D4517} - System32\Tasks\Carbonite Upgrade Check => C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)
Task: {27B92B80-2A71-4D74-9130-446F87AA29A7} - System32\Tasks\SUPERAntiSpyware Scheduled Task a00d761c-5b80-4a6f-8e41-11857ef8a885 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {48C4B2B0-E286-4232-B6AC-FC0B3758D871} - System32\Tasks\SUPERAntiSpyware Scheduled Task 8b753a4f-7f81-44f0-93e1-52469fd63d88 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {61386F76-22FD-45EF-9506-17932C3171C0} - System32\Tasks\At1 => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {6C8D91FE-1B8D-47BD-BAE8-3991EE1B6A8D} - System32\Tasks\SUPERAntiSpyware Scheduled Task e55b0dc4-9b61-4c31-ade5-7aa4f33ac245 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {80CAF94A-6016-4685-91FD-D6DB2660DFDA} - System32\Tasks\{65229D5F-4F8F-438C-B0CE-31B96F839F8B} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {8195037D-1C70-46E7-93CF-78D7558C8074} - System32\Tasks\SUPERAntiSpyware Scheduled Task 61633aab-dd87-4057-995b-e285d11a22d8 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {947AD995-F787-49F1-B467-97109DF57A10} - \ArcadeFrontier No Task File <==== ATTENTION
Task: {AF282857-380E-4808-8FE6-24EEAE1434E9} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {AFC31899-B403-48E2-9639-35574027F8C2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd)
Task: {C2FA6FBB-E54B-40D3-AE06-C9A488C201B6} - System32\Tasks\Motorola Device Manager Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {C6F3B25F-95B2-4530-B333-A3750263E7B2} - System32\Tasks\SearchGuardPlusUpdater => C:\Program Files\Search Guard PlusU\sgpupdaters.exe
Task: {C9E39A9C-E54F-4F67-AAEC-B24E491935EB} - System32\Tasks\DSite => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {DBDCDD86-C0C5-4C5B-9703-F845C5268852} - System32\Tasks\SUPERAntiSpyware Scheduled Task 496ce132-741c-4714-94e8-e5e2782636c9 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {E7E595C7-4E25-4157-89F5-13D928F59A27} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {E8AF1EB9-E351-4E15-B11D-172C6790BD91} - System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} => C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()
Task: C:\Windows\Tasks\At1.job => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 496ce132-741c-4714-94e8-e5e2782636c9.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 61633aab-dd87-4057-995b-e285d11a22d8.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 8b753a4f-7f81-44f0-93e1-52469fd63d88.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task a00d761c-5b80-4a6f-8e41-11857ef8a885.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e55b0dc4-9b61-4c31-ade5-7aa4f33ac245.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe

==================== Loaded Modules (whitelisted) =============

2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2011-07-01 07:25 - 2011-07-01 07:06 - 00301720 _____ () C:\Program Files\Macrium\Reflect\ReflectService.exe
2013-10-31 10:05 - 2013-10-31 10:05 - 00172032 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\css_core.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00269128 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\boost_regex-vc90-mt-p-1_33.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00021320 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\QBCompressor.dll
2012-06-05 05:56 - 2012-06-05 05:56 - 00059904 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\zlib1.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00380744 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\BackupLib.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00138568 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\QBMAPILibrary.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00176968 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\boost_serialization-vc90-mt-p-1_33.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00042824 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\mbpopup.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:062AF572
AlternateDataStreams: C:\ProgramData\TEMP:09867A8B
AlternateDataStreams: C:\ProgramData\TEMP:0ACF1AF5
AlternateDataStreams: C:\ProgramData\TEMP:0E22C5DB
AlternateDataStreams: C:\ProgramData\TEMP:15E76ABF
AlternateDataStreams: C:\ProgramData\TEMP:30DA8392
AlternateDataStreams: C:\ProgramData\TEMP:38FF076E
AlternateDataStreams: C:\ProgramData\TEMP:6C08335F
AlternateDataStreams: C:\ProgramData\TEMP:7E927D7D
AlternateDataStreams: C:\ProgramData\TEMP:8C12CFCD
AlternateDataStreams: C:\ProgramData\TEMP:8F067037
AlternateDataStreams: C:\ProgramData\TEMP:92EDCBF3
AlternateDataStreams: C:\ProgramData\TEMP:98DFF516
AlternateDataStreams: C:\ProgramData\TEMP:9ACB70D7
AlternateDataStreams: C:\ProgramData\TEMP:A31FAD21
AlternateDataStreams: C:\ProgramData\TEMP:ACCFA538
AlternateDataStreams: C:\ProgramData\TEMP:B8AF0F0F
AlternateDataStreams: C:\ProgramData\TEMP:D2C51E3D
AlternateDataStreams: C:\ProgramData\TEMP:E222F217
AlternateDataStreams: C:\ProgramData\TEMP:E5BA9ADD
AlternateDataStreams: C:\ProgramData\TEMP:EA7D76BE
AlternateDataStreams: C:\ProgramData\TEMP:EE7AAC75
AlternateDataStreams: C:\ProgramData\TEMP:F0A06891
AlternateDataStreams: C:\ProgramData\TEMP:F5FC5DCE

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\plsapp => ""="service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Calendar Sync.lnk => C:\Windows\pss\Google Calendar Sync.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Bricks4Kidz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dell Dock.lnk => C:\Windows\pss\Dell Dock.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Bricks4Kidz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AOL Fast Start => "C:\Program Files (x86)\AOL Desktop 9.7a\AOL.EXE" -b
MSCONFIG\startupreg: DellSystemDetect => C:\Users\kevin\AppData\Local\Apps\2.0\OCH5ML9H.C03\Y6EDNOEO.6VT\dell..tion_0f612f649c4a10af_0005.0007_59de4fd2458fcaec\DellSystemDetect.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Bricks4Kidz\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: FlashPlayerUpdate => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe -update plugin
MSCONFIG\startupreg: googletalk => C:\Users\kevin\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
MSCONFIG\startupreg: HostManager => "C:\Program Files (x86)\Common Files\AOL\1232141495\ee\AOLSoftware.exe"
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
MSCONFIG\startupreg: OfficeSyncProcess => "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: RtHDVCpl => RAVCpl64.exe
MSCONFIG\startupreg: Skytel => Skytel.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (08/25/2014 06:36:07 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/25/2014 06:36:07 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/25/2014 06:36:07 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/25/2014 06:32:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2014 09:04:42 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/25/2014 09:04:42 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/25/2014 09:04:42 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/24/2014 09:18:38 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/24/2014 09:18:38 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/24/2014 09:18:38 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

System errors:
=============
Error: (08/25/2014 06:32:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep
uezndl

Error: (08/25/2014 06:31:45 PM) (Source: HTTP) (EventID: 15021) (User: )
Description: \Device\Http\ReqQueue0.0.0.0:4482

Error: (08/24/2014 06:35:13 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}

Error: (08/23/2014 07:39:50 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep
uezndl

Error: (08/23/2014 07:38:34 AM) (Source: HTTP) (EventID: 15021) (User: )
Description: \Device\Http\ReqQueue0.0.0.0:4482

Error: (08/22/2014 07:40:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep
uezndl

Error: (08/22/2014 07:39:11 AM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)
Description: The print spooler failed to share printer Xerox ColorQube 8570DN PS with shared resource name Xerox ColorQube 8570DN PS. Error 2114. The printer cannot be used by others on the network.

Error: (08/22/2014 07:38:58 AM) (Source: HTTP) (EventID: 15021) (User: )
Description: \Device\Http\ReqQueue0.0.0.0:4482

Error: (08/19/2014 08:51:23 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep
uezndl

Error: (08/19/2014 08:50:37 AM) (Source: HTTP) (EventID: 15021) (User: )
Description: \Device\Http\ReqQueue0.0.0.0:4482

Microsoft Office Sessions:
=========================
Error: (08/25/2014 06:36:07 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/25/2014 06:36:07 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/25/2014 06:36:07 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/25/2014 06:32:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2014 09:04:42 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/25/2014 09:04:42 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/25/2014 09:04:42 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/24/2014 09:18:38 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/24/2014 09:18:38 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/24/2014 09:18:38 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

CodeIntegrity Errors:
===================================
Date: 2014-08-25 18:45:05.653
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:45:05.387
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:45:05.150
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:45:04.914
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:45:04.416
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:45:04.175
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:45:03.926
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:45:03.611
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:44:34.247
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-25 18:44:34.012
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 50%
Total physical RAM: 4084.27 MB
Available physical RAM: 2040.27 MB
Total Pagefile: 8383.81 MB
Available Pagefile: 6139.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:901.41 GB) (Free:515.31 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:30 GB) (Free:23.73 GB) NTFS
Drive e: (New Volume) (Fixed) (Total:465.76 GB) (Free:419.36 GB) NTFS
Drive f: (files backup) (Fixed) (Total:232.88 GB) (Free:77.96 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 00DA9FEA)
Partition 1: (Not Active) - (Size=232.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 5BB1415C)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: C871F750)
Partition 1: (Not Active) - (Size=110 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=30 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=901.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Here is the FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 01
Ran by [removed] (administrator) on CZARNOTA-FAMILY on 25-08-2014 18:44:23
Running from C:\Users\[removed]\Desktop
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Windows\System32\AERTSr64.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
(Carbonite, Inc. (www.carbonite.com)) C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
() C:\Program Files\Macrium\Reflect\ReflectService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\aol\1232141495\ee\aolsoftware.exe
(Carbonite, Inc.) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(Intuit Inc.) C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE
(Stoic Joker's Network) C:\Program Files (x86)\Tclock\tclock-x64\Clock.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKLM-x32\…\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [2829624 2013-11-08] (Intuit Inc. All rights reserved.)
HKLM-x32\…\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1232141495\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.)
HKLM-x32\…\Run: [Carbonite Backup] => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe [1056976 2014-06-27] (Carbonite, Inc.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\…\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7762712 2014-08-12] (SUPERAntiSpyware)
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [KSS] => "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (No File)
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
ShortcutTarget: OpenOffice.org 3.0.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stoic Joker's T-Clock x64.lnk
ShortcutTarget: Stoic Joker's T-Clock x64.lnk -> C:\Program Files (x86)\Tclock\tclock-x64\Clock.exe (Stoic Joker's Network)
ShellIconOverlayIdentifiers: Carbonite.Green -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers: Carbonite.Partial -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers: Carbonite.Yellow -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Green -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Partial -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Yellow -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.techsupportalert.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form;=MSSEDF&pc;=MSSE
SearchScopes: HKLM-x32 - {32564CED-2EF8-466A-900C-38D268CF8C4A} URL = http://ws.infospace.com/playsushi_tbar/ws/redir?_iceUrl=true&tool;_id=58485&qkw;={searchTerms}
SearchScopes: HKLM-x32 - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form;=MSSEDF&pc;=MSSE
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&q;={searchTerms}
SearchScopes: HKLM-x32 - {CF739809-1C6C-47C0-85B9-569DBB141420} URL = http://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct;=&gc;=1&q;={searchTerms}&crm;=1
SearchScopes: HKCU - DefaultScope {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?p={searchTerms}&fr;=chr-iobit
SearchScopes: HKCU - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form;=MSSEDF&pc;=MSSE
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&q;={searchTerms}
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?p={searchTerms}&fr;=chr-iobit
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {0AD584EB-F10F-46F7-BCB8-1085C386BEAE} https://merchantaccount.quickbooks.com/recurchrg/IntuitRecurPayCom2009.cab
DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Virtual%20Families/Images/stg_drm.ocx
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {5C709EEC-DDE1-4738-8E57-7564E2637891} https://merchantaccount.quickbooks.com/sync/QBMASSyncCom1_2009.cab
DPF: HKLM-x32 {788539E8-002D-4E59-9089-40B694A99C9A} https://merchantaccount.quickbooks.com/sync/QBMASSyncCom2_2008.cab
DPF: HKLM-x32 {8714912E-380D-11D5-B8AA-00D0B78F3D48} http://chat.yahoo.com/cab/yuplapp.cab
DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB
DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Peggle/Images/armhelper.ocx
Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - No File
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] [removed] [removed]

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default
FF NewTab: hxxp://search.conduit.com/?gd=&ctid;=CT3322520&octid;=EB_ORIGINAL_CTID&ISID;=MF9C46A2D-B58E-4307-8C64-2AC84FADB334&SearchSource;=69&CUI;=&SSPV;=&Lay;=1&UM;=5&UP;=SPAAA5301C-389E-4EEF-982A-A061C2714527
FF Homepage: hxxp://www.techsupportalert.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MI1933~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin-x32: @ei.Retrogamer_4w.com/Plugin -> C:\Program Files (x86)\Retrogamer_4wEI\Installr\1.bin\NP4wEISB.dll (Retrogamer)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @viewpoint.com/VMP -> C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF Plugin-x32: @virtools.com/3DviaPlayer -> C:\Program Files (x86)\Virtools\3D Life Player\npvirtools.dll (Dassault Systèmes)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol500.dll (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\kevin\AppData\Roaming\mozilla\plugins\np-mswmp.dll (Microsoft Corporation)
FF Extension: LogMeIn, Inc. Remote Access Plugin - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2014-06-07]
FF Extension: ArcadeFrontier - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{1a68cbde-3e4c-4fae-bf49-af5ab9868e53} [2014-05-06]
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}-trash [2011-03-09]
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-19]
FF Extension: IE View Lite - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3} [2009-09-14]
FF Extension: SkipScreen - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2011-07-16]
FF Extension: WikiLook - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2011-07-23]
FF Extension: ALLYouTubeDownloader - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2012-09-22]
FF Extension: Flash Block - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{95ab36d4-fb6f-47b0-8b8d-e5f3bd547953}.xpi [2014-08-02]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] [2014-07-30]
FF HKLM-x32\…\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-11-20]

Chrome:
=======
CHR Profile: C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-12] (SUPERAntiSpyware.com)
R2 AERTFilters; C:\Windows\system32\AERTSr64.exe [86016 2008-07-28] (Andrea Electronics Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [173344 2007-02-06] (Logitech Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed]
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2013-11-08] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2012-06-05] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2012-06-05] (Intuit Inc.) [File not signed]
R2 ReflectService; C:\Program Files\Macrium\Reflect\ReflectService.exe [301720 2011-07-01] ()
S3 ShowAnalyzerMaster; C:\Program Files (x86)\Dragon Global\ShowAnalyzerSuite\ShowAnalyzerMaster.exe [2074112 2010-02-08] (Dragon Global) [File not signed]
S3 WinDefend; %ProgramFiles(x86)%\Windows Defender\mpsvc.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)
R3 ATIAVPCI; C:\Windows\System32\DRIVERS\atinavrr.sys [1557376 2009-11-04] (ATI Technologies Inc.)
S1 AuviPCI; C:\Windows\System32\DRIVERS\AuviPCI64.sys [1771776 2009-06-30] (Auvitek Corp.) [File not signed]
S1 Beep; No ImagePath
S3 FlyUsb; C:\Windows\System32\DRIVERS\FlyUsb.sys [24576 2007-06-18] (LeapFrog)
R1 GizmoDrv; C:\Windows\System32\Drivers\GizmoDrv.sys [34704 2011-05-30] (Arainia Solutions LLC)
S3 LVcKap64; C:\Windows\System32\DRIVERS\LVcKap64.sys [1013024 2007-02-06] (Logitech Inc.)
S3 LVMVDrv; C:\Windows\System32\DRIVERS\LVMVDrv.sys [2346016 2007-02-06] (Logitech Inc.)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [31520 2007-02-06] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S3 PSMounter; C:\Windows\system32\drivers\psmounter.sys [40600 2011-07-01] (Macrium Software)
S3 PSVolAcc; C:\Windows\System32\Drivers\PSVolAcc.sys [13464 2011-07-01] (Paramount Software UK Ltd)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-08-03] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-08-03] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SQTECH9052; C:\Windows\System32\Drivers\Capt9052.sys [47680 2008-02-21] (Service & Quality Technology.)
S3 SQTECH905C; C:\Windows\System32\Drivers\Capt905c.sys [44480 2007-05-02] (Service & Quality Technology.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-07-17] ()
S0 uezndl; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-25 18:44 - 2014-08-25 18:44 - 00024372 _____ () C:\Users\kevin\Desktop\FRST.txt
2014-08-25 18:42 - 2014-08-25 18:44 - 00000000 ____D () C:\FRST
2014-08-25 18:42 - 2014-08-25 18:42 - 02103296 _____ (Farbar) C:\Users\kevin\Desktop\FRST64.exe
2014-08-25 18:31 - 2014-08-25 18:31 - 00464632 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 18:30 - 2014-08-25 18:30 - 00157188 _____ () C:\Windows\PFRO.log
2014-08-25 17:56 - 2014-08-25 18:32 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 17:56 - 2014-08-25 17:56 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-25 17:56 - 2014-08-25 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2014-08-25 17:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-25 17:55 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-25 17:55 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-25 17:54 - 2014-08-25 17:54 - 00002596 _____ () C:\Users\kevin\Desktop\aswMBR.txt
2014-08-25 09:12 - 2014-08-25 17:54 - 00000512 _____ () C:\Users\kevin\Desktop\MBR.dat
2014-08-25 09:10 - 2014-08-25 09:10 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\kevin\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-25 09:06 - 2014-08-25 09:06 - 05185536 _____ (AVAST Software) C:\Users\kevin\Desktop\aswMBR.exe
2014-08-24 16:09 - 2014-08-24 16:09 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(6).exe
2014-08-24 16:04 - 2014-08-24 16:04 - 00079991 _____ () C:\Users\Bricks4Kidz\Downloads\silverlight.diagcab
2014-08-24 15:36 - 2014-08-24 15:36 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(5).exe
2014-08-24 08:23 - 2014-08-24 08:23 - 00113776 _____ () C:\Users\kevin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 19:00 - 2014-08-23 19:00 - 00000000 ____D () C:\a3f5a5774bf4325b38922cfb
2014-08-23 18:57 - 2014-08-23 18:57 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(4).exe
2014-08-23 18:56 - 2014-08-23 18:56 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(3).exe
2014-08-22 21:07 - 2014-08-24 19:56 - 00013891 _____ () C:\Users\Bricks4Kidz\Documents\school distance.xlsx
2014-08-22 13:49 - 2014-08-22 13:51 - 76699734 _____ () C:\Users\Bricks4Kidz\Downloads\NXT_Tutorial.zip
2014-08-19 11:28 - 2014-08-19 22:14 - 00013934 _____ () C:\Users\Bricks4Kidz\Documents\09-2014SceduleAll.xlsx
2014-08-12 17:01 - 2014-06-26 17:17 - 01389200 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-12 17:01 - 2014-06-26 17:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-12 17:01 - 2014-06-26 17:17 - 00171152 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00008848 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-12 17:00 - 2014-06-05 23:29 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-12 17:00 - 2014-06-05 23:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-12 16:59 - 2014-07-24 14:28 - 17861120 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-12 16:59 - 2014-07-24 14:12 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-12 16:59 - 2014-07-24 14:10 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-12 16:59 - 2014-07-24 14:07 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-12 16:59 - 2014-07-24 14:06 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-12 16:59 - 2014-07-24 14:05 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-12 16:59 - 2014-07-24 14:05 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-08-12 16:59 - 2014-07-24 14:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 02155520 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-12 16:59 - 2014-07-24 14:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-12 16:59 - 2014-07-24 14:03 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-08-12 16:59 - 2014-07-24 14:03 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-08-12 16:59 - 2014-07-24 14:02 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-12 16:59 - 2014-07-24 13:07 - 12356608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-12 16:59 - 2014-07-24 12:58 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-12 16:59 - 2014-07-24 12:57 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-12 16:59 - 2014-07-24 12:52 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-12 16:59 - 2014-07-24 12:51 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-12 16:59 - 2014-07-24 12:51 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-12 16:59 - 2014-07-24 12:50 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-08-12 16:59 - 2014-07-24 12:50 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-12 16:59 - 2014-07-24 12:48 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-12 16:59 - 2014-07-24 12:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-08-12 16:59 - 2014-07-24 12:48 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-08-12 16:59 - 2014-07-24 12:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-12 16:58 - 2014-07-24 23:27 - 00304128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-12 16:58 - 2014-07-24 23:18 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-12 16:58 - 2014-07-24 22:15 - 02781696 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-12 16:58 - 2014-07-07 20:12 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-12 16:58 - 2014-07-07 19:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-12 16:58 - 2014-06-13 19:56 - 00901568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-12 16:58 - 2014-06-13 19:51 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-12 16:57 - 2014-06-02 16:30 - 03137536 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-12 16:56 - 2014-06-02 16:30 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-12 16:56 - 2014-06-02 16:29 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-12 16:56 - 2014-06-02 16:29 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-08-12 16:56 - 2014-06-02 15:29 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-12 16:56 - 2014-06-02 05:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-12 16:56 - 2014-06-02 05:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-12 16:56 - 2014-06-02 05:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-11 15:41 - 2014-07-25 12:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-11 15:41 - 2014-07-25 12:49 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-11 15:41 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-11 15:41 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-11 15:40 - 2014-08-11 15:41 - 00005618 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-11 15:37 - 2014-08-11 15:38 - 00918952 _____ (Oracle Corporation) C:\Users\kids\Downloads\jxpiinstall(3).exe
2014-08-02 20:38 - 2014-08-02 20:38 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\New Folder
2014-07-30 20:37 - 2014-07-30 20:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-30 18:45 - 2014-07-30 18:45 - 00004170 _____ () C:\Windows\System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4}
2014-07-30 18:45 - 2014-07-30 18:45 - 00001969 _____ () C:\Users\Public\Desktop\Carbonite InfoCenter.lnk
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files (x86)\Carbonite
2014-07-30 16:53 - 2014-08-15 08:17 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\XBMC
2014-07-30 16:41 - 2014-07-30 16:41 - 00375958 _____ () C:\Users\kevin\AppData\Local\dd_vcredistMSI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00011190 _____ () C:\Users\kevin\AppData\Local\dd_vcredistUI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XBMC
2014-07-27 20:54 - 2014-07-29 07:56 - 00009628 _____ () C:\Users\Bricks4Kidz\Documents\Leigh Brown Camp Payment Rate.xlsx
2014-07-27 09:51 - 2014-07-27 09:51 - 00009412 _____ () C:\Users\Bricks4Kidz\Documents\MinfigureCostFromLego.xlsx

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-25 18:44 - 2014-08-25 18:44 - 00024372 _____ () C:\Users\kevin\Desktop\FRST.txt
2014-08-25 18:44 - 2014-08-25 18:42 - 00000000 ____D () C:\FRST
2014-08-25 18:42 - 2014-08-25 18:42 - 02103296 _____ (Farbar) C:\Users\kevin\Desktop\FRST64.exe
2014-08-25 18:38 - 2006-11-02 10:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-25 18:38 - 2006-11-02 10:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-25 18:37 - 2014-04-30 18:48 - 01311675 _____ () C:\Windows\WindowsUpdate.log
2014-08-25 18:35 - 2010-12-26 22:17 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-08-25 18:34 - 2010-04-26 13:58 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-08-25 18:32 - 2014-08-25 17:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 18:32 - 2009-01-16 16:20 - 00000000 ____D () C:\TEMP
2014-08-25 18:31 - 2014-08-25 18:31 - 00464632 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 18:31 - 2006-11-02 10:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-25 18:30 - 2014-08-25 18:30 - 00157188 _____ () C:\Windows\PFRO.log
2014-08-25 18:28 - 2006-11-02 10:42 - 00032598 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-25 18:27 - 2011-10-31 11:36 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Outlook Files
2014-08-25 18:24 - 2013-02-17 13:37 - 00000000 ____D () C:\Users\Bricks4Kidz\AppData\Roaming\DSite
2014-08-25 17:56 - 2014-08-25 17:56 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-25 17:56 - 2014-08-25 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-25 17:56 - 2014-08-25 17:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2012-03-22 10:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 17:54 - 2014-08-25 17:54 - 00002596 _____ () C:\Users\kevin\Desktop\aswMBR.txt
2014-08-25 17:54 - 2014-08-25 09:12 - 00000512 _____ () C:\Users\kevin\Desktop\MBR.dat
2014-08-25 12:02 - 2014-04-03 16:49 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e55b0dc4-9b61-4c31-ade5-7aa4f33ac245.job
2014-08-25 09:10 - 2014-08-25 09:10 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\kevin\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-25 09:06 - 2014-08-25 09:06 - 05185536 _____ (AVAST Software) C:\Users\kevin\Desktop\aswMBR.exe
2014-08-25 03:02 - 2014-02-09 15:42 - 00000510 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task a00d761c-5b80-4a6f-8e41-11857ef8a885.job
2014-08-25 02:00 - 2014-02-09 15:42 - 00000510 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 8b753a4f-7f81-44f0-93e1-52469fd63d88.job
2014-08-25 01:00 - 2012-12-08 13:13 - 00000562 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 496ce132-741c-4714-94e8-e5e2782636c9.job
2014-08-25 00:55 - 2012-12-08 13:13 - 00000562 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 61633aab-dd87-4057-995b-e285d11a22d8.job
2014-08-24 21:12 - 2011-10-31 11:32 - 00002643 _____ () C:\Users\Bricks4Kidz\Desktop\Microsoft Outlook 2010.lnk
2014-08-24 19:56 - 2014-08-22 21:07 - 00013891 _____ () C:\Users\Bricks4Kidz\Documents\school distance.xlsx
2014-08-24 16:09 - 2014-08-24 16:09 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(6).exe
2014-08-24 16:04 - 2014-08-24 16:04 - 00079991 _____ () C:\Users\Bricks4Kidz\Downloads\silverlight.diagcab
2014-08-24 15:36 - 2014-08-24 15:36 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(5).exe
2014-08-24 08:23 - 2014-08-24 08:23 - 00113776 _____ () C:\Users\kevin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 19:00 - 2014-08-23 19:00 - 00000000 ____D () C:\a3f5a5774bf4325b38922cfb
2014-08-23 18:57 - 2014-08-23 18:57 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(4).exe
2014-08-23 18:56 - 2014-08-23 18:56 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(3).exe
2014-08-23 08:51 - 2009-01-16 15:22 - 00000000 ____D () C:\Users\kevin
2014-08-23 07:59 - 2011-02-26 11:29 - 00000000 ____D () C:\Users\kevin\Desktop\highjackthis
2014-08-23 07:59 - 2009-01-16 15:22 - 00000000 ____D () C:\Users\kevin\AppData\Local\VirtualStore
2014-08-22 15:02 - 2012-03-05 08:40 - 00002637 _____ () C:\Users\Bricks4Kidz\Desktop\Microsoft Word 2010.lnk
2014-08-22 13:51 - 2014-08-22 13:49 - 76699734 _____ () C:\Users\Bricks4Kidz\Downloads\NXT_Tutorial.zip
2014-08-22 12:00 - 2012-04-09 07:10 - 00000000 ____D () C:\Users\Bricks4Kidz\AppData\Roaming\vlc
2014-08-22 11:57 - 2011-12-20 14:16 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Mindstorm
2014-08-21 20:14 - 2011-10-29 21:30 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Receipts
2014-08-21 18:26 - 2013-01-13 22:13 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\BirthdayParties
2014-08-19 22:14 - 2014-08-19 11:28 - 00013934 _____ () C:\Users\Bricks4Kidz\Documents\09-2014SceduleAll.xlsx
2014-08-18 19:56 - 2011-10-28 16:07 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Legal
2014-08-18 03:34 - 2013-01-21 17:48 - 00000000 ____D () C:\Users\Bricks4Kidz\AppData\Roaming\.minecraft
2014-08-17 20:28 - 2014-07-21 21:42 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\BBVACompassOpenPositions7.14.14
2014-08-16 08:23 - 2006-11-02 07:46 - 00763610 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-15 08:17 - 2014-07-30 16:53 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\XBMC
2014-08-12 17:42 - 2006-11-02 08:33 - 00000000 ____D () C:\Windows\rescache
2014-08-12 17:15 - 2013-07-11 23:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-12 17:09 - 2006-11-02 07:35 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-12 06:43 - 2011-10-23 20:40 - 00000000 ____D () C:\Users\Bricks4Kidz
2014-08-11 15:47 - 2009-11-22 12:58 - 00000000 ____D () C:\Users\kids\AppData\Roaming\AOL
2014-08-11 15:47 - 2009-01-26 15:07 - 00000000 ____D () C:\Users\kids\AppData\Local\AOL
2014-08-11 15:42 - 2013-10-15 17:33 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-11 15:41 - 2014-08-11 15:40 - 00005618 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-11 15:41 - 2009-01-14 00:31 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-11 15:38 - 2014-08-11 15:37 - 00918952 _____ (Oracle Corporation) C:\Users\kids\Downloads\jxpiinstall(3).exe
2014-08-09 09:19 - 2012-08-12 13:19 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Artwork-blankFlyers
2014-08-08 16:15 - 2009-09-24 09:43 - 00000000 ____D () C:\Users\Carla\AppData\Roaming\vlc
2014-08-07 16:40 - 2013-04-23 00:20 - 00000680 _____ () C:\Users\Bricks4Kidz\AppData\Local\d3d9caps.dat
2014-08-06 20:04 - 2011-10-24 09:37 - 00024576 _____ () C:\Users\Bricks4Kidz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-02 20:39 - 2012-04-14 07:03 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\games
2014-08-02 20:38 - 2014-08-02 20:38 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\New Folder
2014-08-01 14:30 - 2012-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-31 20:01 - 2012-12-04 20:11 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Labels
2014-07-31 15:04 - 2012-07-27 13:52 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Invoices
2014-07-30 20:38 - 2014-07-30 20:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-30 18:45 - 2014-07-30 18:45 - 00004170 _____ () C:\Windows\System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4}
2014-07-30 18:45 - 2014-07-30 18:45 - 00001969 _____ () C:\Users\Public\Desktop\Carbonite InfoCenter.lnk
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files (x86)\Carbonite
2014-07-30 16:41 - 2014-07-30 16:41 - 00375958 _____ () C:\Users\kevin\AppData\Local\dd_vcredistMSI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00011190 _____ () C:\Users\kevin\AppData\Local\dd_vcredistUI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XBMC
2014-07-30 16:41 - 2011-03-11 12:59 - 00000000 ____D () C:\Program Files (x86)\XBMC
2014-07-29 07:56 - 2014-07-27 20:54 - 00009628 _____ () C:\Users\Bricks4Kidz\Documents\Leigh Brown Camp Payment Rate.xlsx
2014-07-28 23:11 - 2013-07-06 10:15 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\StopMotion
2014-07-27 09:51 - 2014-07-27 09:51 - 00009412 _____ () C:\Users\Bricks4Kidz\Documents\MinfigureCostFromLego.xlsx

Files to move or delete:
====================
C:\Windows\Tasks\At1.job

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-08-25 18:40

==================== End Of Log ============================

Thanks for your help.

ken545

Post #5August 26, 2014, 1:52 AM UTC

Hi,

You have Microsoft Security Essentials and also Kaspersky Anti Virus, you only need one so uninstall on via Programs and Features in the Control Panel. Most times running more than one AV can hamper system performance

Open notepad (Start =>All Programs => Accessories => Notepad).

Please copy the entire contents of the code box below.

(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).

Save it to the same directory as frst.exe (or frst64.exe) as fixlist.txt. (it has to be right next to FRST/64) either in a directory you saved frst.exe (or frst64.exe)or on your desktop if thats where you saved it

Start

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearsh…q={searchTerms}

SearchScopes: HKLM-x32 - {CF739809-1C6C-47C0-85B9-569DBB141420} URL = http://toolbar.ask.c…rchTerms}&crm=1

SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearsh…q={searchTerms}

FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3322520&octid=EB_ORIGINAL_CTID&ISID=MF9C46A2D-B58E-4307-8C64-2AC84FADB334&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SPAAA5301C-389E-4EEF-982A-A061C2714527

Task: {61386F76-22FD-45EF-9506-17932C3171C0} - System32\Tasks\At1 => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {947AD995-F787-49F1-B467-97109DF57A10} - \ArcadeFrontier No Task File <==== ATTENTION

Task: {C9E39A9C-E54F-4F67-AAEC-B24E491935EB} - System32\Tasks\DSite => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\At1.job => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

C:\Windows\Tasks\At1.job

Hosts:

EmptyTemp:

End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Then open FRST64 and click on fix

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

===========================================================

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner

Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Do not click on any links in the top Advertisment.

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click on Scan.

After the scan is complete click on "Clean"

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the content of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

kevin_czarnota

Post #6August 26, 2014, 2:58 PM UTC

Here is fixlog.

Thanks for help.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-08-2014 01
Ran by [removed] at 2014-08-26 09:25:56 Run:1
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************

    Start
    SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearsh…q={searchTerms}
    SearchScopes: HKLM-x32 - {CF739809-1C6C-47C0-85B9-569DBB141420} URL = http://toolbar.ask.c…rchTerms}&crm=1
    SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearsh…q={searchTerms}
    FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3322520&octid=EB_ORIGINAL_CTID&ISID=MF9C46A2D-B58E-4307-8C64-2AC84FADB334&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SPAAA5301C-389E-4EEF-982A-A061C2714527
    Task: {61386F76-22FD-45EF-9506-17932C3171C0} - System32\Tasks\At1 => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
    Task: {947AD995-F787-49F1-B467-97109DF57A10} - \ArcadeFrontier No Task File <==== ATTENTION
    Task: {C9E39A9C-E54F-4F67-AAEC-B24E491935EB} - System32\Tasks\DSite => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
    Task: C:\Windows\Tasks\At1.job => C:\Users\BRICKS~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
    C:\Windows\Tasks\At1.job
    Hosts:
    EmptyTemp:
    End

*****************

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{CF739809-1C6C-47C0-85B9-569DBB141420}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}" => Key deleted successfully.
"HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}" => Key not found.
Firefox newtab deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{61386F76-22FD-45EF-9506-17932C3171C0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{61386F76-22FD-45EF-9506-17932C3171C0}" => Key deleted successfully.
C:\Windows\System32\Tasks\At1 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\At1" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{947AD995-F787-49F1-B467-97109DF57A10}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{947AD995-F787-49F1-B467-97109DF57A10}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ArcadeFrontier" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C9E39A9C-E54F-4F67-AAEC-B24E491935EB}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C9E39A9C-E54F-4F67-AAEC-B24E491935EB}" => Key deleted successfully.
C:\Windows\System32\Tasks\DSite => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DSite" => Key deleted successfully.
C:\Windows\Tasks\At1.job => Moved successfully.
"C:\Windows\Tasks\At1.job" => File/Directory not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 785.8 MB temporary data.

The system needed a reboot.

==== End of Fixlog ====

Working on next item in previous reply.

kevin_czarnota

Post #7August 26, 2014, 3:12 PM UTC

Here is the adwcleaner log file:

# AdwCleaner v3.308 - Report created 26/08/2014 at 10:02:16
# Updated 20/08/2014 by Xplode
# Operating System : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# Username : kevin - CZARNOTA-FAMILY
# Running from : C:\Users\kevin\Desktop\adwcleaner_3.308.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

[!] Folder Deleted : C:\ProgramData\NCH Software
[!] Folder Deleted : C:\ProgramData\ParetoLogic
[!] Folder Deleted : C:\ProgramData\quickclick
[!] Folder Deleted : C:\ProgramData\Viewpoint
[!] Folder Deleted : C:\Program Files (x86)\Around the world in 80 days
[!] Folder Deleted : C:\Program Files (x86)\NCH Software
[!] Folder Deleted : C:\Program Files (x86)\Viewpoint
[!] Folder Deleted : C:\Users\Bricks4Kidz\AppData\Local\visi_coupon
[!] Folder Deleted : C:\Users\Bricks4Kidz\AppData\LocalLow\Delta
[!] Folder Deleted : C:\Users\Bricks4Kidz\AppData\Roaming\DSite
[!] Folder Deleted : C:\Users\Bricks4Kidz\AppData\Roaming\Strongvault
[!] Folder Deleted : C:\Users\kevin\AppData\Local\PackageAware
[!] Folder Deleted : C:\Users\kevin\AppData\Local\visi_coupon
[!] Folder Deleted : C:\Users\kevin\AppData\Roaming\DriverCure
[!] Folder Deleted : C:\Users\kevin\AppData\Roaming\NCH Software
[!] Folder Deleted : C:\Users\kids\AppData\Local\PackageAware
[!] Folder Deleted : C:\Users\kids\AppData\Local\visi_coupon
[!] Folder Deleted : C:\Users\Carla\AppData\Roaming\Mozilla\Firefox\Profiles\cb73nuv0.default\FCTB
[!] Folder Deleted : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Conduit
[!] Folder Deleted : C:\Users\Bricks4Kidz\AppData\Roaming\Mozilla\Firefox\Profiles\c0iibkez.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[!] Folder Deleted : C:\Program Files (x86)\Mozilla Firefox\Extensions\[removed]
File Deleted : C:\END
File Deleted : C:\Program Files (x86)\Mozilla Firefox\Components\AskSearch.js
File Deleted : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\invalidprefs.js
File Deleted : C:\Users\Carla\AppData\Roaming\Mozilla\Firefox\Profiles\cb73nuv0.default\searchplugins\mywebsearch.xml
File Deleted : C:\Users\Bricks4Kidz\AppData\Roaming\Mozilla\Firefox\Profiles\c0iibkez.default\user.js
File Deleted : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\user.js

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\BHO.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\PSText.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Key Deleted : HKCU\Software\59ed98be235b942
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{055069F3-F78B-4BD1-A277-FE66648D3300}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{E89A07B5-BD7A-43F9-BDA4-0DAA48AC4FA5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ParetoLogic
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\PlaySushi
Key Deleted : HKCU\Software\AppDataLow\Software\bearsharemediabartb
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Freeze.com
Key Deleted : HKLM\SOFTWARE\MetaStream
Key Deleted : HKLM\SOFTWARE\PIP
Key Deleted : HKLM\SOFTWARE\Viewpoint
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Ask Toolbar_is1
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\I Want This
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\mywebsearch bar uninstall
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PlaySushi
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Search Guard Plus Updater
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Search Guard Plus
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer
Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16563

-\\ Mozilla Firefox v31.0 (x86 en-US)

[ File : C:\Users\Bricks4Kidz\AppData\Roaming\Mozilla\Firefox\Profiles\c0iibkez.default\prefs.js ]

Line Deleted : user_pref("extensions.sahtb.url.prefs.data", "\r\n \r\n
[ File : C:\Users\Bricks4Kidz\AppData\Roaming\Mozilla\Firefox\Profiles\lpmzhq9a.default-1385303025077\prefs.js ]

[ File : C:\Users\Carla\AppData\Roaming\Mozilla\Firefox\Profiles\cb73nuv0.default\prefs.js ]

Line Deleted : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[…]
Line Deleted : user_pref("extensions.enabledAddons", "moveplayer%40movenetworks.com:1.0.0.071303000006,crossriderapp2258%40crossrider.com:0.93.147,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:31.0");

[ File : C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pi94zynj.default\prefs.js ]

[ File : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\prefs.js ]

Line Deleted : user_pref("CT2354614.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Line Deleted : user_pref("CT2354614.CTID", "CT2354614");
Line Deleted : user_pref("CT2354614.CurrentServerDate", "12-4-2010");
Line Deleted : user_pref("CT2354614.DialogsAlignMode", "LTR");
Line Deleted : user_pref("CT2354614.ExternalComponentPollDate129034476366350537", "Sun Apr 11 2010 16:06:14 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.ExternalComponentPollDate129039750747456367", "Sun Apr 11 2010 16:06:14 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.FirstServerDate", "12-4-2010");
Line Deleted : user_pref("CT2354614.FirstTime", true);
Line Deleted : user_pref("CT2354614.FirstTimeFF3", true);
Line Deleted : user_pref("CT2354614.GroupingServerCheckInterval", 1440);
Line Deleted : user_pref("CT2354614.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Line Deleted : user_pref("CT2354614.Initialize", true);
Line Deleted : user_pref("CT2354614.InitializeCommonPrefs", true);
Line Deleted : user_pref("CT2354614.InstalledDate", "Sun Apr 11 2010 16:06:15 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.InvalidateCache", false);
Line Deleted : user_pref("CT2354614.IsGrouping", false);
Line Deleted : user_pref("CT2354614.IsMulticommunity", false);
Line Deleted : user_pref("CT2354614.IsOpenThankYouPage", true);
Line Deleted : user_pref("CT2354614.IsOpenUninstallPage", true);
Line Deleted : user_pref("CT2354614.LanguagePackLastCheckTime", "Sun Apr 11 2010 16:06:15 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.LanguagePackReloadIntervalMM", 1440);
Line Deleted : user_pref("CT2354614.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
Line Deleted : user_pref("CT2354614.LastLogin_2.5.8.6", "Sun Apr 11 2010 16:06:30 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.LatestVersion", "2.1.0.18");
Line Deleted : user_pref("CT2354614.Locale", "en");
Line Deleted : user_pref("CT2354614.LoginCache", 4);
Line Deleted : user_pref("CT2354614.MCDetectTooltipHeight", "83");
Line Deleted : user_pref("CT2354614.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Line Deleted : user_pref("CT2354614.MCDetectTooltipWidth", "295");
Line Deleted : user_pref("CT2354614.RadioIsPodcast", false);
Line Deleted : user_pref("CT2354614.RadioLastCheckTime", "Sun Apr 11 2010 16:06:14 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.RadioLastUpdateIPServer", "3");
Line Deleted : user_pref("CT2354614.RadioLastUpdateServer", "3");
Line Deleted : user_pref("CT2354614.RadioMediaID", "9905");
Line Deleted : user_pref("CT2354614.RadioMediaType", "Media Player");
Line Deleted : user_pref("CT2354614.RadioMenuSelectedID", "EBRadioMenu_CT2354614_RECENT9905");
Line Deleted : user_pref("CT2354614.RadioShrinked", "shrinked");
Line Deleted : user_pref("CT2354614.RadioStationName", "1.FM%20(Modern%20Rock)");
Line Deleted : user_pref("CT2354614.RadioStationURL", "hxxp://www.1.fm/TuneIn/WM/energyX128k/Listen.aspx");
Line Deleted : user_pref("CT2354614.SHRINK_TOOLBAR", 1);
Line Deleted : user_pref("CT2354614.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2354614&octid=EB_ORIGINAL_CTID");
Line Deleted : user_pref("CT2354614.SearchFromAddressBarIsInit", true);
Line Deleted : user_pref("CT2354614.SearchInNewTabEnabled", true);
Line Deleted : user_pref("CT2354614.SearchInNewTabIntervalMM", 1440);
Line Deleted : user_pref("CT2354614.SearchInNewTabLastCheckTime", "Sun Apr 11 2010 16:06:30 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
Line Deleted : user_pref("CT2354614.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");
Line Deleted : user_pref("CT2354614.SettingsCheckIntervalMin", 120);
Line Deleted : user_pref("CT2354614.SettingsLastCheckTime", "Sun Apr 11 2010 16:06:13 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.SettingsLastUpdate", "1269766680");
Line Deleted : user_pref("CT2354614.ThirdPartyComponentsInterval", 504);
Line Deleted : user_pref("CT2354614.ThirdPartyComponentsLastCheck", "Sun Apr 11 2010 16:06:13 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CT2354614.ThirdPartyComponentsLastUpdate", "1269766680");
Line Deleted : user_pref("CT2354614.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=101&sealid=112");
Line Deleted : user_pref("CT2354614.UserID", "UN73079496383751760");
Line Deleted : user_pref("CT2354614.ValidationData_Toolbar", 2);
Line Deleted : user_pref("CT2354614.alertChannelId", "749848");
Line Deleted : user_pref("CT2354614.clientLogIsEnabled", false);
Line Deleted : user_pref("CT2354614.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Line Deleted : user_pref("CT2354614.components.1000034", false);
Line Deleted : user_pref("CT2354614.components.1000234", false);
Line Deleted : user_pref("CT2354614.myStuffEnabled", true);
Line Deleted : user_pref("CT2354614.myStuffPublihserMinWidth", 400);
Line Deleted : user_pref("CT2354614.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=2&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Line Deleted : user_pref("CT2354614.myStuffServiceIntervalMM", 1440);
Line Deleted : user_pref("CT2354614.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Line Deleted : user_pref("CT2354614.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
Line Deleted : user_pref("CT3209604_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1349724355976,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZUzeb004YYUS_ZUxdm722YYUS&fl=0&ptb=p7T.rvBBdyXFFOidEvI.Wg&url=hxxp://search.mywebsearch.com[…]
Line Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2354614");
Line Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2354614");
Line Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 60);
Line Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Mon Jun 21 2010 13:28:05 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Line Deleted : user_pref("CommunityToolbar.alert.locale", "en");
Line Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Line Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Mon Jun 21 2010 08:10:32 GMT-0500 (Central Daylight Time)");
Line Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1234796400");
Line Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Line Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Line Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Line Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Line Deleted : user_pref("CommunityToolbar.alert.userId", "{f4ff5d43-4792-46ed-b4a6-38c4d9af19c4}");
Line Deleted : user_pref("extensions.skipscreen.hostMatchStr", "hxxp://www.4shared.com/(get|audio|file|document|dir)/.*|hxxp://.*depositfiles.com/(([a-z]{2})/files/|auth-).*|hxxp://(www.)*digg.com/(.{5}|.{6})$|hxxp:[…]
Line Deleted : user_pref("[removed]-event-fired", true);

[ File : C:\Users\kids\AppData\Roaming\Mozilla\Firefox\Profiles\nxc97u5c.default\prefs.js ]

Line Deleted : user_pref("extensions.enabledAddons", "crossriderapp2258%40crossrider.com:0.94.149,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:31.0");

-\\ Google Chrome v

[ File : C:\Users\Carla\AppData\Local\Google\Chrome\User Data\Default\preferences ]

[ File : C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [17065 octets] - [26/08/2014 10:00:20]
AdwCleaner[S0].txt - [16826 octets] - [26/08/2014 10:02:16]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [16887 octets] ##########

I am not seeing much improvement in speed,

ken545

Post #8August 26, 2014, 3:22 PM UTC

Kevin, this is a malware removal forum, were not here to speed up your computer, we just remove viruses, malware and bogus programs. If after we deem your system as being ok then I can link you to our windows forum for help going through startups and installed programs to try and find out why, could also be a hardware problem , not sure

Let me ask you, prior to the slowdown, have you added or removed any hardware like a printer, scanner for example. Outside of here, have you installed or uninstalled any software prior to you experiencing the slowdown

Go ahead and run a new FRST scan and post both the new scan log along with the additiions log

kevin_czarnota

Post #9August 27, 2014, 1:33 AM UTC

Here is the Frst file but it did not seem to have created an additon file. Did I forget to click something/

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 01
Ran by [removed] (administrator) on CZARNOTA-FAMILY on 26-08-2014 20:26:34
Running from C:\Users\[removed]\Desktop
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Windows\System32\AERTSr64.exe
(Carbonite, Inc. (www.carbonite.com)) C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
() C:\Program Files\Macrium\Reflect\ReflectService.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\aol\1232141495\ee\aolsoftware.exe
(Intuit Inc.) C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE
(Carbonite, Inc.) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
(AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\waol.exe
(Stoic Joker's Network) C:\Program Files (x86)\Tclock\tclock-x64\Clock.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
(AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\shellmon.exe
(Xerox Corporation) C:\Windows\System32\spool\drivers\x64\3\x2jobtHT.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKLM-x32\…\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [2829624 2013-11-08] (Intuit Inc. All rights reserved.)
HKLM-x32\…\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1232141495\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.)
HKLM-x32\…\Run: [Carbonite Backup] => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe [1056976 2014-06-27] (Carbonite, Inc.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\…\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7762712 2014-08-12] (SUPERAntiSpyware)
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [KSS] => "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL Desktop 9.7b\AOL.EXE [72296 2014-06-05] (AOL Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (No File)
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
ShortcutTarget: OpenOffice.org 3.0.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stoic Joker's T-Clock x64.lnk
ShortcutTarget: Stoic Joker's T-Clock x64.lnk -> C:\Program Files (x86)\Tclock\tclock-x64\Clock.exe (Stoic Joker's Network)
ShellIconOverlayIdentifiers: Carbonite.Green -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers: Carbonite.Partial -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers: Carbonite.Yellow -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Green -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Partial -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Yellow -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.techsupportalert.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {32564CED-2EF8-466A-900C-38D268CF8C4A} URL = http://ws.infospace.com/playsushi_tbar/ws/redir?_iceUrl=true&tool_id=58485&qkw={searchTerms}
SearchScopes: HKLM-x32 - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL =
SearchScopes: HKCU - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?p={searchTerms}&fr=chr-iobit
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {0AD584EB-F10F-46F7-BCB8-1085C386BEAE} https://merchantaccount.quickbooks.com/recurchrg/IntuitRecurPayCom2009.cab
DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Virtual%20Families/Images/stg_drm.ocx
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {5C709EEC-DDE1-4738-8E57-7564E2637891} https://merchantaccount.quickbooks.com/sync/QBMASSyncCom1_2009.cab
DPF: HKLM-x32 {788539E8-002D-4E59-9089-40B694A99C9A} https://merchantaccount.quickbooks.com/sync/QBMASSyncCom2_2008.cab
DPF: HKLM-x32 {8714912E-380D-11D5-B8AA-00D0B78F3D48} http://chat.yahoo.com/cab/yuplapp.cab
DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB
DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Peggle/Images/armhelper.ocx
Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - No File
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] [removed] [removed]

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default
FF Homepage: hxxp://www.techsupportalert.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MI1933~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin-x32: @ei.Retrogamer_4w.com/Plugin -> C:\Program Files (x86)\Retrogamer_4wEI\Installr\1.bin\NP4wEISB.dll (Retrogamer)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @virtools.com/3DviaPlayer -> C:\Program Files (x86)\Virtools\3D Life Player\npvirtools.dll (Dassault Systèmes)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol500.dll (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\kevin\AppData\Roaming\mozilla\plugins\np-mswmp.dll (Microsoft Corporation)
FF Extension: LogMeIn, Inc. Remote Access Plugin - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2014-06-07]
FF Extension: ArcadeFrontier - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{1a68cbde-3e4c-4fae-bf49-af5ab9868e53} [2014-05-06]
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}-trash [2011-03-09]
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-19]
FF Extension: IE View Lite - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3} [2009-09-14]
FF Extension: SkipScreen - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2011-07-16]
FF Extension: WikiLook - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2011-07-23]
FF Extension: ALLYouTubeDownloader - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2012-09-22]
FF Extension: Flash Block - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{95ab36d4-fb6f-47b0-8b8d-e5f3bd547953}.xpi [2014-08-02]
FF HKLM-x32\…\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-11-20]

Chrome:
=======
CHR Profile: C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-12] (SUPERAntiSpyware.com)
R2 AERTFilters; C:\Windows\system32\AERTSr64.exe [86016 2008-07-28] (Andrea Electronics Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [173344 2007-02-06] (Logitech Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed]
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2013-11-08] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2012-06-05] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2012-06-05] (Intuit Inc.) [File not signed]
R2 ReflectService; C:\Program Files\Macrium\Reflect\ReflectService.exe [301720 2011-07-01] ()
S3 ShowAnalyzerMaster; C:\Program Files (x86)\Dragon Global\ShowAnalyzerSuite\ShowAnalyzerMaster.exe [2074112 2010-02-08] (Dragon Global) [File not signed]
S3 WinDefend; %ProgramFiles(x86)%\Windows Defender\mpsvc.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)
R3 ATIAVPCI; C:\Windows\System32\DRIVERS\atinavrr.sys [1557376 2009-11-04] (ATI Technologies Inc.)
S1 AuviPCI; C:\Windows\System32\DRIVERS\AuviPCI64.sys [1771776 2009-06-30] (Auvitek Corp.) [File not signed]
S1 Beep; No ImagePath
S3 FlyUsb; C:\Windows\System32\DRIVERS\FlyUsb.sys [24576 2007-06-18] (LeapFrog)
R1 GizmoDrv; C:\Windows\System32\Drivers\GizmoDrv.sys [34704 2011-05-30] (Arainia Solutions LLC)
S3 LVcKap64; C:\Windows\System32\DRIVERS\LVcKap64.sys [1013024 2007-02-06] (Logitech Inc.)
S3 LVMVDrv; C:\Windows\System32\DRIVERS\LVMVDrv.sys [2346016 2007-02-06] (Logitech Inc.)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [31520 2007-02-06] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-26] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S3 PSMounter; C:\Windows\system32\drivers\psmounter.sys [40600 2011-07-01] (Macrium Software)
S3 PSVolAcc; C:\Windows\System32\Drivers\PSVolAcc.sys [13464 2011-07-01] (Paramount Software UK Ltd)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-08-03] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-08-03] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SQTECH9052; C:\Windows\System32\Drivers\Capt9052.sys [47680 2008-02-21] (Service & Quality Technology.)
S3 SQTECH905C; C:\Windows\System32\Drivers\Capt905c.sys [44480 2007-05-02] (Service & Quality Technology.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-07-17] ()
S0 uezndl; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-26 20:26 - 2014-08-26 20:26 - 00023158 _____ () C:\Users\kevin\Desktop\FRST.txt
2014-08-26 17:45 - 2014-08-26 18:00 - 00000000 ____D () C:\Users\kevin\Desktop\stephanieProject
2014-08-26 10:01 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-26 10:00 - 2014-08-26 10:03 - 00000000 ____D () C:\AdwCleaner
2014-08-26 09:58 - 2014-08-26 09:59 - 01364531 _____ () C:\Users\kevin\Desktop\adwcleaner_3.308.exe
2014-08-25 22:46 - 2014-08-25 22:46 - 00014717 _____ () C:\Users\Bricks4Kidz\Documents\FieldTripPricing.xlsx
2014-08-25 18:42 - 2014-08-26 20:26 - 00000000 ____D () C:\FRST
2014-08-25 18:42 - 2014-08-25 18:42 - 02103296 _____ (Farbar) C:\Users\kevin\Desktop\FRST64.exe
2014-08-25 18:31 - 2014-08-26 09:39 - 00464632 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 18:30 - 2014-08-26 10:05 - 00202782 _____ () C:\Windows\PFRO.log
2014-08-25 17:56 - 2014-08-26 17:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 17:56 - 2014-08-25 17:56 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-25 17:56 - 2014-08-25 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2014-08-25 17:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-25 17:55 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-25 17:55 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-25 17:54 - 2014-08-25 17:54 - 00002596 _____ () C:\Users\kevin\Desktop\aswMBR.txt
2014-08-25 09:12 - 2014-08-25 17:54 - 00000512 _____ () C:\Users\kevin\Desktop\MBR.dat
2014-08-25 09:10 - 2014-08-25 09:10 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\kevin\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-25 09:06 - 2014-08-25 09:06 - 05185536 _____ (AVAST Software) C:\Users\kevin\Desktop\aswMBR.exe
2014-08-24 16:09 - 2014-08-24 16:09 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(6).exe
2014-08-24 16:04 - 2014-08-24 16:04 - 00079991 _____ () C:\Users\Bricks4Kidz\Downloads\silverlight.diagcab
2014-08-24 15:36 - 2014-08-24 15:36 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(5).exe
2014-08-24 08:23 - 2014-08-24 08:23 - 00113776 _____ () C:\Users\kevin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 19:00 - 2014-08-23 19:00 - 00000000 ____D () C:\a3f5a5774bf4325b38922cfb
2014-08-23 18:57 - 2014-08-23 18:57 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(4).exe
2014-08-23 18:56 - 2014-08-23 18:56 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(3).exe
2014-08-22 21:07 - 2014-08-24 19:56 - 00013891 _____ () C:\Users\Bricks4Kidz\Documents\school distance.xlsx
2014-08-22 13:49 - 2014-08-22 13:51 - 76699734 _____ () C:\Users\Bricks4Kidz\Downloads\NXT_Tutorial.zip
2014-08-19 11:28 - 2014-08-19 22:14 - 00013934 _____ () C:\Users\Bricks4Kidz\Documents\09-2014SceduleAll.xlsx
2014-08-12 17:01 - 2014-06-26 17:17 - 01389200 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-12 17:01 - 2014-06-26 17:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-12 17:01 - 2014-06-26 17:17 - 00171152 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00008848 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-12 17:00 - 2014-06-05 23:29 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-12 17:00 - 2014-06-05 23:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-12 16:59 - 2014-07-24 14:28 - 17861120 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-12 16:59 - 2014-07-24 14:12 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-12 16:59 - 2014-07-24 14:10 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-12 16:59 - 2014-07-24 14:07 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-12 16:59 - 2014-07-24 14:06 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-12 16:59 - 2014-07-24 14:05 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-12 16:59 - 2014-07-24 14:05 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-08-12 16:59 - 2014-07-24 14:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 02155520 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-12 16:59 - 2014-07-24 14:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-12 16:59 - 2014-07-24 14:03 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-08-12 16:59 - 2014-07-24 14:03 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-08-12 16:59 - 2014-07-24 14:02 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-12 16:59 - 2014-07-24 13:07 - 12356608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-12 16:59 - 2014-07-24 12:58 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-12 16:59 - 2014-07-24 12:57 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-12 16:59 - 2014-07-24 12:52 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-12 16:59 - 2014-07-24 12:51 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-12 16:59 - 2014-07-24 12:51 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-12 16:59 - 2014-07-24 12:50 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-08-12 16:59 - 2014-07-24 12:50 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-12 16:59 - 2014-07-24 12:48 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-12 16:59 - 2014-07-24 12:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-08-12 16:59 - 2014-07-24 12:48 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-08-12 16:59 - 2014-07-24 12:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-12 16:58 - 2014-07-24 23:27 - 00304128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-12 16:58 - 2014-07-24 23:18 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-12 16:58 - 2014-07-24 22:15 - 02781696 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-12 16:58 - 2014-07-07 20:12 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-12 16:58 - 2014-07-07 19:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-12 16:58 - 2014-06-13 19:56 - 00901568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-12 16:58 - 2014-06-13 19:51 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-12 16:57 - 2014-06-02 16:30 - 03137536 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-12 16:56 - 2014-06-02 16:30 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-12 16:56 - 2014-06-02 16:29 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-12 16:56 - 2014-06-02 16:29 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-08-12 16:56 - 2014-06-02 15:29 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-12 16:56 - 2014-06-02 05:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-12 16:56 - 2014-06-02 05:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-12 16:56 - 2014-06-02 05:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-11 15:41 - 2014-07-25 12:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-11 15:41 - 2014-07-25 12:49 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-11 15:41 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-11 15:41 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-11 15:40 - 2014-08-11 15:41 - 00005618 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-11 15:37 - 2014-08-11 15:38 - 00918952 _____ (Oracle Corporation) C:\Users\kids\Downloads\jxpiinstall(3).exe
2014-08-02 20:38 - 2014-08-02 20:38 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\New Folder
2014-07-30 20:37 - 2014-07-30 20:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-30 18:45 - 2014-07-30 18:45 - 00004170 _____ () C:\Windows\System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4}
2014-07-30 18:45 - 2014-07-30 18:45 - 00001969 _____ () C:\Users\Public\Desktop\Carbonite InfoCenter.lnk
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files (x86)\Carbonite
2014-07-30 16:53 - 2014-08-15 08:17 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\XBMC
2014-07-30 16:41 - 2014-07-30 16:41 - 00375958 _____ () C:\Users\kevin\AppData\Local\dd_vcredistMSI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00011190 _____ () C:\Users\kevin\AppData\Local\dd_vcredistUI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XBMC
2014-07-27 20:54 - 2014-07-29 07:56 - 00009628 _____ () C:\Users\Bricks4Kidz\Documents\Leigh Brown Camp Payment Rate.xlsx
2014-07-27 09:51 - 2014-07-27 09:51 - 00009412 _____ () C:\Users\Bricks4Kidz\Documents\MinfigureCostFromLego.xlsx

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-26 20:26 - 2014-08-26 20:26 - 00023158 _____ () C:\Users\kevin\Desktop\FRST.txt
2014-08-26 20:26 - 2014-08-25 18:42 - 00000000 ____D () C:\FRST
2014-08-26 20:05 - 2006-11-02 10:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-26 20:05 - 2006-11-02 10:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-26 20:02 - 2014-04-03 16:49 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e55b0dc4-9b61-4c31-ade5-7aa4f33ac245.job
2014-08-26 18:00 - 2014-08-26 17:45 - 00000000 ____D () C:\Users\kevin\Desktop\stephanieProject
2014-08-26 17:54 - 2014-08-25 17:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-26 17:54 - 2012-08-04 11:18 - 00016896 _____ () C:\Users\kevin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-26 16:58 - 2010-12-26 22:17 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-08-26 16:57 - 2009-01-16 16:20 - 00000000 ____D () C:\TEMP
2014-08-26 10:16 - 2009-01-17 14:31 - 00000000 ____D () C:\Users\kevin\Documents\insurance
2014-08-26 10:12 - 2014-04-30 18:48 - 01356263 _____ () C:\Windows\WindowsUpdate.log
2014-08-26 10:09 - 2010-04-26 13:58 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-08-26 10:05 - 2014-08-25 18:30 - 00202782 _____ () C:\Windows\PFRO.log
2014-08-26 10:05 - 2006-11-02 10:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-26 10:03 - 2014-08-26 10:00 - 00000000 ____D () C:\AdwCleaner
2014-08-26 10:03 - 2006-11-02 10:42 - 00032598 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-26 09:59 - 2014-08-26 09:58 - 01364531 _____ () C:\Users\kevin\Desktop\adwcleaner_3.308.exe
2014-08-26 09:39 - 2014-08-25 18:31 - 00464632 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-26 09:03 - 2011-10-31 11:36 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Outlook Files
2014-08-26 08:52 - 2011-10-31 11:32 - 00002643 _____ () C:\Users\Bricks4Kidz\Desktop\Microsoft Outlook 2010.lnk
2014-08-26 03:02 - 2014-02-09 15:42 - 00000510 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task a00d761c-5b80-4a6f-8e41-11857ef8a885.job
2014-08-26 01:59 - 2014-02-09 15:42 - 00000510 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 8b753a4f-7f81-44f0-93e1-52469fd63d88.job
2014-08-26 01:00 - 2012-12-08 13:13 - 00000562 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 496ce132-741c-4714-94e8-e5e2782636c9.job
2014-08-26 00:55 - 2012-12-08 13:13 - 00000562 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 61633aab-dd87-4057-995b-e285d11a22d8.job
2014-08-25 22:49 - 2014-07-16 22:11 - 00260096 _____ () C:\Users\Bricks4Kidz\Documents\Brictek price list US 20140630.xls
2014-08-25 22:46 - 2014-08-25 22:46 - 00014717 _____ () C:\Users\Bricks4Kidz\Documents\FieldTripPricing.xlsx
2014-08-25 21:39 - 2012-08-12 13:19 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Artwork-blankFlyers
2014-08-25 18:42 - 2014-08-25 18:42 - 02103296 _____ (Farbar) C:\Users\kevin\Desktop\FRST64.exe
2014-08-25 17:56 - 2014-08-25 17:56 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-25 17:56 - 2014-08-25 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-25 17:56 - 2014-08-25 17:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2012-03-22 10:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 17:54 - 2014-08-25 17:54 - 00002596 _____ () C:\Users\kevin\Desktop\aswMBR.txt
2014-08-25 17:54 - 2014-08-25 09:12 - 00000512 _____ () C:\Users\kevin\Desktop\MBR.dat
2014-08-25 09:10 - 2014-08-25 09:10 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\kevin\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-25 09:06 - 2014-08-25 09:06 - 05185536 _____ (AVAST Software) C:\Users\kevin\Desktop\aswMBR.exe
2014-08-24 19:56 - 2014-08-22 21:07 - 00013891 _____ () C:\Users\Bricks4Kidz\Documents\school distance.xlsx
2014-08-24 16:09 - 2014-08-24 16:09 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(6).exe
2014-08-24 16:04 - 2014-08-24 16:04 - 00079991 _____ () C:\Users\Bricks4Kidz\Downloads\silverlight.diagcab
2014-08-24 15:36 - 2014-08-24 15:36 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(5).exe
2014-08-24 08:23 - 2014-08-24 08:23 - 00113776 _____ () C:\Users\kevin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 19:00 - 2014-08-23 19:00 - 00000000 ____D () C:\a3f5a5774bf4325b38922cfb
2014-08-23 18:57 - 2014-08-23 18:57 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(4).exe
2014-08-23 18:56 - 2014-08-23 18:56 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(3).exe
2014-08-23 08:51 - 2009-01-16 15:22 - 00000000 ____D () C:\Users\kevin
2014-08-23 07:59 - 2011-02-26 11:29 - 00000000 ____D () C:\Users\kevin\Desktop\highjackthis
2014-08-23 07:59 - 2009-01-16 15:22 - 00000000 ____D () C:\Users\kevin\AppData\Local\VirtualStore
2014-08-22 15:02 - 2012-03-05 08:40 - 00002637 _____ () C:\Users\Bricks4Kidz\Desktop\Microsoft Word 2010.lnk
2014-08-22 13:51 - 2014-08-22 13:49 - 76699734 _____ () C:\Users\Bricks4Kidz\Downloads\NXT_Tutorial.zip
2014-08-22 12:00 - 2012-04-09 07:10 - 00000000 ____D () C:\Users\Bricks4Kidz\AppData\Roaming\vlc
2014-08-22 11:57 - 2011-12-20 14:16 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Mindstorm
2014-08-21 20:14 - 2011-10-29 21:30 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Receipts
2014-08-21 18:26 - 2013-01-13 22:13 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\BirthdayParties
2014-08-19 22:14 - 2014-08-19 11:28 - 00013934 _____ () C:\Users\Bricks4Kidz\Documents\09-2014SceduleAll.xlsx
2014-08-18 19:56 - 2011-10-28 16:07 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Legal
2014-08-18 03:34 - 2013-01-21 17:48 - 00000000 ____D () C:\Users\Bricks4Kidz\AppData\Roaming\.minecraft
2014-08-17 20:28 - 2014-07-21 21:42 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\BBVACompassOpenPositions7.14.14
2014-08-16 08:23 - 2006-11-02 07:46 - 00763610 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-15 08:17 - 2014-07-30 16:53 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\XBMC
2014-08-12 17:42 - 2006-11-02 08:33 - 00000000 ____D () C:\Windows\rescache
2014-08-12 17:15 - 2013-07-11 23:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-12 17:09 - 2006-11-02 07:35 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-12 06:43 - 2011-10-23 20:40 - 00000000 ____D () C:\Users\Bricks4Kidz
2014-08-11 15:47 - 2009-11-22 12:58 - 00000000 ____D () C:\Users\kids\AppData\Roaming\AOL
2014-08-11 15:47 - 2009-01-26 15:07 - 00000000 ____D () C:\Users\kids\AppData\Local\AOL
2014-08-11 15:42 - 2013-10-15 17:33 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-11 15:41 - 2014-08-11 15:40 - 00005618 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-11 15:41 - 2009-01-14 00:31 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-11 15:38 - 2014-08-11 15:37 - 00918952 _____ (Oracle Corporation) C:\Users\kids\Downloads\jxpiinstall(3).exe
2014-08-08 16:15 - 2009-09-24 09:43 - 00000000 ____D () C:\Users\Carla\AppData\Roaming\vlc
2014-08-07 16:40 - 2013-04-23 00:20 - 00000680 _____ () C:\Users\Bricks4Kidz\AppData\Local\d3d9caps.dat
2014-08-06 20:04 - 2011-10-24 09:37 - 00024576 _____ () C:\Users\Bricks4Kidz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-02 20:39 - 2012-04-14 07:03 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\games
2014-08-02 20:38 - 2014-08-02 20:38 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\New Folder
2014-08-01 14:30 - 2012-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-31 20:01 - 2012-12-04 20:11 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Labels
2014-07-31 15:04 - 2012-07-27 13:52 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Invoices
2014-07-30 20:38 - 2014-07-30 20:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-30 18:45 - 2014-07-30 18:45 - 00004170 _____ () C:\Windows\System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4}
2014-07-30 18:45 - 2014-07-30 18:45 - 00001969 _____ () C:\Users\Public\Desktop\Carbonite InfoCenter.lnk
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files (x86)\Carbonite
2014-07-30 16:41 - 2014-07-30 16:41 - 00375958 _____ () C:\Users\kevin\AppData\Local\dd_vcredistMSI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00011190 _____ () C:\Users\kevin\AppData\Local\dd_vcredistUI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XBMC
2014-07-30 16:41 - 2011-03-11 12:59 - 00000000 ____D () C:\Program Files (x86)\XBMC
2014-07-29 07:56 - 2014-07-27 20:54 - 00009628 _____ () C:\Users\Bricks4Kidz\Documents\Leigh Brown Camp Payment Rate.xlsx
2014-07-28 23:11 - 2013-07-06 10:15 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\StopMotion
2014-07-27 09:51 - 2014-07-27 09:51 - 00009412 _____ () C:\Users\Bricks4Kidz\Documents\MinfigureCostFromLego.xlsx

Some content of TEMP:
====================
C:\Users\kevin\AppData\Local\temp\Quarantine.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-08-26 10:17

==================== End Of Log ============================

ken545

Post #10August 27, 2014, 11:01 AM UTC

Let me ask you, prior to the slowdown, have you added or removed any hardware like a printer, scanner for example. Outside of here, have you installed or uninstalled any software prior to you experiencing the slowdown

Open up FRST and on the bottom you will see Optional Scans…put a checkmark in Additions ONLY

kevin_czarnota

Post #11August 28, 2014, 2:25 AM UTC

Here is my additions file:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2014 01
Ran by [removed] at 2014-08-27 21:22:40
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

10 Talismans (HKLM-x32\…\BFG-10 Talismans) (Version: - )
3DVIA player 5.0 (HKLM-x32\…\{4E868D3D-6EEB-4273-926C-2287236B5B79}) (Version: 5.0.0.15 - 3DVIA)
Acrobat.com (HKLM-x32\…\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 2.0.0.0 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 2.0.0 - Adobe Systems Incorporated) Hidden
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\…\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.7) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.7 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
Agatha Christie: 4:50 from Paddington (HKLM-x32\…\BFG-Agatha Christie - 450 from Paddington) (Version: - )
Age of Emerald (HKLM-x32\…\BFG-Age of Emerald) (Version: - )
Age Of Oracles: Tara`s Journey (HKLM-x32\…\BFG-Age Of Oracles - Taras Journey) (Version: - )
Alex Gordon (HKLM-x32\…\BFG-Alex Gordon) (Version: - )
Amazing Adventures: The Caribbean Secret (HKLM-x32\…\BFG-Amazing Adventures - The Caribbean Secret) (Version: - )
Amazing Pyramids (HKLM-x32\…\BFG-Amazing Pyramids) (Version: - )
AOL Registration (HKLM-x32\…\AOL Regclient) (Version: - )
AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\…\AOL Uninstaller) (Version: - AOL Inc.)
ATI AVIVO64 Codecs (Version: 10.0.0.31121 - ATI Technologies Inc.) Hidden
Atlantis (HKLM-x32\…\BFG-Atlantis) (Version: - )
Auslogics Disk Defrag (HKLM-x32\…\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: version 3.1 - Auslogics Software Pty Ltd)
Avery Template (HKLM-x32\…\{A760067A-C07E-1033-0000-A764AC000008}) (Version: 2.0.0.0 - Avery)
Avidemux 2.5 (HKLM-x32\…\Avidemux 2.5 (64-bit)) (Version: 2.5.6.7716 - )
AxCrypt 1.7.2126.0 (HKLM\…\{4316E318-85EC-42C3-9535-C7B49B8CAD21}) (Version: 1.7.2126.0 - Axantum Software AB)
Big City Adventure: Sydney, Australia (HKLM-x32\…\BFG-Big City Adventure - Sydney Australia) (Version: - )
Big Fish Games: Game Manager (HKLM-x32\…\BFGC) (Version: 3.0.1.60 - )
Bus Driver (HKLM-x32\…\BFG-Bus Driver) (Version: - )
Carbonite (HKLM-x32\…\Carbonite Backup) (Version: 5.5.5 build 4151 (Jun-27-2014) - Carbonite)
CCleaner (HKLM\…\CCleaner) (Version: 4.00 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
ConvertHelper 2.2 (HKLM-x32\…\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version: - DownloadHelper)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2433A103-9EC3-49EA-9AD1-58A35F27EE56}) (Version: - Microsoft)
Dell Getting Started Guide (HKLM-x32\…\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell System Detect (HKCU\…\9204f5692a8faf3b) (Version: 5.7.0.6 - Dell)
Dell System Detect Bootstrapper (HKCU\…\8e3135b376bd523e) (Version: 1.1.0.15 - Dell)
DVD Flick 1.3.0.7 (HKLM-x32\…\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
DVRMSToolbox (HKLM-x32\…\{E7ECD072-02DF-4F24-B5C9-7928A2867B14}) (Version: 1.2.1 - babgvant.com)
EasyCleaner (HKLM-x32\…\{F5346614-B7C4-4E94-826A-E2363155233D}) (Version: 2.0.6.380 - ToniArts)
EPSON Printer Software (HKLM\…\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\…\EPSON Scanner) (Version: - )
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
EssentialPIM (HKLM-x32\…\EssentialPIM) (Version: 4.23 - )
Exact Audio Copy 0.99pb5 (HKLM-x32\…\Exact Audio Copy) (Version: 0.99pb5 - Andre Wiethoff)
Farm Frenzy 3: Madagascar (HKLM-x32\…\BFG-Farm Frenzy 3 - Madagascar) (Version: - )
ffdshow [rev 2527] [2008-12-19] (HKLM-x32\…\ffdshow_is1) (Version: 1.0 - )
Gardenscapes (HKLM-x32\…\BFG-Gardenscapes) (Version: - )
Geisha: The Secret Garden (HKLM-x32\…\BFG-Geisha - The Secret Garden) (Version: - )
Gemsweeper (HKLM-x32\…\BFG-Gemsweeper) (Version: - )
Google Calendar Sync (HKLM-x32\…\Google Calendar Sync) (Version: - )
Great Escapes Solitaire Collection (HKLM-x32\…\BFG-Great Escapes Solitaire Collection) (Version: - )
Hidden Expedition: Everest ™ (HKLM-x32\…\BFG-Hidden Expedition - Everest) (Version: - )
Inkscape 0.48.4 (HKLM-x32\…\Inkscape) (Version: 0.48.4 - )
Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: - Intel Corporation)
Jar of Marbles (HKLM-x32\…\BFG-Jar of Marbles) (Version: - )
Java 7 Update 25 (64-bit) (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F86417025FF}) (Version: 7.0.250 - Oracle)
Java 7 Update 67 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Kingdom Chronicles (HKLM-x32\…\BFG-Kingdom Chronicles) (Version: - )
Liong: The Dragon Dance (HKLM-x32\…\BFG-Liong - The Dragon Dance) (Version: - )
Logitech QuickCam (HKLM\…\{192E85C6-2B8A-4217-AD30-ECA5CE19DB23}) (Version: 10.51.2029 - Logitech Inc.)
Logitech Video Enumerator (x32 Version: 10.51.2027 - Logitech Inc.) Hidden
Logitech® Camera Driver (HKLM-x32\…\QcDrv) (Version: - )
Macrium Reflect - Free Edition (HKLM\…\{AC1B58BB-55ED-43F0-98D9-6CEB24C2C5CD}) (Version: 4.2.2098 - Macrium)
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\…\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft Corporation (x32 Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft LifeCam (HKLM\…\{5CE7E3F5-9803-4F32-AA89-2D8848A80109}) (Version: 3.60.253.0 - Microsoft Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
Microsoft Office 2010 Service Pack 1 (SP1) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\…\Office14.PROPLUSR) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.3.0215.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.3.215.0 - Microsoft Corporation)
Microsoft VC9 runtime libraries (x32 Version: 1.0.0 - AOL Inc.) Hidden
Microsoft VC9 runtime libraries (x32 Version: 1.0.0 - AOL LLC) Hidden
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\…\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\…\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Million Dollar Quest (HKLM-x32\…\BFG-Million Dollar Quest) (Version: - )
MotoCast (HKLM-x32\…\{5401CEE8-3C2D-4835-A802-213306537FF4}) (Version: 2.0.31 - Motorola Mobility)
MotoHelper MergeModules (x32 Version: 1.2.0 - Motorola) Hidden
Motorola Device Manager (HKLM-x32\…\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.4.5 - Motorola Mobility)
Motorola Device Software Update (x32 Version: 13.09.3001 - Motorola Mobility) Hidden
Motorola Mobile Drivers Installation 6.3.0 (HKLM\…\{759E6A2F-1F01-45EF-A0C4-22F1B56CB975}) (Version: 6.3.0 - Motorola Mobility LLC)
Mozilla Firefox 31.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 31.0 (x86 en-US)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\…\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\…\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\…\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
My Kingdom for the Princess II (HKLM-x32\…\BFG-My Kingdom for the Princess II) (Version: - )
My Kingdom for the Princess III (HKLM-x32\…\BFG-My Kingdom for the Princess III) (Version: - )
Nick Jr. Bingo (HKLM-x32\…\BFG-Nick Jr. Bingo) (Version: - )
NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version: - )
Pac-Man (HKLM-x32\…\BFG-Pac-Man) (Version: - )
Pantheon (HKLM-x32\…\BFG-Pantheon) (Version: - )
Paradise Quest (HKLM-x32\…\BFG-Paradise Quest) (Version: - )
PDF Annotator 5.0.0.502 (HKLM-x32\…\PDFAnnotator_is1) (Version: 5.0.0.502 - GRAHL software design)
PDF-Viewer (HKLM\…\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.200.0 - Tracker Software Products Ltd)
Peggle (HKLM-x32\…\Peggle) (Version: - Spintop Media, Inc)
Peggle Deluxe (HKLM-x32\…\BFG-Peggle Deluxe) (Version: - )
Pioneer Lands (HKLM-x32\…\BFG-Pioneer Lands) (Version: - )
Print to PDF Annotator (novaPDF OEM 7.7 printer) (HKLM\…\Print to PDF Annotator_is1) (Version: 7.7.400 - Softland)
Puzzle Park (HKLM-x32\…\BFG-Puzzle Park) (Version: - )
QuickBooks (x32 Version: 22.0.4015.2206 - Intuit Inc.) Hidden
QuickBooks Pro 2012 (HKLM-x32\…\{22057D8D-7CC8-46FF-AD8C-9BD24F9014F3}) (Version: 22.0.4015.2206 - Intuit Inc.)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - Realtek Semiconductor Corp.)
RTC Client API v1.2 (HKLM-x32\…\{44CDBD1B-89FB-4E02-8319-2A4C550F664A}) (Version: 1.2.0000 - Microsoft)
Season of Mystery: The Cherry Blossom Murders (HKLM-x32\…\BFG-Season of Mystery - The Cherry Blossom Murders) (Version: - )
ShopSafe (x32 Version: 1.4.3.0 - ShopSafe) Hidden
ShowAnalyzerSuite (HKLM-x32\…\{230B46CD-A035-484C-BB8B-1FE46DA0724F}) (Version: 1.0.59.783 - Dragon Global)
Skype™ 5.10 (HKLM-x32\…\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}) (Version: 5.10.116 - Skype Technologies S.A.)
Slingo Quest (HKLM-x32\…\BFG-Slingo Quest) (Version: - )
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
SUPERAntiSpyware (HKLM\…\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 4.47.1000 - SUPERAntiSpyware.com)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab for Intel (HKLM-x32\…\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
The Timebuilders: Caveman's Prophecy (HKLM-x32\…\BFG-The Timebuilders - Caveman's Prophecy) (Version: - )
The Timebuilders: Pyramid Rising (HKLM-x32\…\BFG-The Timebuilders - Pyramid Rising) (Version: - )
Trinklit Supreme (HKLM-x32\…\BFG-Trinklit Supreme) (Version: - )
TurboTax Deluxe 2007 (HKLM-x32\…\TurboTax Deluxe 2007) (Version: - )
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\…\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\…\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553065) (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{A8686D24-1E89-43A1-973E-05A258D2B3F8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553157) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{97C39B81-3054-4AB4-B11D-A656DE619982}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{48E1B6C2-7299-4F3F-AA63-42F0ACE55AA4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{18B3CF2A-73F7-4716-B1AE-86D68726D408}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (HKLM-x32\…\{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{73E67A3A-8D61-44EF-90C2-1697C3DBE668}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2566458) (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{EFB525A0-E1C0-4E32-9968-FE401BC87363}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589370) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{150A0FF0-AF69-4132-BD93-1E34F63FC8A3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ED31DE9A-3E13-4E2C-9106-E0D8AFFB9FA6}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (HKLM-x32\…\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{C4F26A9B-B121-4135-8084-A0D9C780C7C8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (HKLM-x32\…\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{460FF681-BC66-4C38-99DF-7012E03F1EBA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (HKLM-x32\…\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{C633216E-FF30-45B6-B2AB-21922A9353EF}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\…\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760758) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{24BD08F8-FF6E-4DD8-BE49-3659AE78A819}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9CFD026D-EB1C-48C2-9DD2-8E8875F251B2}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (HKLM-x32\…\{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{9865DC3A-2898-48D9-B96A-46397571C934}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (HKLM-x32\…\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{3EFF1957-7DEA-4C7A-8E9C-2D6D58E4B2ED}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{3EFF1957-7DEA-4C7A-8E9C-2D6D58E4B2ED}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (HKLM-x32\…\{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{47894754-0FEC-4920-9A65-6C1E732587AC}) (Version: - Microsoft)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (HKLM-x32\…\{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{1EEFF749-6F29-4F0B-AB08-4C6EA52AA110}) (Version: - Microsoft)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BC6DFBFD-16DD-47E1-A7EF-2C062930FA4F}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\…\{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{DA2F7ECE-6629-4A80-9CDE-EC95261B75E2}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{190EC86F-5867-4D7A-B9F3-D14D82C26F3D}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (HKLM-x32\…\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{5DA2D071-A54C-47C0-83E5-43C63DBFD936}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5DA2D071-A54C-47C0-83E5-43C63DBFD936}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\…\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Virtual Families (HKLM-x32\…\Virtual Families) (Version: - Spintop Media, Inc)
VLC media player 2.0.8 (HKLM-x32\…\VLC media player) (Version: 2.0.8 - VideoLAN)
VTech Download Agent Library (x32 Version: 1.00.0000 - VTech) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\…\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinZip (HKLM-x32\…\WinZip) (Version: 8.1 (4331) - WinZip Computing, Inc.)
WinZip 16.5 (HKLM\…\{CD95F661-A5C4-44F5-A6AA-ECDD91C240D5}) (Version: 16.5.10096 - WinZip Computing, S.L. )
XBMC (HKCU\…\XBMC) (Version: - Team XBMC)
Yahoo! Messenger (HKLM-x32\…\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Youda Farmer 2: Save the Village (HKLM-x32\…\BFG-Youda Farmer 2 - Save the Village) (Version: - )
Youda Survivor (HKLM-x32\…\BFG-Youda Survivor) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> "C:\Users\Bricks4Kidz\AppData\Local\Facebook\Update\FacebookUpdate.exe" No File
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{4CA41277-032D-4a20-B225-371EBA96ABF2}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{8E590317-1329-11D1-B70B-00805F29CD16}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{C9448C44-BEFB-4941-8457-E5C4314D3D96}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{CD89D352-5A13-49F8-9EB5-7E6D1FB0CD57}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{DB20D0C0-4CEF-11D0-8B17-00AA00211961}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{DB20D0C3-4CEF-11D0-8B17-00AA00211961}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{DEBB9B79-B3DD-47F4-9E5C-EA6975BAB611}\InprocServer32 -> C:\Program Files\Macrium\Reflect\RShellExt.dll (Paramount Software UK Ltd)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{E8ACF719-FFDE-4EE1-8923-48BDA8569FCC}\localserver32 -> C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\LVComSX.exe (Logitech Inc.)
CustomCLSID: HKU\S-1-5-21-2707694908-3892883027-3287269716-1000_Classes\CLSID\{FAC93D42-FFC2-11d1-9DEB-0008C7A08EBA}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)

==================== Restore Points =========================

12-08-2014 18:08:56 Windows Update
12-08-2014 21:59:29 Windows Update
14-08-2014 08:37:15 Scheduled Checkpoint
15-08-2014 05:00:11 Scheduled Checkpoint
15-08-2014 22:32:44 Windows Update
17-08-2014 05:00:06 Scheduled Checkpoint
18-08-2014 05:00:01 Scheduled Checkpoint
19-08-2014 05:00:03 Scheduled Checkpoint
20-08-2014 05:19:07 Scheduled Checkpoint
20-08-2014 14:02:03 Windows Update
21-08-2014 06:08:02 Scheduled Checkpoint
22-08-2014 08:13:17 Scheduled Checkpoint
24-08-2014 05:17:24 Scheduled Checkpoint
24-08-2014 06:42:24 Windows Update
25-08-2014 05:00:01 Scheduled Checkpoint
26-08-2014 10:29:54 Scheduled Checkpoint
27-08-2014 05:39:51 Scheduled Checkpoint
27-08-2014 15:17:45 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-11-15 08:14 - 2014-08-26 09:26 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0530C8C5-89DF-4E77-A15D-6E157BC50A9D} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1875D461-928A-4E63-B3A0-0B3BBA6D4517} - System32\Tasks\Carbonite Upgrade Check => C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)
Task: {27B92B80-2A71-4D74-9130-446F87AA29A7} - System32\Tasks\SUPERAntiSpyware Scheduled Task a00d761c-5b80-4a6f-8e41-11857ef8a885 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {48C4B2B0-E286-4232-B6AC-FC0B3758D871} - System32\Tasks\SUPERAntiSpyware Scheduled Task 8b753a4f-7f81-44f0-93e1-52469fd63d88 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {6C8D91FE-1B8D-47BD-BAE8-3991EE1B6A8D} - System32\Tasks\SUPERAntiSpyware Scheduled Task e55b0dc4-9b61-4c31-ade5-7aa4f33ac245 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {80CAF94A-6016-4685-91FD-D6DB2660DFDA} - System32\Tasks\{65229D5F-4F8F-438C-B0CE-31B96F839F8B} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {8195037D-1C70-46E7-93CF-78D7558C8074} - System32\Tasks\SUPERAntiSpyware Scheduled Task 61633aab-dd87-4057-995b-e285d11a22d8 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {AF282857-380E-4808-8FE6-24EEAE1434E9} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {AFC31899-B403-48E2-9639-35574027F8C2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd)
Task: {C2FA6FBB-E54B-40D3-AE06-C9A488C201B6} - System32\Tasks\Motorola Device Manager Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {C6F3B25F-95B2-4530-B333-A3750263E7B2} - System32\Tasks\SearchGuardPlusUpdater => C:\Program Files\Search Guard PlusU\sgpupdaters.exe
Task: {DBDCDD86-C0C5-4C5B-9703-F845C5268852} - System32\Tasks\SUPERAntiSpyware Scheduled Task 496ce132-741c-4714-94e8-e5e2782636c9 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-08-03] (SUPERAdBlocker.com)
Task: {E7E595C7-4E25-4157-89F5-13D928F59A27} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {E8AF1EB9-E351-4E15-B11D-172C6790BD91} - System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} => C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 496ce132-741c-4714-94e8-e5e2782636c9.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 61633aab-dd87-4057-995b-e285d11a22d8.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 8b753a4f-7f81-44f0-93e1-52469fd63d88.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task a00d761c-5b80-4a6f-8e41-11857ef8a885.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e55b0dc4-9b61-4c31-ade5-7aa4f33ac245.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe

==================== Loaded Modules (whitelisted) =============

2011-07-01 07:25 - 2011-07-01 07:06 - 00301720 _____ () C:\Program Files\Macrium\Reflect\ReflectService.exe
2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2013-10-31 10:05 - 2013-10-31 10:05 - 00172032 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\css_core.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00269128 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\boost_regex-vc90-mt-p-1_33.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00021320 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\QBCompressor.dll
2012-06-05 05:56 - 2012-06-05 05:56 - 00059904 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\zlib1.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00380744 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\BackupLib.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00138568 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\QBMAPILibrary.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00176968 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\boost_serialization-vc90-mt-p-1_33.dll
2013-11-08 08:48 - 2013-11-08 08:48 - 00042824 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2012\mbpopup.dll
2014-06-05 16:31 - 2014-06-05 16:31 - 00048640 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\zlib.dll
2014-06-05 16:31 - 2014-06-05 16:31 - 21151744 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libcef.dll
2014-06-05 16:31 - 2014-06-05 16:31 - 00648704 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libglesv2.dll
2014-06-05 16:31 - 2014-06-05 16:31 - 00122880 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libegl.dll
2014-07-30 20:37 - 2014-07-30 20:38 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:062AF572
AlternateDataStreams: C:\ProgramData\TEMP:09867A8B
AlternateDataStreams: C:\ProgramData\TEMP:0ACF1AF5
AlternateDataStreams: C:\ProgramData\TEMP:0E22C5DB
AlternateDataStreams: C:\ProgramData\TEMP:15E76ABF
AlternateDataStreams: C:\ProgramData\TEMP:30DA8392
AlternateDataStreams: C:\ProgramData\TEMP:38FF076E
AlternateDataStreams: C:\ProgramData\TEMP:6C08335F
AlternateDataStreams: C:\ProgramData\TEMP:7E927D7D
AlternateDataStreams: C:\ProgramData\TEMP:8C12CFCD
AlternateDataStreams: C:\ProgramData\TEMP:8F067037
AlternateDataStreams: C:\ProgramData\TEMP:92EDCBF3
AlternateDataStreams: C:\ProgramData\TEMP:98DFF516
AlternateDataStreams: C:\ProgramData\TEMP:9ACB70D7
AlternateDataStreams: C:\ProgramData\TEMP:A31FAD21
AlternateDataStreams: C:\ProgramData\TEMP:ACCFA538
AlternateDataStreams: C:\ProgramData\TEMP:B8AF0F0F
AlternateDataStreams: C:\ProgramData\TEMP:D2C51E3D
AlternateDataStreams: C:\ProgramData\TEMP:E222F217
AlternateDataStreams: C:\ProgramData\TEMP:E5BA9ADD
AlternateDataStreams: C:\ProgramData\TEMP:EA7D76BE
AlternateDataStreams: C:\ProgramData\TEMP:EE7AAC75
AlternateDataStreams: C:\ProgramData\TEMP:F0A06891
AlternateDataStreams: C:\ProgramData\TEMP:F5FC5DCE

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\plsapp => ""="service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Calendar Sync.lnk => C:\Windows\pss\Google Calendar Sync.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Bricks4Kidz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dell Dock.lnk => C:\Windows\pss\Dell Dock.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Bricks4Kidz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AOL Fast Start => "C:\Program Files (x86)\AOL Desktop 9.7a\AOL.EXE" -b
MSCONFIG\startupreg: DellSystemDetect => C:\Users\kevin\AppData\Local\Apps\2.0\OCH5ML9H.C03\Y6EDNOEO.6VT\dell..tion_0f612f649c4a10af_0005.0007_59de4fd2458fcaec\DellSystemDetect.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Bricks4Kidz\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: FlashPlayerUpdate => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe -update plugin
MSCONFIG\startupreg: googletalk => C:\Users\kevin\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
MSCONFIG\startupreg: HostManager => "C:\Program Files (x86)\Common Files\AOL\1232141495\ee\AOLSoftware.exe"
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
MSCONFIG\startupreg: OfficeSyncProcess => "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: RtHDVCpl => RAVCpl64.exe
MSCONFIG\startupreg: Skytel => Skytel.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (08/27/2014 09:19:53 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/27/2014 09:19:53 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/27/2014 09:19:53 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/27/2014 03:26:43 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/27/2014 03:26:43 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/27/2014 03:26:43 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/26/2014 08:36:54 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/26/2014 08:36:54 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/26/2014 08:36:54 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (08/26/2014 04:58:46 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

System errors:
=============
Error: (08/27/2014 03:26:47 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {7F6316B4-4D69-4765-B0A3-B2598F2FA80A}

Error: (08/26/2014 10:08:30 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (08/26/2014 10:06:49 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep
uezndl

Error: (08/26/2014 10:05:58 AM) (Source: HTTP) (EventID: 15021) (User: )
Description: \Device\Http\ReqQueue0.0.0.0:4482

Error: (08/26/2014 09:39:45 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep
uezndl

Error: (08/26/2014 09:38:57 AM) (Source: HTTP) (EventID: 15021) (User: )
Description: \Device\Http\ReqQueue0.0.0.0:4482

Error: (08/25/2014 07:04:48 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep
uezndl

Error: (08/25/2014 07:02:20 PM) (Source: HTTP) (EventID: 15021) (User: )
Description: \Device\Http\ReqQueue0.0.0.0:4482

Error: (08/25/2014 06:32:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep
uezndl

Error: (08/25/2014 06:31:45 PM) (Source: HTTP) (EventID: 15021) (User: )
Description: \Device\Http\ReqQueue0.0.0.0:4482

Microsoft Office Sessions:
=========================
Error: (08/27/2014 09:19:53 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/27/2014 09:19:53 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/27/2014 09:19:53 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/27/2014 03:26:43 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/27/2014 03:26:43 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/27/2014 03:26:43 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/26/2014 08:36:54 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/26/2014 08:36:54 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/26/2014 08:36:54 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

Error: (08/26/2014 04:58:46 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooksReturning NULL QBWinInstance Handle

CodeIntegrity Errors:
===================================
Date: 2014-08-27 21:22:20.753
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:22:20.505
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:22:20.261
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:22:20.006
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:22:19.598
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:22:19.355
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:22:19.109
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:22:18.863
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:21:17.203
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-08-27 21:21:16.931
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 67%
Total physical RAM: 4084.27 MB
Available physical RAM: 1344.79 MB
Total Pagefile: 8405.81 MB
Available Pagefile: 5600.71 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:901.41 GB) (Free:509.65 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:30 GB) (Free:23.73 GB) NTFS
Drive e: (New Volume) (Fixed) (Total:465.76 GB) (Free:419.36 GB) NTFS
Drive f: (files backup) (Fixed) (Total:232.88 GB) (Free:77.96 GB) NTFS
Drive i: (PENDRIVE) (Removable) (Total:29.79 GB) (Free:18.94 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 00DA9FEA)
Partition 1: (Not Active) - (Size=232.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 5BB1415C)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: C871F750)
Partition 1: (Not Active) - (Size=110 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=30 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=901.4 GB) - (Type=07 NTFS)

========================================================
Disk: 4 (Size: 29.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

Here is the FRST file:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 01
Ran by [removed] (administrator) on CZARNOTA-FAMILY on 27-08-2014 21:20:53
Running from C:\Users\[removed]\Desktop
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Windows\System32\AERTSr64.exe
(Carbonite, Inc. (www.carbonite.com)) C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
() C:\Program Files\Macrium\Reflect\ReflectService.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(Intuit Inc.) C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE
(Stoic Joker's Network) C:\Program Files (x86)\Tclock\tclock-x64\Clock.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\aol\1232141495\ee\aolsoftware.exe
(Carbonite, Inc.) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\waol.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\aol\1232141495\ee\aolupdates.exe
(AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\shellmon.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKLM-x32\…\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [2829624 2013-11-08] (Intuit Inc. All rights reserved.)
HKLM-x32\…\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1232141495\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.)
HKLM-x32\…\Run: [Carbonite Backup] => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe [1056976 2014-06-27] (Carbonite, Inc.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\…\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7762712 2014-08-12] (SUPERAntiSpyware)
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [KSS] => "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun
HKU\S-1-5-21-2707694908-3892883027-3287269716-1000\…\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL Desktop 9.7b\AOL.EXE [72296 2014-06-05] (AOL Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (No File)
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
ShortcutTarget: OpenOffice.org 3.0.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stoic Joker's T-Clock x64.lnk
ShortcutTarget: Stoic Joker's T-Clock x64.lnk -> C:\Program Files (x86)\Tclock\tclock-x64\Clock.exe (Stoic Joker's Network)
ShellIconOverlayIdentifiers: Carbonite.Green -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers: Carbonite.Partial -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers: Carbonite.Yellow -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Green -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Partial -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: Carbonite.Yellow -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll (Carbonite, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.techsupportalert.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {32564CED-2EF8-466A-900C-38D268CF8C4A} URL = http://ws.infospace.com/playsushi_tbar/ws/redir?_iceUrl=true&tool;_id=58485&qkw;={searchTerms}
SearchScopes: HKLM-x32 - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL =
SearchScopes: HKCU - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form;=MSSEDF&pc;=MSSE
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?p={searchTerms}&fr;=chr-iobit
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {0AD584EB-F10F-46F7-BCB8-1085C386BEAE} https://merchantaccount.quickbooks.com/recurchrg/IntuitRecurPayCom2009.cab
DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Virtual%20Families/Images/stg_drm.ocx
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {5C709EEC-DDE1-4738-8E57-7564E2637891} https://merchantaccount.quickbooks.com/sync/QBMASSyncCom1_2009.cab
DPF: HKLM-x32 {788539E8-002D-4E59-9089-40B694A99C9A} https://merchantaccount.quickbooks.com/sync/QBMASSyncCom2_2008.cab
DPF: HKLM-x32 {8714912E-380D-11D5-B8AA-00D0B78F3D48} http://chat.yahoo.com/cab/yuplapp.cab
DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB
DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Peggle/Images/armhelper.ocx
Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - No File
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] [removed] [removed]

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default
FF Homepage: hxxp://www.techsupportalert.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MI1933~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin-x32: @ei.Retrogamer_4w.com/Plugin -> C:\Program Files (x86)\Retrogamer_4wEI\Installr\1.bin\NP4wEISB.dll (Retrogamer)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @virtools.com/3DviaPlayer -> C:\Program Files (x86)\Virtools\3D Life Player\npvirtools.dll (Dassault Systèmes)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol500.dll (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\kevin\AppData\Roaming\mozilla\plugins\np-mswmp.dll (Microsoft Corporation)
FF Extension: LogMeIn, Inc. Remote Access Plugin - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2014-06-07]
FF Extension: ArcadeFrontier - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{1a68cbde-3e4c-4fae-bf49-af5ab9868e53} [2014-05-06]
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}-trash [2011-03-09]
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-19]
FF Extension: IE View Lite - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3} [2009-09-14]
FF Extension: SkipScreen - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2011-07-16]
FF Extension: WikiLook - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2011-07-23]
FF Extension: ALLYouTubeDownloader - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\[removed] [2012-09-22]
FF Extension: Flash Block - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\Extensions\{95ab36d4-fb6f-47b0-8b8d-e5f3bd547953}.xpi [2014-08-02]
FF HKLM-x32\…\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-11-20]

Chrome:
=======
CHR Profile: C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-12] (SUPERAntiSpyware.com)
R2 AERTFilters; C:\Windows\system32\AERTSr64.exe [86016 2008-07-28] (Andrea Electronics Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [173344 2007-02-06] (Logitech Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed]
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2013-11-08] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2012-06-05] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2012-06-05] (Intuit Inc.) [File not signed]
R2 ReflectService; C:\Program Files\Macrium\Reflect\ReflectService.exe [301720 2011-07-01] ()
S3 ShowAnalyzerMaster; C:\Program Files (x86)\Dragon Global\ShowAnalyzerSuite\ShowAnalyzerMaster.exe [2074112 2010-02-08] (Dragon Global) [File not signed]
S3 WinDefend; %ProgramFiles(x86)%\Windows Defender\mpsvc.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)
R3 ATIAVPCI; C:\Windows\System32\DRIVERS\atinavrr.sys [1557376 2009-11-04] (ATI Technologies Inc.)
S1 AuviPCI; C:\Windows\System32\DRIVERS\AuviPCI64.sys [1771776 2009-06-30] (Auvitek Corp.) [File not signed]
S1 Beep; No ImagePath
S3 FlyUsb; C:\Windows\System32\DRIVERS\FlyUsb.sys [24576 2007-06-18] (LeapFrog)
R1 GizmoDrv; C:\Windows\System32\Drivers\GizmoDrv.sys [34704 2011-05-30] (Arainia Solutions LLC)
S3 LVcKap64; C:\Windows\System32\DRIVERS\LVcKap64.sys [1013024 2007-02-06] (Logitech Inc.)
S3 LVMVDrv; C:\Windows\System32\DRIVERS\LVMVDrv.sys [2346016 2007-02-06] (Logitech Inc.)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [31520 2007-02-06] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-27] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S3 PSMounter; C:\Windows\system32\drivers\psmounter.sys [40600 2011-07-01] (Macrium Software)
S3 PSVolAcc; C:\Windows\System32\Drivers\PSVolAcc.sys [13464 2011-07-01] (Paramount Software UK Ltd)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-08-03] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-08-03] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SQTECH9052; C:\Windows\System32\Drivers\Capt9052.sys [47680 2008-02-21] (Service & Quality Technology.)
S3 SQTECH905C; C:\Windows\System32\Drivers\Capt905c.sys [44480 2007-05-02] (Service & Quality Technology.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-07-17] ()
S0 uezndl; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-27 10:35 - 2014-08-27 11:52 - 00016477 _____ () C:\Users\Bricks4Kidz\Documents\AlphabeticListingOfModels.xlsx
2014-08-26 20:26 - 2014-08-27 21:22 - 00023513 _____ () C:\Users\kevin\Desktop\FRST.txt
2014-08-26 17:45 - 2014-08-26 18:00 - 00000000 ____D () C:\Users\kevin\Desktop\stephanieProject
2014-08-26 10:01 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-26 10:00 - 2014-08-26 10:03 - 00000000 ____D () C:\AdwCleaner
2014-08-26 09:58 - 2014-08-26 09:59 - 01364531 _____ () C:\Users\kevin\Desktop\adwcleaner_3.308.exe
2014-08-25 22:46 - 2014-08-25 22:46 - 00014717 _____ () C:\Users\Bricks4Kidz\Documents\FieldTripPricing.xlsx
2014-08-25 18:42 - 2014-08-27 21:21 - 00000000 ____D () C:\FRST
2014-08-25 18:42 - 2014-08-25 18:42 - 02103296 _____ (Farbar) C:\Users\kevin\Desktop\FRST64.exe
2014-08-25 18:31 - 2014-08-26 09:39 - 00464632 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 18:30 - 2014-08-26 10:05 - 00202782 _____ () C:\Windows\PFRO.log
2014-08-25 17:56 - 2014-08-27 21:18 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 17:56 - 2014-08-25 17:56 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-25 17:56 - 2014-08-25 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2014-08-25 17:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-25 17:55 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-25 17:55 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-25 17:54 - 2014-08-25 17:54 - 00002596 _____ () C:\Users\kevin\Desktop\aswMBR.txt
2014-08-25 09:12 - 2014-08-25 17:54 - 00000512 _____ () C:\Users\kevin\Desktop\MBR.dat
2014-08-25 09:10 - 2014-08-25 09:10 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\kevin\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-25 09:06 - 2014-08-25 09:06 - 05185536 _____ (AVAST Software) C:\Users\kevin\Desktop\aswMBR.exe
2014-08-24 16:09 - 2014-08-24 16:09 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(6).exe
2014-08-24 16:04 - 2014-08-24 16:04 - 00079991 _____ () C:\Users\Bricks4Kidz\Downloads\silverlight.diagcab
2014-08-24 15:36 - 2014-08-24 15:36 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(5).exe
2014-08-24 08:23 - 2014-08-24 08:23 - 00113776 _____ () C:\Users\kevin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 19:00 - 2014-08-23 19:00 - 00000000 ____D () C:\a3f5a5774bf4325b38922cfb
2014-08-23 18:57 - 2014-08-23 18:57 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(4).exe
2014-08-23 18:56 - 2014-08-23 18:56 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(3).exe
2014-08-22 21:07 - 2014-08-24 19:56 - 00013891 _____ () C:\Users\Bricks4Kidz\Documents\school distance.xlsx
2014-08-22 13:49 - 2014-08-22 13:51 - 76699734 _____ () C:\Users\Bricks4Kidz\Downloads\NXT_Tutorial.zip
2014-08-19 11:28 - 2014-08-19 22:14 - 00013934 _____ () C:\Users\Bricks4Kidz\Documents\09-2014SceduleAll.xlsx
2014-08-12 17:01 - 2014-06-26 17:17 - 01389200 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-12 17:01 - 2014-06-26 17:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-12 17:01 - 2014-06-26 17:17 - 00171152 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-12 17:01 - 2014-06-26 17:17 - 00008848 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-12 17:00 - 2014-06-05 23:29 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-12 17:00 - 2014-06-05 23:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-12 16:59 - 2014-07-24 14:28 - 17861120 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-12 16:59 - 2014-07-24 14:12 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-12 16:59 - 2014-07-24 14:10 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-12 16:59 - 2014-07-24 14:07 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-12 16:59 - 2014-07-24 14:06 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-12 16:59 - 2014-07-24 14:05 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-12 16:59 - 2014-07-24 14:05 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-08-12 16:59 - 2014-07-24 14:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 02155520 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-12 16:59 - 2014-07-24 14:04 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-12 16:59 - 2014-07-24 14:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-12 16:59 - 2014-07-24 14:03 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-08-12 16:59 - 2014-07-24 14:03 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-08-12 16:59 - 2014-07-24 14:03 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-08-12 16:59 - 2014-07-24 14:02 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-12 16:59 - 2014-07-24 13:07 - 12356608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-12 16:59 - 2014-07-24 12:58 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-12 16:59 - 2014-07-24 12:57 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-12 16:59 - 2014-07-24 12:52 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-12 16:59 - 2014-07-24 12:51 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-12 16:59 - 2014-07-24 12:51 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-12 16:59 - 2014-07-24 12:50 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-08-12 16:59 - 2014-07-24 12:50 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-12 16:59 - 2014-07-24 12:49 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-12 16:59 - 2014-07-24 12:48 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-12 16:59 - 2014-07-24 12:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-08-12 16:59 - 2014-07-24 12:48 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-08-12 16:59 - 2014-07-24 12:48 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-08-12 16:59 - 2014-07-24 12:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-12 16:58 - 2014-07-24 23:27 - 00304128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-12 16:58 - 2014-07-24 23:18 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-12 16:58 - 2014-07-24 22:15 - 02781696 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-12 16:58 - 2014-07-07 20:12 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-12 16:58 - 2014-07-07 19:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-12 16:58 - 2014-06-13 19:56 - 00901568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-12 16:58 - 2014-06-13 19:51 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-12 16:57 - 2014-06-02 16:30 - 03137536 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-12 16:56 - 2014-06-02 16:30 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-12 16:56 - 2014-06-02 16:29 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-12 16:56 - 2014-06-02 16:29 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-08-12 16:56 - 2014-06-02 15:29 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-12 16:56 - 2014-06-02 05:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-12 16:56 - 2014-06-02 05:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-12 16:56 - 2014-06-02 05:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-11 15:41 - 2014-07-25 12:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-11 15:41 - 2014-07-25 12:49 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-11 15:41 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-11 15:41 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-11 15:40 - 2014-08-11 15:41 - 00005618 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-11 15:37 - 2014-08-11 15:38 - 00918952 _____ (Oracle Corporation) C:\Users\kids\Downloads\jxpiinstall(3).exe
2014-08-02 20:38 - 2014-08-02 20:38 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\New Folder
2014-07-30 20:37 - 2014-07-30 20:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-30 18:45 - 2014-07-30 18:45 - 00004170 _____ () C:\Windows\System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4}
2014-07-30 18:45 - 2014-07-30 18:45 - 00001969 _____ () C:\Users\Public\Desktop\Carbonite InfoCenter.lnk
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files (x86)\Carbonite
2014-07-30 16:53 - 2014-08-15 08:17 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\XBMC
2014-07-30 16:41 - 2014-07-30 16:41 - 00375958 _____ () C:\Users\kevin\AppData\Local\dd_vcredistMSI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00011190 _____ () C:\Users\kevin\AppData\Local\dd_vcredistUI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XBMC

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-27 21:22 - 2014-08-26 20:26 - 00023513 _____ () C:\Users\kevin\Desktop\FRST.txt
2014-08-27 21:21 - 2014-08-25 18:42 - 00000000 ____D () C:\FRST
2014-08-27 21:20 - 2010-12-26 22:17 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-08-27 21:18 - 2014-08-25 17:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-27 21:18 - 2011-10-31 11:36 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Outlook Files
2014-08-27 20:06 - 2006-11-02 10:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-27 20:06 - 2006-11-02 10:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-27 20:03 - 2014-04-03 16:49 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e55b0dc4-9b61-4c31-ade5-7aa4f33ac245.job
2014-08-27 19:19 - 2014-07-21 21:42 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\BBVACompassOpenPositions7.14.14
2014-08-27 19:15 - 2011-10-28 16:07 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Legal
2014-08-27 19:00 - 2011-10-31 11:32 - 00002643 _____ () C:\Users\Bricks4Kidz\Desktop\Microsoft Outlook 2010.lnk
2014-08-27 13:55 - 2011-10-29 21:30 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Receipts
2014-08-27 11:59 - 2012-12-04 20:11 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Labels
2014-08-27 11:52 - 2014-08-27 10:35 - 00016477 _____ () C:\Users\Bricks4Kidz\Documents\AlphabeticListingOfModels.xlsx
2014-08-27 10:24 - 2014-04-30 18:48 - 01384798 _____ () C:\Windows\WindowsUpdate.log
2014-08-27 09:09 - 2012-03-05 08:40 - 00002637 _____ () C:\Users\Bricks4Kidz\Desktop\Microsoft Word 2010.lnk
2014-08-27 07:54 - 2009-12-04 20:08 - 00000000 ____D () C:\Users\kevin\Documents\FOOD
2014-08-27 03:03 - 2014-02-09 15:42 - 00000510 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task a00d761c-5b80-4a6f-8e41-11857ef8a885.job
2014-08-27 02:00 - 2014-02-09 15:42 - 00000510 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 8b753a4f-7f81-44f0-93e1-52469fd63d88.job
2014-08-27 01:00 - 2012-12-08 13:13 - 00000562 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 496ce132-741c-4714-94e8-e5e2782636c9.job
2014-08-27 00:55 - 2012-12-08 13:13 - 00000562 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 61633aab-dd87-4057-995b-e285d11a22d8.job
2014-08-26 18:00 - 2014-08-26 17:45 - 00000000 ____D () C:\Users\kevin\Desktop\stephanieProject
2014-08-26 17:54 - 2012-08-04 11:18 - 00016896 _____ () C:\Users\kevin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-26 16:57 - 2009-01-16 16:20 - 00000000 ____D () C:\TEMP
2014-08-26 10:16 - 2009-01-17 14:31 - 00000000 ____D () C:\Users\kevin\Documents\insurance
2014-08-26 10:09 - 2010-04-26 13:58 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-08-26 10:05 - 2014-08-25 18:30 - 00202782 _____ () C:\Windows\PFRO.log
2014-08-26 10:05 - 2006-11-02 10:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-26 10:03 - 2014-08-26 10:00 - 00000000 ____D () C:\AdwCleaner
2014-08-26 10:03 - 2006-11-02 10:42 - 00032598 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-26 09:59 - 2014-08-26 09:58 - 01364531 _____ () C:\Users\kevin\Desktop\adwcleaner_3.308.exe
2014-08-26 09:39 - 2014-08-25 18:31 - 00464632 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 22:49 - 2014-07-16 22:11 - 00260096 _____ () C:\Users\Bricks4Kidz\Documents\Brictek price list US 20140630.xls
2014-08-25 22:46 - 2014-08-25 22:46 - 00014717 _____ () C:\Users\Bricks4Kidz\Documents\FieldTripPricing.xlsx
2014-08-25 21:39 - 2012-08-12 13:19 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Artwork-blankFlyers
2014-08-25 18:42 - 2014-08-25 18:42 - 02103296 _____ (Farbar) C:\Users\kevin\Desktop\FRST64.exe
2014-08-25 17:56 - 2014-08-25 17:56 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-25 17:56 - 2014-08-25 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-25 17:56 - 2014-08-25 17:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-25 17:55 - 2012-03-22 10:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 17:54 - 2014-08-25 17:54 - 00002596 _____ () C:\Users\kevin\Desktop\aswMBR.txt
2014-08-25 17:54 - 2014-08-25 09:12 - 00000512 _____ () C:\Users\kevin\Desktop\MBR.dat
2014-08-25 09:10 - 2014-08-25 09:10 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\kevin\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-25 09:06 - 2014-08-25 09:06 - 05185536 _____ (AVAST Software) C:\Users\kevin\Desktop\aswMBR.exe
2014-08-24 19:56 - 2014-08-22 21:07 - 00013891 _____ () C:\Users\Bricks4Kidz\Documents\school distance.xlsx
2014-08-24 16:09 - 2014-08-24 16:09 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(6).exe
2014-08-24 16:04 - 2014-08-24 16:04 - 00079991 _____ () C:\Users\Bricks4Kidz\Downloads\silverlight.diagcab
2014-08-24 15:36 - 2014-08-24 15:36 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(5).exe
2014-08-24 08:23 - 2014-08-24 08:23 - 00113776 _____ () C:\Users\kevin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 19:00 - 2014-08-23 19:00 - 00000000 ____D () C:\a3f5a5774bf4325b38922cfb
2014-08-23 18:57 - 2014-08-23 18:57 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(4).exe
2014-08-23 18:56 - 2014-08-23 18:56 - 13087456 _____ (Microsoft Corporation) C:\Users\Bricks4Kidz\Downloads\Silverlight_x64(3).exe
2014-08-23 08:51 - 2009-01-16 15:22 - 00000000 ____D () C:\Users\kevin
2014-08-23 07:59 - 2011-02-26 11:29 - 00000000 ____D () C:\Users\kevin\Desktop\highjackthis
2014-08-23 07:59 - 2009-01-16 15:22 - 00000000 ____D () C:\Users\kevin\AppData\Local\VirtualStore
2014-08-22 13:51 - 2014-08-22 13:49 - 76699734 _____ () C:\Users\Bricks4Kidz\Downloads\NXT_Tutorial.zip
2014-08-22 12:00 - 2012-04-09 07:10 - 00000000 ____D () C:\Users\Bricks4Kidz\AppData\Roaming\vlc
2014-08-22 11:57 - 2011-12-20 14:16 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Mindstorm
2014-08-21 18:26 - 2013-01-13 22:13 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\BirthdayParties
2014-08-19 22:14 - 2014-08-19 11:28 - 00013934 _____ () C:\Users\Bricks4Kidz\Documents\09-2014SceduleAll.xlsx
2014-08-18 03:34 - 2013-01-21 17:48 - 00000000 ____D () C:\Users\Bricks4Kidz\AppData\Roaming\.minecraft
2014-08-16 08:23 - 2006-11-02 07:46 - 00763610 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-15 08:17 - 2014-07-30 16:53 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\XBMC
2014-08-12 17:42 - 2006-11-02 08:33 - 00000000 ____D () C:\Windows\rescache
2014-08-12 17:15 - 2013-07-11 23:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-12 17:09 - 2006-11-02 07:35 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-12 06:43 - 2011-10-23 20:40 - 00000000 ____D () C:\Users\Bricks4Kidz
2014-08-11 15:47 - 2009-11-22 12:58 - 00000000 ____D () C:\Users\kids\AppData\Roaming\AOL
2014-08-11 15:47 - 2009-01-26 15:07 - 00000000 ____D () C:\Users\kids\AppData\Local\AOL
2014-08-11 15:42 - 2013-10-15 17:33 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-11 15:41 - 2014-08-11 15:40 - 00005618 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-11 15:41 - 2009-01-14 00:31 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-11 15:38 - 2014-08-11 15:37 - 00918952 _____ (Oracle Corporation) C:\Users\kids\Downloads\jxpiinstall(3).exe
2014-08-08 16:15 - 2009-09-24 09:43 - 00000000 ____D () C:\Users\Carla\AppData\Roaming\vlc
2014-08-07 16:40 - 2013-04-23 00:20 - 00000680 _____ () C:\Users\Bricks4Kidz\AppData\Local\d3d9caps.dat
2014-08-06 20:04 - 2011-10-24 09:37 - 00024576 _____ () C:\Users\Bricks4Kidz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-02 20:39 - 2012-04-14 07:03 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\games
2014-08-02 20:38 - 2014-08-02 20:38 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\New Folder
2014-08-01 14:30 - 2012-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-31 15:04 - 2012-07-27 13:52 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\Invoices
2014-07-30 20:38 - 2014-07-30 20:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-30 18:45 - 2014-07-30 18:45 - 00004170 _____ () C:\Windows\System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4}
2014-07-30 18:45 - 2014-07-30 18:45 - 00001969 _____ () C:\Users\Public\Desktop\Carbonite InfoCenter.lnk
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\ProgramData\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files\Carbonite
2014-07-30 18:45 - 2014-07-30 18:45 - 00000000 ____D () C:\Program Files (x86)\Carbonite
2014-07-30 16:41 - 2014-07-30 16:41 - 00375958 _____ () C:\Users\kevin\AppData\Local\dd_vcredistMSI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00011190 _____ () C:\Users\kevin\AppData\Local\dd_vcredistUI775A.txt
2014-07-30 16:41 - 2014-07-30 16:41 - 00000000 ____D () C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XBMC
2014-07-30 16:41 - 2011-03-11 12:59 - 00000000 ____D () C:\Program Files (x86)\XBMC
2014-07-29 07:56 - 2014-07-27 20:54 - 00009628 _____ () C:\Users\Bricks4Kidz\Documents\Leigh Brown Camp Payment Rate.xlsx
2014-07-28 23:11 - 2013-07-06 10:15 - 00000000 ____D () C:\Users\Bricks4Kidz\Documents\StopMotion

Some content of TEMP:
====================
C:\Users\kevin\AppData\Local\temp\Quarantine.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-08-27 10:55

==================== End Of Log ============================

Thank you for your help.

ken545

Post #12August 28, 2014, 12:28 PM UTC

Morning,

You have a ton of games installed, not that there's anything wrong with that but games sometimes can cause problems and you have a bunch.

Read this about Strongvault, you may want to uninstall it

http://www.shouldiremoveit.com/Strongvault-Online-Backup-5198-program.aspx

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

See this Link for programs that need to be disabled and instruction on how to disable them.

Remember to re-enable them when we're done.

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: RC1.png]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: RC2-1.png]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.[/color

kevin_czarnota

Post #13August 29, 2014, 1:43 PM UTC

Here is the log file:

ComboFix 14-08-29.03 - kevin 08/29/2014   8:25.3.2 - x64
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.4084.1773 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\search-metadata.json
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((   Files Created from 2014-07-28 to 2014-08-29 )))))))))))))))))))))))))))))))
.
.
2014-08-29 13:36 . 2014-08-29 13:36   ——–   d—–w-   c:\users\Public\AppData\Local\temp
2014-08-29 13:36 . 2014-08-29 13:36   ——–   d—–w-   c:\users\Default\AppData\Local\temp
2014-08-29 13:36 . 2014-08-29 13:36   ——–   d—–w-   c:\users\Carla\AppData\Local\temp
2014-08-29 12:27 . 2014-08-20 14:02   1169712   —-a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0738A973-D264-4232-8246-E3EB84B5C160}\gapaengine.dll
2014-08-29 12:24 . 2014-08-21 03:43   11319192   —-a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1F86F4B8-E805-4389-80C5-897B85D24AC6}\mpengine.dll
2014-08-28 12:00 . 2014-08-23 01:05   304128   —-a-w-   c:\windows\SysWow64\gdi32.dll
2014-08-28 12:00 . 2014-08-23 00:42   390144   —-a-w-   c:\windows\system32\gdi32.dll
2014-08-28 12:00 . 2014-08-22 23:38   2782208   —-a-w-   c:\windows\system32\win32k.sys
2014-08-27 15:18 . 2014-08-21 03:43   11319192   —-a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-08-26 15:01 . 2010-08-30 13:34   536576   —-a-w-   c:\windows\SysWow64\sqlite3.dll
2014-08-26 15:00 . 2014-08-26 15:03   ——–   d—–w-   C:\AdwCleaner
2014-08-25 23:42 . 2014-08-28 02:23   ——–   d—–w-   C:\FRST
2014-08-25 22:56 . 2014-08-29 13:07   122584   —-a-w-   c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-25 22:55 . 2014-05-12 12:26   64216   —-a-w-   c:\windows\system32\drivers\mwac.sys
2014-08-25 22:55 . 2014-05-12 12:26   91352   —-a-w-   c:\windows\system32\drivers\mbamchameleon.sys
2014-08-25 22:55 . 2014-05-12 12:25   25816   —-a-w-   c:\windows\system32\drivers\mbam.sys
2014-08-25 22:55 . 2014-08-25 22:56   ——–   d—–w-   c:\program files (x86)\Malwarebytes Anti-Malware
2014-08-24 00:00 . 2014-08-24 00:00   ——–   d—–w-   C:\a3f5a5774bf4325b38922cfb
2014-08-20 14:07 . 2014-08-20 14:02   1169712   ——w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AC21D695-178F-4CA4-9E36-8DE55DE9633E}\gapaengine.dll
2014-08-12 22:01 . 2014-06-26 22:17   171152   —-a-w-   c:\windows\system32\infocardapi.dll
2014-08-12 22:01 . 2014-06-26 22:17   1389200   —-a-w-   c:\windows\system32\icardagt.exe
2014-08-12 22:01 . 2014-06-26 22:17   99480   —-a-w-   c:\windows\SysWow64\infocardapi.dll
2014-08-12 22:01 . 2014-06-26 22:17   8856   —-a-w-   c:\windows\SysWow64\icardres.dll
2014-08-12 22:01 . 2014-06-26 22:17   619664   —-a-w-   c:\windows\SysWow64\icardagt.exe
2014-08-12 22:01 . 2014-06-26 22:17   8848   —-a-w-   c:\windows\system32\icardres.dll
2014-08-12 22:00 . 2014-06-06 04:29   35480   —-a-w-   c:\windows\system32\TsWpfWrp.exe
2014-08-12 22:00 . 2014-06-06 04:28   35480   —-a-w-   c:\windows\SysWow64\TsWpfWrp.exe
2014-08-12 21:58 . 2014-07-08 01:12   2048   —-a-w-   c:\windows\system32\tzres.dll
2014-08-12 21:58 . 2014-07-08 00:46   2048   —-a-w-   c:\windows\SysWow64\tzres.dll
2014-08-12 21:58 . 2014-06-14 00:56   901568   —-a-w-   c:\windows\system32\drivers\dxgkrnl.sys
2014-08-12 21:58 . 2014-06-14 00:51   47104   —-a-w-   c:\windows\system32\cdd.dll
2014-08-12 21:57 . 2014-06-02 21:30   3137536   —-a-w-   c:\windows\system32\msi.dll
2014-08-12 21:56 . 2014-06-02 21:30   503296   —-a-w-   c:\windows\system32\msihnd.dll
2014-08-12 21:56 . 2014-06-02 21:29   2280448   —-a-w-   c:\windows\system32\authui.dll
2014-08-12 21:56 . 2014-06-02 21:29   45056   —-a-w-   c:\windows\system32\appinfo.dll
2014-08-12 21:56 . 2014-06-02 20:29   87552   —-a-w-   c:\windows\system32\consent.exe
2014-08-12 21:56 . 2014-06-02 10:31   2263552   —-a-w-   c:\windows\SysWow64\msi.dll
2014-08-12 21:56 . 2014-06-02 10:30   1993728   —-a-w-   c:\windows\SysWow64\authui.dll
2014-08-12 21:56 . 2014-06-02 10:31   332800   —-a-w-   c:\windows\SysWow64\msihnd.dll
2014-08-11 20:41 . 2014-08-11 20:41   ——–   d—–w-   c:\program files (x86)\Common Files\Java
2014-08-11 20:41 . 2014-07-25 17:55   98216   —-a-w-   c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-30 23:45 . 2014-07-30 23:45   ——–   d—–w-   c:\program files\Carbonite
2014-07-30 23:45 . 2014-07-30 23:45   ——–   d—–w-   c:\programdata\Carbonite
2014-07-30 23:45 . 2014-07-30 23:45   ——–   d—–w-   c:\program files (x86)\Carbonite
2014-07-30 21:53 . 2014-08-15 13:17   ——–   d—–w-   c:\users\kevin\AppData\Roaming\XBMC
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-20 14:02 . 2013-03-12 19:13   1169712   —-a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-08-12 22:09 . 2006-11-02 12:35   99218768   —-a-w-   c:\windows\system32\mrt.exe
2014-06-16 15:13 . 2014-07-13 01:51   33056   —-a-w-   c:\windows\system32\novamnv7.dll
2014-06-16 15:13 . 2014-07-13 01:51   22304   —-a-w-   c:\windows\system32\novamiv7.dll
2014-06-07 15:30 . 2013-08-18 01:51   70832   —-a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-06-07 15:30 . 2013-08-18 01:51   692400   —-a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2014-06-06 08:59 . 2014-07-09 04:08   506880   —-a-w-   c:\windows\SysWow64\qedit.dll
2014-06-06 07:13 . 2014-07-09 04:08   620032   —-a-w-   c:\windows\system32\qedit.dll
2014-06-05 22:36 . 2011-02-20 04:10   58696   —-a-w-   c:\windows\SysWow64\AOLParconLink.exe
2014-06-05 21:31 . 2014-06-05 21:31   499712   —-a-w-   c:\windows\SysWow64\msvcp71.dll
2014-06-05 21:31 . 2014-06-05 21:31   348160   —-a-w-   c:\windows\SysWow64\msvcr71.dll
2008-09-30 16:29 . 2008-09-30 16:29   9772544   ——w-   c:\program files (x86)\openofficeorg30.msi
2002-03-11 09:06 . 2002-03-11 09:06   1822520   ——w-   c:\program files (x86)\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45   1708856   ——w-   c:\program files (x86)\instmsia.exe
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2014-06-27 19:27   1020624   —-a-r-   c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2014-06-27 19:27   1020624   —-a-r-   c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2014-06-27 19:27   1020624   —-a-r-   c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-08-12 7762712]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"AOL Fast Start"="c:\program files (x86)\AOL Desktop 9.7b\AOL.EXE" [2014-06-05 72296]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Intuit SyncManager"="c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2013-11-08 2829624]
"HostManager"="c:\program files (x86)\Common Files\AOL\1232141495\ee\AOLSoftware.exe" [2010-03-08 41800]
"Carbonite Backup"="c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe" [2014-06-27 1056976]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
.
c:\users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stoic Joker's T-Clock x64.lnk - c:\program files (x86)\Tclock\tclock-x64\Clock.exe [2009-5-4 156160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Intuit Data Protect.lnk - c:\program files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe /Startup [2013-11-8 6306104]
QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2013-11-8 1176904]
QuickBooks_Standard_21.lnk - c:\program files (x86)\Intuit\QuickBooks 2012\QBW32.EXE -silent [2013-11-8 1182024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 2 (0x2)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options]
"Debugger"=svchost.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSr64.exe;c:\windows\SYSNATIVE\AERTSr64.exe [x]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - ATWPKT2
*Deregistered* - ATWPKT2
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2014-08-29 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 496ce132-741c-4714-94e8-e5e2782636c9.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-08-03 22:03]
.
2014-08-29 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 61633aab-dd87-4057-995b-e285d11a22d8.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-08-03 22:03]
.
2014-08-29 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 8b753a4f-7f81-44f0-93e1-52469fd63d88.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-08-03 22:03]
.
2014-08-29 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task a00d761c-5b80-4a6f-8e41-11857ef8a885.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-08-03 22:03]
.
2014-08-29 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task e55b0dc4-9b61-4c31-ade5-7aa4f33ac245.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-08-03 22:03]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2014-06-27 19:15   1293520   —-a-r-   c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2014-06-27 19:15   1293520   —-a-r-   c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2014-06-27 19:15   1293520   —-a-r-   c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-06-21 1356240]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-16 154648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-16 227352]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-16 202264]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.techsupportalert.com/
uLocal Page = c:\windows\system32\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
Trusted Zone: dell.com
TCP: DhcpNameServer = [removed] [removed]
DPF: {0AD584EB-F10F-46F7-BCB8-1085C386BEAE} - hxxps://merchantaccount.quickbooks.com/recurchrg/IntuitRecurPayCom2009.cab
DPF: {5C709EEC-DDE1-4738-8E57-7564E2637891} - hxxps://merchantaccount.quickbooks.com/sync/QBMASSyncCom1_2009.cab
DPF: {788539E8-002D-4E59-9089-40B694A99C9A} - hxxps://merchantaccount.quickbooks.com/sync/QBMASSyncCom2_2008.cab
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\tu1flxa4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.techsupportalert.com/
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-KSS - c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe
c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@DACL=(02 0011)
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
@DACL=(02 0011)
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@DACL=(02 0011)
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@DACL=(02 0011)
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{80c554b9-c7f8-4a21-9471-06d606da78a2}]
@DACL=(02 0000)
"DisplayName"="Bing"
"URL"="http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE"
"SuggestionsURL"="http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&form=MSSEDF&pc=MSSE&market={language}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2014-08-29 08:40:46
ComboFix-quarantined-files.txt 2014-08-29 13:40
.
Pre-Run: 682,660,945,920 bytes free
Post-Run: 682,800,402,432 bytes free
.
- - End Of File - - D6B1AE7B40DEE9E2747152DAB38E8ECC
5C616939100B85E558DA92B899A0FC36

Can I use any of the tools you had me download for normal malware maintenance unassisted?

ken545

Post #14August 29, 2014, 2:05 PM UTC last edited August 29, 2014, 2:09 PM UTC

Hi,

Combofix is a great tool for removing malware, it doesn't look like it found and removed much, thats good. But being a helper on the forums like I am , I am updated and kept in the loop are far as any problems with any of our tools. Example, one of the great scanners we have used to detect and remove malware is called OTL by OldTimer, its still a great tool but can cause some problems on Windows 8. Last year Combofix was pulled off line for a few days because it also caused some damage, but it was fixed and made available for download again. The people that post here for help and not aware of these things so what I am trying to say is its best if you or any friends have problems to post in the forum and we can decide what the best tool is to run .

You can download and install Malwarebytes on any computer, the free version will let you update, scan for threats and remove them, the Pro Version offers a Protection module that blocks bad sites from loading, the choice on this is up to you

What I would suggest is posting in our windows forum as I dont believe at this point that your slowdown is malware related. I will leave this thread open for you for a few more days in case you need to post back

http://forums.whatthetech.com/index.php?showforum=119

Good luck,

Ken

ken545

Post #15September 2, 2014, 9:50 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

system has slowed to a crawl [Solved]

✨ Ask AI

Ask AI