What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Powershell has stopped working [Solved]

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

I've seen this same error going around and I believe I have an infection. I'm running windows pro 7 and the 64 bit operating system. I've run my anti-virus (which did not help) and my computer is barely moving. I did run both of the scans as requested and here are the logs. First, from the ASWMBR scan:

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2014-12-21 15:27:44
—————————–
15:27:44.581    OS Version: Windows x64 6.1.7601 Service Pack 1
15:27:44.591    Number of processors: 4 586 0x2A07
15:27:44.596    ComputerName: ROB-HP  UserName: Rob
15:28:11.652    Initialize success
15:28:12.453    VM: initialized successfully
15:28:12.455    VM: Intel CPU BiosDisabled 
15:29:03.418    AVAST engine defs: 14122101
15:29:09.587    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
15:29:09.589    Disk 0 Vendor: Hitachi_ EC2O Size: 305245MB BusType: 3
15:29:10.868    Disk 0 MBR read successfully
15:29:10.870    Disk 0 MBR scan
15:29:11.488    Disk 0 Windows 7 default MBR code
15:29:11.570    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          300 MB offset 2048
15:29:11.715    Disk 0 default boot code
15:29:11.975    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       285463 MB offset 616448
15:29:12.425    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        14358 MB offset 585244672
15:29:12.470    Disk 0 Partition 4 00     0C    FAT32 LBA MSDOS5.0     5115 MB offset 614649856
15:29:13.695    Disk 0 scanning C:\windows\system32\drivers
15:30:45.637    Service scanning
15:31:28.410    Modules scanning
15:31:28.410    Disk 0 trace - called modules:
15:31:28.457    ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys ACPI.sys iaStor.sys hal.dll 
15:31:28.473    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006662060]
15:31:28.473    3 CLASSPNP.SYS[fffff88001ae643f] -> nt!IofCallDriver -> [0xfffffa80048f3850]
15:31:28.473    5 hpdskflt.sys[fffff880013e8379] -> nt!IofCallDriver -> [0xfffffa800475d6c0]
15:31:28.473    7 ACPI.sys[fffff88000d7b7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0xfffffa800475e050]
15:31:32.206    AVAST engine scan C:\windows
15:31:43.984    AVAST engine scan C:\windows\system32
15:44:21.589    AVAST engine scan C:\windows\system32\drivers
15:45:00.823    AVAST engine scan C:\Users\Rob
17:32:08.934    File: C:\Users\Rob\AppData\LocalLow\bvtddfg.dll  **INFECTED** Win32:Dropper-gen [Drp]
19:40:30.537    AVAST engine scan C:\ProgramData
20:14:16.928    Disk 0 statistics 6765387/0/0 @ 0.25 MB/s
20:14:17.028    Scan finished successfully
21:20:26.732    Disk 0 MBR has been saved successfully to "C:\Users\Rob\Desktop\MBR.dat"
21:20:27.507    The log file has been saved successfully to "C:\Users\Rob\Desktop\aswMBR.txt"
 
Here is the information from the Farbar scan:
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 01
Ran by [removed] (administrator) on ROB-HP on 21-12-2014 12:27:09
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchService.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\BCMWLTRY.EXE
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXSPMGT.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXTCS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Amazon.com) C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
() C:\Program Files\WTouch\WTouchUser.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Dropbox, Inc.) C:\Users\Rob\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Webroot) C:\Users\Rob\AppData\Local\Temp\WRupdate413855.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Webroot) C:\Users\Rob\AppData\Local\Temp\WRupdate939157.exe
(Webroot) C:\Users\Rob\AppData\Local\Temp\WRupdate1678882.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Webroot) C:\Users\Rob\AppData\Local\Temp\WRupdate14030698.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Webroot) C:\Users\Rob\AppData\Local\Temp\WRupdate14627667.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Webroot) C:\Users\Rob\AppData\Local\Temp\WRupdate15020462.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmmon32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2816240 2014-10-27] (Synaptics Incorporated)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [WRSVC] => C:\Program Files\Webroot\WRSA.exe [775872 2014-11-09] (Webroot)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\…\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-12-02] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22869088 2014-10-21] (Google)
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Policies\Explorer: [NoDesktopCleanupWizard] 1
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\MountPoints2: {29d1d11e-6033-11e1-a949-2c27d77f7d6d} - D:\LaunchU3.exe
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\MountPoints2: {5c2559fc-d67b-11e0-8cbb-2c27d77f7d6d} - G:\LaunchU3.exe -a
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\MountPoints2: {8e0c8c1d-8874-11e4-8d7e-2c27d77f7d6d} - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\MountPoints2: {9010a979-c7b2-11e0-9199-2c27d77f7d6d} - D:\Welcome\Welcome.exe
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\MountPoints2: {f3e42a7e-66e2-11e4-a08a-ac8112a03d85} - D:\mri.exe
HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks!
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l;=dis&o;=CMNTDF
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=chr-hp-psg&type;=CMNTDF
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = http://www.bing.com/search?q={searchTerms}&form;=CMNTDF&pc;=CMNTDF&src;=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-21-2596615249-950003756-3831691080-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-21-2596615249-950003756-3831691080-1001 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-2596615249-950003756-3831691080-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com//activex/x64/ractrl.cab?lmi=1007
DPF: HKLM-x32 {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com//activex/ractrl.cab?lmi=1091
Handler-x32: intu-help-qb7 - {5A03BD9D-766D-47A6-8E87-CD90F60BE245} - C:\Program Files (x86)\Intuit\QuickBooks 2014\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76 192.168.1.1
 
FireFox:
========
FF ProfilePath: C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\z8247kv4.default
FF DefaultSearchUrl: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3309350&CUI;=UN19638847329023226&UM;=2&SearchSource;=3&q;={searchTerms}
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-2596615249-950003756-3831691080-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Rob\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKU\S-1-5-21-2596615249-950003756-3831691080-1001: @sony.com/Some -> C:\Program Files (x86)\Sony\Bloggie Software\npsome.dll (Sony)
FF user.js: detected! => C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\z8247kv4.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\z8247kv4.default\searchplugins\browserplus2-customized-web-search.xml
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-01-21]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2014-10-27]
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "https://www.google.com/"
CHR Profile: C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-30]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-25]
CHR Extension: (YouTube) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-12]
CHR Extension: (Google Search) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-12]
CHR Extension: (The QR Code Generator) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcmhlmapohffdglflokbgknlknnmogbb [2014-11-03]
CHR Extension: (Cisco WebEx Extension) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlhmfgmfgeifomenelglieieghnjghma [2014-11-23]
CHR Extension: (Google Wallet) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (Gmail) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-12]
CHR HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Rob\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-11-30]
CHR HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Chrome\Extension: [iigplimlmgilpobjilfbfeilnpiigpgl] - C:\Users\Rob\AppData\Local\CRE\iigplimlmgilpobjilfbfeilnpiigpgl.crx [2013-08-27]
CHR HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path
CHR HKLM-x32\…\Chrome\Extension: [iigplimlmgilpobjilfbfeilnpiigpgl] - C:\Users\Rob\AppData\Local\CRE\iigplimlmgilpobjilfbfeilnpiigpgl.crx [2013-08-27]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 ADVService; C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe [25704 2011-11-23] (Amazon.com) [File not signed]
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [486224 2011-11-10] (DigitalPersona, Inc.)
R2 Fitbit Connect; C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [1436192 2014-05-19] (Fitbit, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [476728 2011-09-05] (Hewlett-Packard Company)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [320512 2011-05-09] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [523680 2012-06-20] (Hewlett-Packard Company)
R2 IFXSpMgtSrv; C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1126264 2011-08-29] (Infineon Technologies AG)
R2 IFXTCS; C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxtcs.exe [980856 2011-08-29] (Infineon Technologies AG)
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1323008 2013-02-01] () [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 PersonalSecureDriveService; C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe [203640 2011-08-29] (Infineon Technologies AG)
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2014-06-26] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2013-12-02] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2013-12-02] (Intuit Inc.) [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [323072 2012-11-18] (IDT, Inc.) [File not signed]
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe [5878272 2014-01-19] (Broadcom Corporation) [File not signed]
S2 WRSVC; C:\Program Files\Webroot\WRSA.exe [775872 2014-11-09] (Webroot)
R2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [114544 2011-01-07] (Wacom Technology, Corp.)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-03-03] (Hewlett-Packard Company)
R3 HBtnKey; C:\Windows\System32\DRIVERS\cpqbttn.sys [17720 2011-07-26] (Hewlett-Packard Company)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-08] (QUALCOMM Incorporated)
S3 johci; C:\Windows\System32\DRIVERS\johci.sys [26208 2013-01-27] (JMicron Technology Corp.)
R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [101288 2013-02-01] (McAfee, Inc.)
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158888 2013-02-01] (McAfee, Inc.)
R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [44576 2011-08-29] (Infineon Technologies AG)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1826048 2010-12-21] ()
R3 WacomVTHid; C:\Windows\System32\DRIVERS\WacomVTHid.sys [16368 2011-01-07] (Wacom Technology)
R3 wisdpen; C:\Windows\System32\DRIVERS\wisdpen.sys [44656 2011-01-07] (Wacom Technology)
R0 WRkrn; C:\Windows\System32\drivers\WRkrn.sys [114176 2014-11-09] (Webroot)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-12-21 12:27 - 2014-12-21 12:28 - 00023834 _____ () C:\Users\Rob\Desktop\FRST.txt
2014-12-21 12:26 - 2014-12-21 12:27 - 00000000 ____D () C:\FRST
2014-12-21 12:24 - 2014-12-21 12:24 - 02122240 _____ (Farbar) C:\Users\Rob\Desktop\FRST64.exe
2014-12-17 22:27 - 2014-12-12 22:09 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-12-17 22:27 - 2014-12-12 20:33 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-12-16 20:50 - 2014-12-16 20:51 - 00000000 ____D () C:\Users\Rob\AppData\Local\{F874E1F6-3649-4623-A2D5-63F80E819275}
2014-12-15 19:26 - 2014-12-15 19:27 - 00000000 ____D () C:\Users\Rob\AppData\Local\{1423D1EB-CEA1-44C2-851E-237DB3A4D0B1}
2014-12-15 14:43 - 2014-12-15 14:43 - 00000103 _____ () C:\Users\Rob\Desktop\mkx01401.ini
2014-12-15 14:43 - 2014-12-15 14:43 - 00000000 ____D () C:\Users\Rob\Desktop\01401
2014-12-12 17:41 - 2014-12-12 17:41 - 00000000 ____D () C:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Drive
2014-12-12 17:41 - 2014-12-12 17:41 - 00000000 ____D () C:\Users\Rob\AppData\Local\Amazon Cloud Drive
2014-12-10 03:26 - 2014-12-10 03:26 - 00000000 ____D () C:\windows\system32\appraiser
2014-12-10 03:03 - 2014-10-17 19:05 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2014-12-10 03:03 - 2014-10-17 18:33 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2014-12-10 03:03 - 2014-07-06 19:06 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2014-12-10 03:03 - 2014-07-06 19:06 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2014-12-10 03:03 - 2014-07-06 19:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2014-12-10 03:03 - 2014-07-06 19:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2014-12-10 03:03 - 2014-07-06 18:40 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2014-12-10 03:03 - 2014-07-06 18:39 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2014-12-10 03:03 - 2014-07-06 18:39 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2014-12-10 03:03 - 2014-07-06 18:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2014-12-09 20:17 - 2014-12-03 19:50 - 00830976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2014-12-09 20:17 - 2014-12-03 19:50 - 00741376 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2014-12-09 20:17 - 2014-12-03 19:50 - 00413184 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-12-09 20:17 - 2014-12-03 19:50 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2014-12-09 20:17 - 2014-12-03 19:50 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-12-09 20:17 - 2014-12-03 19:50 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2014-12-09 20:17 - 2014-12-03 19:44 - 01083392 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-12-09 20:17 - 2014-12-01 16:28 - 01232040 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2014-12-09 20:17 - 2014-11-26 18:43 - 00389296 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-12-09 20:17 - 2014-11-26 18:10 - 00342200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-12-09 20:17 - 2014-11-21 20:13 - 25059840 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-12-09 20:17 - 2014-11-21 20:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-12-09 20:17 - 2014-11-21 20:06 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-12-09 20:17 - 2014-11-21 19:50 - 00580096 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-12-09 20:17 - 2014-11-21 19:50 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-12-09 20:17 - 2014-11-21 19:49 - 02885120 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-12-09 20:17 - 2014-11-21 19:49 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-12-09 20:17 - 2014-11-21 19:48 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-12-09 20:17 - 2014-11-21 19:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-12-09 20:17 - 2014-11-21 19:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-12-09 20:17 - 2014-11-21 19:37 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-12-09 20:17 - 2014-11-21 19:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-12-09 20:17 - 2014-11-21 19:34 - 06039552 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-12-09 20:17 - 2014-11-21 19:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-12-09 20:17 - 2014-11-21 19:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-12-09 20:17 - 2014-11-21 19:22 - 19749376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-12-09 20:17 - 2014-11-21 19:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-12-09 20:17 - 2014-11-21 19:20 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-12-09 20:17 - 2014-11-21 19:14 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-12-09 20:17 - 2014-11-21 19:09 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-12-09 20:17 - 2014-11-21 19:08 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-12-09 20:17 - 2014-11-21 19:07 - 00501248 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-12-09 20:17 - 2014-11-21 19:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-12-09 20:17 - 2014-11-21 19:06 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-12-09 20:17 - 2014-11-21 19:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-12-09 20:17 - 2014-11-21 19:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-12-09 20:17 - 2014-11-21 19:01 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-12-09 20:17 - 2014-11-21 18:59 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-12-09 20:17 - 2014-11-21 18:58 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-12-09 20:17 - 2014-11-21 18:56 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-12-09 20:17 - 2014-11-21 18:54 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-12-09 20:17 - 2014-11-21 18:49 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-12-09 20:17 - 2014-11-21 18:49 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-12-09 20:17 - 2014-11-21 18:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-12-09 20:17 - 2014-11-21 18:46 - 02125312 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-12-09 20:17 - 2014-11-21 18:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-12-09 20:17 - 2014-11-21 18:43 - 14412800 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-12-09 20:17 - 2014-11-21 18:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-09 20:17 - 2014-11-21 18:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-12-09 20:17 - 2014-11-21 18:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-12-09 20:17 - 2014-11-21 18:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-12-09 20:17 - 2014-11-21 18:29 - 04299264 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-12-09 20:17 - 2014-11-21 18:28 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-12-09 20:17 - 2014-11-21 18:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-12-09 20:17 - 2014-11-21 18:22 - 02052096 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-12-09 20:17 - 2014-11-21 18:21 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-12-09 20:17 - 2014-11-21 18:15 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-12-09 20:17 - 2014-11-21 18:13 - 12836864 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-12-09 20:17 - 2014-11-21 18:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-12-09 20:17 - 2014-11-21 18:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-12-09 20:17 - 2014-11-21 17:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-12-09 20:17 - 2014-11-21 17:54 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-12-09 20:17 - 2014-11-10 20:09 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2014-12-09 20:17 - 2014-11-10 19:44 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2014-12-09 20:17 - 2014-11-10 18:46 - 00119296 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2014-12-09 20:16 - 2014-11-07 20:16 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2014-12-09 20:16 - 2014-11-07 19:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2014-12-09 20:16 - 2014-10-29 19:03 - 00165888 _____ (Microsoft Corporation) C:\windows\system32\charmap.exe
2014-12-09 20:16 - 2014-10-29 18:45 - 00155136 _____ (Microsoft Corporation) C:\windows\SysWOW64\charmap.exe
2014-12-09 20:16 - 2014-10-02 19:12 - 02020352 _____ (Microsoft Corporation) C:\windows\system32\WsmSvc.dll
2014-12-09 20:16 - 2014-10-02 19:12 - 00346624 _____ (Microsoft Corporation) C:\windows\system32\WSManMigrationPlugin.dll
2014-12-09 20:16 - 2014-10-02 19:12 - 00310272 _____ (Microsoft Corporation) C:\windows\system32\WsmWmiPl.dll
2014-12-09 20:16 - 2014-10-02 19:12 - 00181248 _____ (Microsoft Corporation) C:\windows\system32\WsmAuto.dll
2014-12-09 20:16 - 2014-10-02 19:11 - 00266240 _____ (Microsoft Corporation) C:\windows\system32\WSManHTTPConfig.exe
2014-12-09 20:16 - 2014-10-02 18:45 - 01177088 _____ (Microsoft Corporation) C:\windows\SysWOW64\WsmSvc.dll
2014-12-09 20:16 - 2014-10-02 18:45 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-09 20:16 - 2014-10-02 18:45 - 00214016 _____ (Microsoft Corporation) C:\windows\SysWOW64\WsmWmiPl.dll
2014-12-09 20:16 - 2014-10-02 18:45 - 00145920 _____ (Microsoft Corporation) C:\windows\SysWOW64\WsmAuto.dll
2014-12-09 20:16 - 2014-10-02 18:44 - 00198656 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSManHTTPConfig.exe
2014-12-08 20:27 - 2014-12-08 20:27 - 00192736 _____ () C:\Users\Rob\Desktop\Taylor_Madie.jnt
2014-12-07 12:08 - 2014-12-17 23:43 - 00851968 ____R () C:\Users\Rob\Desktop\Edgin Insurance (QuickBooks2011 Acct Transfer Aug 15,2012 _06192013.QBW.TLG
2014-12-07 12:08 - 2014-12-17 23:01 - 00000000 ____D () C:\Users\Rob\Desktop\Edgin Insurance (QuickBooks2011 Acct Transfer Aug 15,2012 _06192013.QBW.SearchIndex
2014-12-07 12:08 - 2014-12-17 22:12 - 00000000 ____D () C:\Users\Rob\Desktop\QuickBooksAutoDataRecovery
2014-12-07 12:08 - 2014-12-07 12:11 - 00000496 ____R () C:\Users\Rob\Desktop\Edgin Insurance (QuickBooks2011 Acct Transfer Aug 15,2012 _06192013.lgb
2014-12-07 12:06 - 2014-12-17 23:43 - 17960960 ____R () C:\Users\Rob\Desktop\Edgin Insurance (QuickBooks2011 Acct Transfer Aug 15,2012 _06192013.QBW
2014-12-07 12:06 - 2014-12-17 23:43 - 00000394 _____ () C:\Users\Rob\Desktop\Edgin Insurance (QuickBooks2011 Acct Transfer Aug 15,2012 _06192013.QBW.ND
2014-12-07 12:06 - 2014-12-07 12:06 - 00000382 _____ () C:\Users\Rob\Desktop\Edgin Insurance (QuickBooks2011 Acct Transfer Aug 15,2012 _06192013.QBW.DSN
2014-12-07 11:50 - 2014-12-07 11:51 - 00000000 ____D () C:\Users\Rob\Desktop\Xmas 2014
2014-11-27 08:10 - 2014-12-12 17:41 - 00001236 _____ () C:\Users\Rob\Desktop\Amazon Cloud Drive.lnk
2014-11-27 08:10 - 2014-11-27 08:10 - 00000000 ____D () C:\Users\Rob\AppData\Local\Amazon.com Inc
2014-11-27 08:09 - 2014-11-27 08:09 - 01471256 _____ () C:\Users\Rob\Downloads\AmazonCloudDriveSetup.exe
2014-11-27 08:06 - 2014-11-27 08:06 - 00001691 _____ () C:\Users\Rob\Desktop\Google Drive.lnk
2014-11-27 08:05 - 2014-11-27 08:05 - 00002042 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-11-27 08:05 - 2014-11-27 08:05 - 00002040 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
2014-11-27 08:05 - 2014-11-27 08:05 - 00002030 _____ () C:\Users\Public\Desktop\Google Docs.lnk
2014-11-27 08:05 - 2014-11-27 08:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-11-27 08:04 - 2014-11-27 08:04 - 00880784 _____ (Google Inc.) C:\Users\Rob\Downloads\googledrivesync.exe
2014-11-26 06:55 - 2014-11-26 06:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2014-11-26 06:52 - 2014-11-26 06:54 - 00000000 ____D () C:\Users\Rob\Desktop\TJ Dance Biz
2014-11-25 19:29 - 2014-11-25 19:29 - 00000000 ____D () C:\Users\Rob\AppData\Local\{191C3E49-ED82-4783-9649-4E09A085D014}
2014-11-25 07:24 - 2014-11-25 07:24 - 00000000 ____D () C:\Users\Rob\AppData\Local\{11189823-7813-43F3-94C1-8ABE2BF032B3}
2014-11-25 07:23 - 2014-11-25 07:23 - 00000000 ____D () C:\Users\Rob\AppData\Local\{21E35540-6319-4A4F-BBF3-299D0CB586D2}
2014-11-22 15:11 - 2014-11-22 15:12 - 00000000 ____D () C:\Users\Rob\AppData\Local\{2AB770A2-839C-47C7-A367-6A5E6CCCF6EB}
2014-11-22 15:11 - 2014-11-22 15:11 - 00000000 ____D () C:\Users\Rob\AppData\Local\{444E0D13-702C-4169-9AD0-DE8F80DC0DB8}
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-12-21 12:11 - 2011-08-14 09:52 - 00000898 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-21 12:05 - 2014-11-09 02:22 - 00000000 ____D () C:\ProgramData\WRData
2014-12-21 11:51 - 2012-01-18 04:18 - 02331648 ___SH () C:\Users\Rob\Desktop\Thumbs.db
2014-12-21 11:45 - 2012-04-01 09:11 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-12-21 11:41 - 2014-11-08 22:58 - 02079436 _____ () C:\windows\WindowsUpdate.log
2014-12-21 11:34 - 2014-07-29 15:30 - 00000550 _____ () C:\windows\Tasks\G2MUpdateTask-S-1-5-21-2596615249-950003756-3831691080-1001.job
2014-12-21 09:26 - 2009-07-13 21:45 - 00025648 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-21 09:26 - 2009-07-13 21:45 - 00025648 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-21 09:01 - 2011-05-05 13:11 - 00000000 ____D () C:\ProgramData\PDFC
2014-12-21 08:20 - 2012-07-15 16:43 - 00000000 ____D () C:\Users\Rob\AppData\Local\CrashDumps
2014-12-21 08:09 - 2009-07-13 22:13 - 00786622 _____ () C:\windows\system32\PerfStringBackup.INI
2014-12-21 08:01 - 2012-09-26 06:44 - 00000000 ___RD () C:\Users\Rob\Google Drive
2014-12-21 08:01 - 2012-02-25 21:44 - 00000000 ___RD () C:\Users\Rob\Dropbox
2014-12-21 08:01 - 2012-02-25 21:42 - 00000000 ____D () C:\Users\Rob\AppData\Roaming\Dropbox
2014-12-21 08:00 - 2013-05-31 09:47 - 00000350 _____ () C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2014-12-21 08:00 - 2013-01-24 07:19 - 00000354 _____ () C:\windows\Tasks\ROC_JAN2013_TB_rmv.job
2014-12-21 08:00 - 2011-08-14 09:52 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-21 08:00 - 2009-07-13 22:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-12-21 07:59 - 2014-11-08 22:51 - 00003188 _____ () C:\windows\setupact.log
2014-12-21 07:34 - 2011-08-24 20:27 - 00000000 ____D () C:\Users\Rob\AppData\Local\Adobe
2014-12-20 14:26 - 2014-07-29 15:30 - 00003568 _____ () C:\windows\System32\Tasks\G2MUpdateTask-S-1-5-21-2596615249-950003756-3831691080-1001
2014-12-20 11:18 - 2013-03-14 06:20 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-20 11:18 - 2013-03-14 06:20 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-19 06:41 - 2012-04-01 09:11 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-12-19 06:41 - 2012-04-01 09:11 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-12-19 06:41 - 2011-05-05 13:12 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-18 06:16 - 2014-11-16 19:26 - 00000000 ____D () C:\Users\Rob\AppData\Local\LogMeInIgnition
2014-12-17 22:11 - 2012-11-26 22:15 - 00003174 _____ () C:\windows\System32\Tasks\HPCeeScheduleForRob
2014-12-17 22:11 - 2012-11-26 22:15 - 00000324 _____ () C:\windows\Tasks\HPCeeScheduleForRob.job
2014-12-16 20:42 - 2014-11-02 07:38 - 00001009 _____ () C:\Users\Rob\Desktop\Dropbox.lnk
2014-12-16 20:42 - 2014-11-02 07:37 - 00000000 ____D () C:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-15 20:59 - 2012-09-16 08:01 - 00000000 ____D () C:\Users\Public\Documents\QB Backup
2014-12-15 20:50 - 2014-08-31 21:54 - 00728064 ___SH () C:\Users\Rob\Downloads\Thumbs.db
2014-12-15 14:23 - 2013-03-14 06:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-14 04:07 - 2011-08-12 22:01 - 00000000 ____D () C:\windows\rescache
2014-12-10 03:29 - 2014-11-08 22:50 - 00006588 _____ () C:\windows\PFRO.log
2014-12-10 03:29 - 2009-07-13 22:08 - 00032564 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-12-10 03:26 - 2014-05-10 04:25 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-12-10 03:26 - 2009-07-13 20:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-12-10 03:26 - 2009-07-13 20:20 - 00000000 ____D () C:\windows\AppCompat
2014-12-10 03:10 - 2011-08-15 19:57 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 03:09 - 2013-08-08 19:28 - 00000000 ____D () C:\windows\system32\MRT
2014-12-10 03:04 - 2011-12-30 10:21 - 112710672 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-12-08 20:51 - 2014-09-27 14:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-08 20:33 - 2011-10-16 10:18 - 00000000 ____D () C:\Users\Rob\Documents\Outlook Files
2014-12-07 10:19 - 2011-10-30 18:32 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-12-07 10:19 - 2011-08-14 21:05 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-12-07 09:25 - 2011-10-22 08:50 - 00000000 ____D () C:\Users\Rob\AppData\Local\Apple Computer
2014-11-27 08:10 - 2011-08-20 16:39 - 00000000 ____D () C:\Users\Rob\AppData\Local\Amazon
2014-11-27 08:05 - 2011-08-14 09:52 - 00000000 ____D () C:\Program Files (x86)\Google
2014-11-24 14:04 - 2011-08-12 15:19 - 00275080 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
 
Some content of TEMP:
====================
C:\Users\Rob\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpe8gwli.dll
C:\Users\Rob\AppData\Local\Temp\sqlite3.dll
C:\Users\Rob\AppData\Local\Temp\TDSSKiller.exe
C:\Users\Rob\AppData\Local\Temp\WindowsUpdateAgent30-x64.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate14030698.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate14627667.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate14921636.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate15020462.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate1678882.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate27868205.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate352375.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate352655.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate360502.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate367397.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate371063.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate377304.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate37867308.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate37870989.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate397334.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate408410.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate409315.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate413855.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate431623.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate434587.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate461950.exe
C:\Users\Rob\AppData\Local\Temp\WRupdate939157.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-12-15 22:35
 
==================== End Of Log ============================
 
And here is the information from the additional file that was created from the FRST scan:
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-12-2014 01
Ran by [removed] at 2014-12-21 12:29:27
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Webroot SecureAnywhere (Enabled - Up to date) {66A6FE14-08CB-F415-3742-517201416109}
AS: Webroot SecureAnywhere (Enabled - Up to date) {DDC71FF0-2EF1-FB9B-0DF2-6A007AC62BB4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
7-Zip 9.20 (HKLM-x32\…\7-Zip) (Version:  - )
Adobe Acrobat X Standard - English, Français, Deutsch (HKLM-x32\…\{AC76BA86-1033-F400-BA7E-000000000005}) (Version: 10.1.12 - Adobe Systems)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 3.8.0.1430 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\…\Adobe Creative Cloud) (Version: 2.3.0.322 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\…\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Illustrator CC (HKLM-x32\…\{F2321021-08A2-44D6-B1DF-BDB415F23EC3}) (Version: 17.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe® Content Viewer (HKLM-x32\…\com.adobe.dmp.contentviewer) (Version: 3.3.0 - Adobe Systems Incorporated)
Alcor Micro Smart Card Reader Driver (HKLM-x32\…\SZCCID) (Version: 1.7.38.0 - Alcor Micro Corp.)
Alcor Micro Smart Card Reader Driver (x32 Version: 1.7.38.0 - Alcor Micro Corp.) Hidden
Amazon Cloud Drive (HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Amazon Cloud Drive) (Version: 1.0.2014.3460 - Amazon Digital Services, LLC.)
Amazon Kindle (HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Amazon Kindle) (Version:  - Amazon)
Amazon Unbox Video (HKLM-x32\…\InstallShield_{54A4839E-87F8-4BD1-9682-A349E9943F0A}) (Version: 2.2.0.153 - Amazon.com)
Amazon Unbox Video (x32 Version: 2.2.0.153 - Amazon.com) Hidden
Apple Application Support (HKLM-x32\…\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft Webcam Sharing Manager (HKLM-x32\…\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 2.0.0.30 - ArcSoft)
Bloggie Software (HKLM-x32\…\BloggieSoftware) (Version: 3.3.1.73 - Sony)
Bloggie Software (x32 Version: 3.3.1.73 - Sony Corporation) Hidden
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 2070 Bluetooth 3.0 (HKLM\…\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.6300 - Broadcom Corporation)
Broadcom 802.11 Wireless LAN Adapter (HKLM\…\Broadcom 802.11 Wireless LAN Adapter) (Version:  - Broadcom Corporation)
Broadcom Wireless Utility (HKLM\…\Broadcom Wireless Utility) (Version:  - Broadcom Corporation)
Bullzip PDF Printer 9.3.0.1516 (HKLM\…\Bullzip PDF Printer_is1) (Version: 9.3.0.1516 - Bullzip)
Camtasia Studio 8 (HKLM-x32\…\{72144B9D-58C4-4C09-A5CF-C6A914B912E8}) (Version: 8.0.0.878 - TechSmith Corporation)
Cisco Connect (HKLM-x32\…\Cisco Connect) (Version: 1.4.12334.0 - Cisco Consumer Products LLC)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden
Citrix Online Launcher (HKLM-x32\…\{C57F6C71-C365-4AFF-9108-397BBAD6127F}) (Version: 1.0.204 - Citrix)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Device Access Manager for HP ProtectTools (HKLM\…\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 6.1.0.1 - Hewlett-Packard Company)
Drive Encryption For HP ProtectTools (HKLM\…\{8A0041CD-277C-4C1F-BFE4-7AC508B20B4C}) (Version: 6.0.100.35469 - Hewlett-Packard Company)
Dropbox (HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
Embedded Security for HP ProtectTools (HKLM\…\{A674F348-9412-4AF5-89A5-BCC0FBB6FC22}) (Version: 6.0.300.2731 - Hewlett-Packard Company)
Energy Star Digital Logo (HKLM-x32\…\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
Evernote v. 5.7.2 (HKLM-x32\…\{FB57263E-706F-11E4-A65F-00163E98E7D6}) (Version: 5.7.2.5753 - Evernote Corp.)
Face Recognition for HP ProtectTools (HKLM\…\{D3A775F2-2674-4452-8D80-1FC1446052EE}) (Version: 6.00.4407 - Hewlett-Packard Company)
File Sanitizer For HP ProtectTools (HKLM-x32\…\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 6.0.0.13 - Hewlett-Packard Company)
Fitbit Connect (HKLM-x32\…\{D3CD091B-296B-48E9-9F0F-E9FE53E02E41}) (Version: 1.0.3.5511 - Fitbit Inc.)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Drive (HKLM-x32\…\{C60F3836-333A-4AE2-B526-CFDBA143A9BA}) (Version: 1.18.7821.2489 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
GoToMeeting 7.0.5.2130 (HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\GoToMeeting) (Version: 7.0.5.2130 - CitrixOnline)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM\…\{54CE68A8-4F2D-4328-B1F7-D6C720405F7F}) (Version: 4.2.9.1 - Hewlett-Packard Company)
HP Client Automation Agent Preload  (HKLM-x32\…\{52B18ABC-AD5F-4C3C-B391-04F57B380449}) (Version: 7.5 - Hewlett-Packard)
HP Connection Manager (HKLM-x32\…\{7A6B4340-7090-418F-8976-EE9650B35550}) (Version: 4.1.22.1 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\…\{62272D4E-78E9-4BAD-B7AA-63072D06AAA9}) (Version: 1.1.0.0 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (HKLM-x32\…\{D562B3BB-4405-4FA8-BCE2-D5DB89E8D5CE}) (Version: 2.2.1 - Hewlett-Packard Company)
HP Hotkey Support (HKLM-x32\…\{C97CC14E-4789-4FC5-BC75-79191F7CE009}) (Version: 4.6.4.1 - Hewlett-Packard Company)
HP Power Assistant (HKLM\…\{84642787-58C0-44AE-8B26-E2F544E380A1}) (Version: 2.5.0.16 - Hewlett-Packard Company)
HP ProtectTools Security Manager (HKLM\…\HPProtectTools) (Version: 6.08.1017 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\…\{6B5E7B4F-64A2-4DEB-B210-0DD92F940A01}) (Version: 3.0.3.9925 - Hewlett-Packard Company)
HP Setup (HKLM-x32\…\{03046EBB-CB7C-4B98-BEFB-690EB955DA22}) (Version: 8.5.4526.3645 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\…\{FE465061-894A-4023-8580-56FCDD4F23F9}) (Version: 3.4.4.0 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\…\{675D093B-815D-47FD-AB2C-192EC751E8E2}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\…\{531000B3-DBEE-4115-BBF3-DA48B67C053F}) (Version: 8.2.1.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\…\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP System Default Settings (HKLM-x32\…\{3A61A282-4F08-4D43-920C-DC30ECE528E8}) (Version: 2.6.1 - Hewlett-Packard Company)
HP Wallpaper (HKLM-x32\…\{11C9A461-DD9D-4C71-85A4-6DCE7F99CC44}) (Version: 2.00 - Hewlett-Packard Company)
HP Webcam (HKLM-x32\…\{1D61E881-43CD-447B-9E6B-D2C6138B2862}) (Version: 1.0.26.3 - Roxio)
HP Webcam Driver (HKLM-x32\…\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50058.0 - Sonix)
iCloud (HKLM\…\{2AAF09D5-4B3F-4975-B6A9-ECE2631FC942}) (Version: 4.0.5.20 - Apple Inc.)
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6428.0 - IDT)
Intel(R) Control Center (HKLM-x32\…\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Identity Protection Technology 1.1.2.0 (HKLM-x32\…\{C01A86F5-56E7-101F-9BC9-E3F1025EB779}) (Version: 1.1.2.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\…\PROSet) (Version: 17.3 - Intel)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2867 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\…\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
iTunes (HKLM\…\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java 8 Update 25 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
JMicron 1394 Filter Driver (HKLM-x32\…\{13C96625-28E4-4c58-ADE0-CDAFC64752EB}) (Version: 1.00.25.03 - JMicron Technology Corp.)
JMicron Flash Media Controller Driver (HKLM-x32\…\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.72.4 - JMicron Technology Corp.)
join.me (HKU\S-1-5-21-2596615249-950003756-3831691080-1001\…\JoinMe) (Version: 1.17.0.131 - LogMeIn, Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Knoll Light Factory EZ Studio 15 (HKLM-x32\…\Knoll Light Factory EZ Studio 15) (Version:  - )
LG Cloud version 1.008 (HKLM\…\LG Cloud_is1) (Version: 1.008 - )
LogMeIn Client (HKLM-x32\…\{0952A0F1-1B10-4382-A4C1-49752AB315EB}) (Version: 1.3.435 - LogMeIn, Inc.)
LSI HDA Modem (HKLM\…\LSI Soft Modem) (Version: 2.2.100 - LSI Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Camera Codec Pack (HKLM\…\{A6A4A258-0A48-4F76-B8F1-61F0514594DD}) (Version: 16.4.1970.0624 - Microsoft Corporation)
Microsoft Camera Codec Pack (HKLM-x32\…\{D03632B5-1DA9-4536-976D-604719500C45}) (Version: 16.4.1970.0624 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\…\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\…\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\…\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Touch Pack for Windows 7 (HKLM-x32\…\{8FF90DB8-6DED-44A3-B182-244FEC09012F}) (Version: 1.0.40517.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\…\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.0 (HKLM-x32\…\{3898934B-05AE-41CD-96BE-70DA9BFBCE1F}) (Version: 3.0.11010.0 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 32.0.3 (x86 en-US)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\…\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
PDF Complete Special Edition (HKLM-x32\…\PDF Complete) (Version: 4.0.64 - PDF Complete, Inc)
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
Pinnacle Studio 15 (HKLM-x32\…\{1362E602-9625-42D3-B57F-CDA9D26F9DA8}) (Version: 15.0.0.7593 - Pinnacle Systems)
Pinnacle Studio 15 Ultimate Plugins (HKLM-x32\…\{EB5DF19E-75D5-4FF1-AE23-2A9A2E0F2BDD}) (Version: 15.0.0.7593 - Pinnacle Systems)
Pinnacle Studio Bonus Content (HKLM-x32\…\{FC030CB5-46A6-4229-AD6E-0AC869F509C8}) (Version: 15.0.0.51 - Pinnacle Systems)
Pinnacle Video Driver (HKLM\…\{6DE721A5-5E89-4D74-994C-652BB3C0672E}) (Version: 12.1.0.030 - Pinnacle Systems)
Plex Media Server (HKLM-x32\…\{5ea93dc7-0906-47a6-8033-d26ed443f0a8}) (Version: 0.9.1101 - Plex, Inc.)
Plex Media Server (x32 Version: 0.9.1101 - Plex, Inc.) Hidden
PowerPlugs: Template Finder for PowerPoint (HKLM-x32\…\{873F3340-3C79-41D1-9D2C-D0B2269CBF24}) (Version: 1.00.0000 - CrystalGraphics)
Privacy Manager for HP ProtectTools (HKLM\…\{5476AB75-E584-4497-80AF-7F205D8F6F54}) (Version: 6.01.842 - Hewlett-Packard Company)
QuickBooks (x32 Version: 24.0.4007.2403 - Intuit Inc.) Hidden
QuickBooks Pro 2014 (HKLM-x32\…\{4A21D17E-2FE8-42CD-88B7-ACF8E8860834}) (Version: 24.0.4004.2403 - Intuit Inc.)
QuickBooks Runtime Redistributable (HKLM\…\{F2A4F809-2DE6-4D27-888B-4D2BB8DAF20E}) (Version: 1.00.0000 - Intuit Inc.)
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Roxio Secure Burn (HKLM-x32\…\{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}) (Version: 1.8.73.2 - Roxio)
SaveVid Plug-in (HKLM-x32\…\SaveVid Plug-in) (Version: 2.0.0.107556 - Bandoo Media, Inc)
SaveVid Plug-in (x32 Version: 2.0.0.107556 - Bandoo Media, Inc) Hidden
SDK (x32 Version: 2.30.042 - Portrait Displays, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\…\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Silver Financial Planner 4.0 (4.0.478.0) (HKLM-x32\…\{64BA0FD0-46B2-433F-BB9F-453875D5CAAE}) (Version: 04.00.00478 - Money Tree Software)
Skype™ 6.21 (HKLM-x32\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 17.0.18.23 - Synaptics Incorporated)
Theft Recovery for HP ProtectTools (HKLM-x32\…\InstallShield_{ADC70B7A-530B-46E3-8384-48D22681A41E}) (Version: 6.0.0.33 - Hewlett-Packard Company)
Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.33 - Hewlett-Packard Company) Hidden
Touch Driver (HKLM-x32\…\Touch Driver) (Version: 3.0.7.24 - )
Validity Fingerprint Sensor Driver (HKLM\…\{BFA2D2A7-4FAC-4862-B7A3-960B329C2177}) (Version: 4.3.216.0 - Validity Sensors, Inc.)
VIP Access SDK (1.0.0.55)  (HKLM-x32\…\VIP Access SDK) (Version: 1.0.0.55 - Symantec Inc.)
Visual Studio 2010 x64 Redistributables (HKLM\…\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\…\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\…\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
Webroot SecureAnywhere (HKLM-x32\…\WRUNINST) (Version: 8.0.5.107 - Webroot)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\…\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Rob\AppData\Local\Citrix\GoToMeeting\1468\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 251 more characters). <==== Poweliks?
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\imgutil.dll No File
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2596615249-950003756-3831691080-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rob\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
 
==================== Restore Points  =========================
 
05-12-2014 13:36:32 Windows Update
09-12-2014 04:32:51 Windows Update
10-12-2014 03:00:26 Windows Update
14-12-2014 03:00:15 Windows Update
15-12-2014 14:19:43 Windows Update
19-12-2014 21:29:35 Windows Update
20-12-2014 11:25:52 Windows Update
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
Task: {07A66E01-764A-48FA-B671-69A262B055E6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {1CDCF3C2-9413-459A-BA39-973F720BD3A4} - System32\Tasks\HPCeeScheduleForRob => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {45FB8353-5550-4AD5-BB34-C82290BFD3DF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {46BC85F0-15C5-4C7D-BE07-B1963F65B9C3} - \AVG-Secure-Search-Update_JUNE2013_TB_rmv No Task File <==== ATTENTION
Task: {4BD9D696-6617-4F9B-AFC5-BF7322A4EFA2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {5245AD6C-1FA8-4DCD-9173-DD4CE9213D15} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {5F8FD2E4-6410-4E05-99C7-3236C3C68451} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {623AE196-0347-4152-8F2F-836C5468E8C2} - System32\Tasks\AdobeAAMUpdater-1.0-Rob-HP-Rob => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {78FFB4D0-DADA-4E1F-8357-B2D01897844B} - System32\Tasks\{E075DE6B-DABE-403E-8A64-F52757AD416D} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-10-15] (Apple Inc.)
Task: {79F709E2-1B16-44E5-8137-F5874964E2C9} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2014-10-17] (Apple Inc.)
Task: {91252EFC-0319-47F4-BEF7-C5FF2A24DD51} - System32\Tasks\{1F8F720E-A7B1-42D0-A35E-1AC9EB510740} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-10-15] (Apple Inc.)
Task: {9FF0D7DE-E443-4B14-ADE5-5B17CB03DF63} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-13] (Microsoft Corporation)
Task: {A04A11A7-E5B4-43D1-B5B7-D45D22AE20C4} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {AC0676D9-6B00-456D-9CD0-29476D3CBEB2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {AC082B2D-176F-4068-81BC-25C984A9D215} - System32\Tasks\{35CAA4CD-51DD-4372-AFCD-10F6DC2DDB2E} => Iexplore.exe http://ui.skype.com/ui/0/5.1.0.104.321/en/abandoninstall?page=tsMain&installinfo;=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {B2C28DFE-8FD6-411C-848D-29F3175597A3} - System32\Tasks\G2MUpdateTask-S-1-5-21-2596615249-950003756-3831691080-1001 => C:\Users\Rob\AppData\Local\Citrix\GoToMeeting\2130\g2mupdate.exe [2014-12-20] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B607E88F-112A-488E-AEEA-1630C5C0BDAF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C8743A5E-1478-478D-B300-5343F729CD9E} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {FAA6EF87-1177-4C2A-AF6D-6BEFD9419337} - \ROC_JAN2013_TB_rmv No Task File <==== ATTENTION
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\windows\TEMP\{6A55A297-7758-45E4-A947-C3F92458C266}.exe
Task: C:\windows\Tasks\G2MUpdateTask-S-1-5-21-2596615249-950003756-3831691080-1001.job => C:\Users\Rob\AppData\Local\Citrix\GoToMeeting\2130\g2mupdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForRob.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files (x86)\AVG Secure Search\PostInstall\ROC.exe
 
==================== Loaded Modules (whitelisted) =============
 
2011-07-18 15:48 - 2011-07-18 15:48 - 00156216 _____ () C:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2013-02-01 09:39 - 2013-02-01 09:39 - 03401216 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeHpFve64.dll
2010-09-06 12:18 - 2010-09-06 12:18 - 01412608 _____ () C:\windows\system32\LIBEAY32.dll
2013-02-01 08:39 - 2013-02-01 08:39 - 01323008 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
2011-07-26 03:37 - 2011-01-07 09:11 - 01108336 _____ () C:\Program Files\WTouch\WTouchUser.exe
2013-12-13 12:20 - 2013-12-13 12:20 - 03359600 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
2011-03-25 05:28 - 2011-03-25 05:28 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-02-10 13:26 - 2012-02-10 13:26 - 01083392 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\System.Data.SQLite.dll
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-02-01 09:14 - 2013-02-01 09:14 - 02830336 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcEncryptionProviderPlugin.dll
2013-02-01 08:38 - 2013-02-01 08:38 - 00126976 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHostInterface.dll
2013-02-01 09:17 - 2013-02-01 09:17 - 02863104 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeHpDpHostPlugin.dll
2013-02-01 09:15 - 2013-02-01 09:15 - 00053248 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeOpalATASec4SATA.dll
2013-02-01 08:42 - 2013-02-01 08:42 - 02035712 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeCoreEncryptionPlugin.dll
2013-02-01 08:43 - 2013-02-01 08:43 - 01945600 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeProductDetectionPlugin.dll
2013-02-01 09:12 - 2013-02-01 09:12 - 03092480 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeOpalEncryptionProviderPlugin.dll
2011-11-23 21:21 - 2011-11-23 21:21 - 00105576 ____R () C:\Program Files (x86)\Amazon\Amazon Unbox Video\LimelightDownloadManager.dll
2014-10-21 17:22 - 2014-10-21 17:22 - 00750080 _____ () C:\Users\Rob\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2014-12-21 08:00 - 2014-12-21 08:00 - 00043008 _____ () c:\users\rob\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpe8gwli.dll
2014-10-21 17:22 - 2014-10-21 17:22 - 00047616 _____ () C:\Users\Rob\AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-21 17:22 - 2014-10-21 17:22 - 00863744 _____ () C:\Users\Rob\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-21 17:22 - 2014-10-21 17:22 - 00200704 _____ () C:\Users\Rob\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2014-12-21 08:00 - 2014-12-21 08:00 - 00098816 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32api.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00110080 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\pywintypes27.dll
2014-12-21 08:00 - 2014-12-21 08:00 - 00364544 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\pythoncom27.dll
2014-12-21 08:00 - 2014-12-21 08:00 - 00045568 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\_socket.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 01160704 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\_ssl.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00320512 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32com.shell.shell.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00713216 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\_hashlib.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 01175040 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\wx._core_.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00805888 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\wx._gdi_.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00811008 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\wx._windows_.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 01062400 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\wx._controls_.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00735232 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\wx._misc_.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00128512 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\_elementtree.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00127488 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\pyexpat.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00557056 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\pysqlite2._sqlite.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00087552 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\_ctypes.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00119808 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32file.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00108544 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32security.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00007168 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\hashobjs_ext.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00167936 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32gui.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00018432 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32event.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00038912 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32inet.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00011264 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32crypt.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00070656 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\wx._html2.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00027136 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\_multiprocessing.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00035840 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32process.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00686080 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\unicodedata.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00122368 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\wx._wizard.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00024064 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32pipe.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00025600 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32pdh.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00525640 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\windows._lib_cacheinvalidation.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00010240 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\select.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00017408 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32profile.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00022528 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\win32ts.pyd
2014-12-21 08:00 - 2014-12-21 08:00 - 00078336 _____ () C:\Users\Rob\AppData\Local\Temp\_MEI50362\wx._animate.pyd
2014-10-22 09:24 - 2014-10-22 09:24 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9b1cac8d98bd69d3e56a26ff2f96f266\IsdiInterop.ni.dll
2011-07-26 03:48 - 2011-01-12 18:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-12-13 07:10 - 2014-12-05 18:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll
2014-12-13 07:10 - 2014-12-05 18:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll
2014-12-13 07:10 - 2014-12-05 18:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll
2014-12-13 07:10 - 2014-12-05 18:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll
2014-12-13 07:10 - 2014-12-05 18:50 - 14913352 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 
==================== Safe Mode (whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"
 
==================== EXE Association (whitelisted) =============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== MSCONFIG/TASK MANAGER disabled items =========
 
(Currently there is no automatic fix for this section.)
 
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
 
========================= Accounts: ==========================
 
Administrator (S-1-5-21-2596615249-950003756-3831691080-500 - Administrator - Disabled)
Christian (S-1-5-21-2596615249-950003756-3831691080-1004 - Limited - Enabled) => C:\Users\Christian
Guest (S-1-5-21-2596615249-950003756-3831691080-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2596615249-950003756-3831691080-1003 - Limited - Enabled)
Rob (S-1-5-21-2596615249-950003756-3831691080-1001 - Administrator - Enabled) => C:\Users\Rob
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (12/21/2014 08:14:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bc5e1
Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9
Exception code: 0xc00000fd
Fault offset: 0x0048863b
Faulting process id: 0x2960
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3
 
Error: (12/19/2014 10:56:50 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2621
 
Error: (12/19/2014 10:56:50 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2621
 
Error: (12/19/2014 10:56:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (12/19/2014 06:40:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: RPCRT4.dll, version: 6.1.7601.18532, time stamp: 0x53c339ee
Exception code: 0xc0000005
Fault offset: 0x0000000000024cbf
Faulting process id: 0x13e8
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3
 
Error: (12/15/2014 08:27:47 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2014":
DBConnPool::HandleConnectionError errorCode:-6069, dbCode:-103 from file:'.\.\src\connpool.cpp' at line 1038 from function:'DBMgr::DBConnPool::init'
 
Error: (12/15/2014 08:27:47 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2014":
Connection String:CON=QBConnectionPool-Probe-QB_data_engine_24; ;DBF=C:\Users\Rob\Desktop\Edgin Insurance (QuickBooks2011 Acct Transfer Aug 15,2012 _06192013.QBW;ENG=QB_data_engine_24;DBN=bee3ff08b159418899647eebdc83a693
 
Error: (12/15/2014 08:27:47 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2014":
Connection Error:Invalid user ID or password
 
Error: (12/15/2014 02:42:27 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2014":
DMError Information:-6069Additional Info:An Invalid Id or password was specified.
 
Error: (12/15/2014 02:42:27 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2014":
DBConnPool::HandleConnectionError errorCode:-6069, dbCode:-103 from file:'.\.\src\connpool.cpp' at line 1038 from function:'DBMgr::DBConnPool::init'
 
 
System errors:
=============
Error: (12/21/2014 00:22:27 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (12/21/2014 00:04:42 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (12/21/2014 11:41:43 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
 
Error: (12/21/2014 11:24:16 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (12/21/2014 11:21:14 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (12/21/2014 11:01:32 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (12/21/2014 10:33:03 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
 
Error: (12/21/2014 10:28:01 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (12/21/2014 10:20:43 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (12/21/2014 10:18:24 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
 
Microsoft Office Sessions:
=========================
Error: (12/21/2014 08:14:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.174964a5bc5e1MSHTML.dll11.0.9600.17496546ff2f9c00000fd0048863b296001d01d30cb5f0d67C:\Program Files\Internet Explorer\iexplore.exeC:\windows\system32\MSHTML.dll19734c2f-8924-11e4-a3c3-2c27d77f7d6d
 
Error: (12/19/2014 10:56:50 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2621
 
Error: (12/19/2014 10:56:50 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2621
 
Error: (12/19/2014 10:56:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (12/19/2014 06:40:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4RPCRT4.dll6.1.7601.1853253c339eec00000050000000000024cbf13e801d017de849cda65C:\windows\Explorer.EXEC:\windows\system32\RPCRT4.dll92dd809e-8784-11e4-9a15-2c27d77f7d6d
 
Error: (12/15/2014 08:27:47 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooks Pro 2014DBConnPool::HandleConnectionError errorCode:-6069, dbCode:-103 from file:'.\.\src\connpool.cpp' at line 1038 from function:'DBMgr::DBConnPool::init'
 
Error: (12/15/2014 08:27:47 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooks Pro 2014Connection String:CON=QBConnectionPool-Probe-QB_data_engine_24; ;DBF=C:\Users\Rob\Desktop\Edgin Insurance (QuickBooks2011 Acct Transfer Aug 15,2012 _06192013.QBW;ENG=QB_data_engine_24;DBN=bee3ff08b159418899647eebdc83a693
 
Error: (12/15/2014 08:27:47 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooks Pro 2014Connection Error:Invalid user ID or password
 
Error: (12/15/2014 02:42:27 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooks Pro 2014DMError Information:-6069Additional Info:An Invalid Id or password was specified.
 
Error: (12/15/2014 02:42:27 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: QuickBooks Pro 2014DBConnPool::HandleConnectionError errorCode:-6069, dbCode:-103 from file:'.\.\src\connpool.cpp' at line 1038 from function:'DBMgr::DBConnPool::init'
 
 
==================== Memory info =========================== 
 
Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
Percentage of memory in use: 67%
Total physical RAM: 4006.36 MB
Available physical RAM: 1307.56 MB
Total Pagefile: 9942.63 MB
Available Pagefile: 6037.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:278.77 GB) (Free:59.03 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_RECOVERY) (Fixed) (Total:14.02 GB) (Free:2.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:2.12 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 9F3B9001)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=278.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=14 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=5 GB) - (Type=0C)
 
==================== End Of Log ============================
 
Any help you can offer would be greatly appreciated.
 
Robert

 

Post #2

Hello robertedgin, welcome to WhatTheTech's Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. :)
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

  • Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  • Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
  • Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
  • Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.  
  • If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  • Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
  • Ensure you are following this topic. Click [external image: etYzdbu.png] at the top of the page. 
     

======================================================
 
Unfortunately, due to the nature of an infection present on your computer, I must issue the following warning. 
Please have a read, and let me know how you wish to proceed. 
 

[external image: goGMWSt.gif]BACKDOOR WARNING
 
——————————
 
One or more of the identified infections is known to use a backdoor, that allows attackers to remotely control your computer, download/execute files and steal critical system, financial and personal information.
 
If your computer was used for online banking, has credit card information or other sensitive data, using a non-infected computer/device you should immediately change all account information (including those used for banking, Email, eBay, Paypal, online forums, etc).
 
Banking and credit card institutions should be notified of the possible security breach. Please read the following article for more information: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
 
Whilst the identified infection(s) can be removed, there is no way to guarantee the trustworthiness of your computer unless you reformat your Hard Drive and reinstall your Operating System. This is due to the nature of the infection, which allows a remote attacker to make any number of modifications. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat/reinstall. Please read the following articles for more information.

  • When should I re-format? How should I reinstall?
  • Help: I Got Hacked. Now What Do I Do?
  • Where to draw the line? When to recommend a format and reinstall?
You now have the choice between cleaning the infection(s) present or reformatting your computer. Ultimately, the decision is personal, and what you're most comfortable please. Have a read of the articles linked, then let me know how you wish to proceed, and if you have any questions.
Post #3

Hello Adam and thank you for getting back to me. Based on the information you provided, I believe my best course of action is to re-format the computer. I really appreciate the help and information and I will begin the re-formatting process.

 

Sincerely,

 

Robert

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI