What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Firefox hangs in every session [Closed]

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

I am using Firefox 35.0.1 and every time I use it after 30 minutes or so of usage it stops responding and require me to end task in Task Manager and restart.  Then, it will work okay for a little while longer, then hang again.  I have run a mbam scan and it didn't find anything.  I have avast antivirus and windows firewall,and have run a scan with avast with no help there.

 

Here are my logs:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by [removed] (administrator) on FAMILYPC on 02-02-2015 11:21:14
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Coupons.com Inc.) C:\Program Files (x86)\Coupons\CouponPrinterService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Dropbox, Inc.) C:\Users\John\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-09-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-07] (CyberLink)
HKLM-x32\…\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-02] (CyberLink Corp.)
HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-30] (AVAST Software)
HKLM-x32\…\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\…\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1691136 2012-05-31] (Wondershare)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\…\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\…\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2015-01-07] (Adobe Systems Incorporated)
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Run: [ManyCam] => C:\Program Files (x86)\ManyCam\ManyCam.exe [8473064 2014-03-26] (Visicom Media Inc.)
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\MountPoints2: {4b191b83-4112-11e4-bef0-78e3b5b3c153} - "H:\VerizonSWUpgradeAssistantLauncher.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\John\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Meserole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk
ShortcutTarget: IMVU.lnk -> C:\Users\John\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe (No File)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1031\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1004\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1001\User: Group Policy restriction detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&src;=IE-SearchBox&FORM;=IE10SR
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = www.bing.com
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
SearchScopes: HKLM -> DefaultScope value is missing.
SearchScopes: HKLM -> {0ABF015E-E08C-4AA1-BA04-3FB7766AB13A} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = http://speedial.com/results.php?f=4&q;={searchTerms}&a;=spd_dsites05_14_23_ff&cd;=2XzuyEtN2Y1L1QzuyBzz0EtA0ByD0BtA0CtCyDtA0Bzz0CyEtN0D0Tzu0SzzzzyDtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0D0EzzyD0B0CtCtGtB0D0D0BtGzzyBzz0FtG0D0A0CzytGtAtCzzyC0B0AtBzztDzy0CyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtAtA0DyEtA0FyCtG0CyD0FtAtGtC0CzzzztG0B0ByEyBtGyDyE0BtC0BtAzz0C0AtD0FtB2Q&cr;=1186556038&ir;=
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 -> {0ABF015E-E08C-4AA1-BA04-3FB7766AB13A} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM-x32 -> {51e4e850-63c0-41bd-ba38-4b03541d5223} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource;=4&ctid;=CT3309767&CUI;=UN11379035163226023&UM;=2
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.254.254

FireFox:
========
FF ProfilePath: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814
FF DefaultSearchEngine: DuckDuckGo
FF SelectedSearchEngine: DuckDuckGo
FF Homepage: hxxp://www.ldsscripturemastery.net/en/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-2574247163-3884555990-3468575119-1001: @nsroblox.roblox.com/launcher -> C:\Users\John\AppData\Local\Roblox\Versions\version-5d9b22aa9d594ee1\\NPRobloxProxy.dll ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2574247163-3884555990-3468575119-1001: @nsroblox.roblox.com/launcher64 -> C:\Users\John\AppData\Local\Roblox\Versions\version-5d9b22aa9d594ee1\\NPRobloxProxy64.dll ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2574247163-3884555990-3468575119-1001: @soe.sony.com/installer,version=1.0.3 -> C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\299hw44i.default-1372520734002\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll No File
FF Plugin HKU\S-1-5-21-2574247163-3884555990-3468575119-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\John\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF user.js: detected! => C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF SearchPlugin: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\searchplugins\duckduckgo.xml
FF SearchPlugin: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\searchplugins\startpage-ssl.xml
FF Extension: Firebug - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\[removed] [2014-12-27]
FF Extension: Pin It Button - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\[removed] [2015-01-07]
FF Extension: FirefoxAdKiller - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\{b1df372d-8b32-4c7d-b6b4-9c5b78cf6fb1}.xpi [2014-04-13]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-26]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-21]

Chrome:
=======
CHR Profile: C:\Users\John\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-21]
CHR Extension: (Google Drive) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-21]
CHR Extension: (SweetTunes) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blklojfklgnogjaijkibhfjepakiocng [2014-03-02]
CHR Extension: (YouTube) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-21]
CHR Extension: (Google Search) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-21]
CHR Extension: (Google Wallet) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-03]
CHR Extension: (Gmail) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-21]
CHR HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Chrome\Extension: [blklojfklgnogjaijkibhfjepakiocng] - C:\Users\John\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx [2013-12-28]
CHR HKLM-x32\…\Chrome\Extension: [blklojfklgnogjaijkibhfjepakiocng] - C:\Users\John\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx [2013-12-28]
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-30]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-30] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-01-30] (Avast Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
S3 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 CouponPrinterService; C:\Program Files (x86)\Coupons\CouponPrinterService.exe [177136 2014-04-28] (Coupons.com Inc.)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [1919256 2014-12-22] (IBM Corp.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-11-20] (IDT, Inc.) [File not signed]
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-03-03] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-30] ()
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-30] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-30] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-30] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-30] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-30] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 CpqDfw; C:\Windows\System32\drivers\CpqDfw.sys [27456 2012-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 ManyCam; C:\Windows\system32\DRIVERS\mcvidrv.sys [52128 2013-11-26] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\system32\drivers\mcaudrv_x64.sys [35232 2013-12-06] (Visicom Media Inc.)
R1 RapportCerberus_80120; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80120.sys [845464 2015-02-01] (IBM Corp.)
R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [445816 2014-12-22] (IBM Corp.)
U0 RapportHades64; C:\Windows\System32\Drivers\RapportHades64.sys [290520 2014-12-22] (IBM Corp.)
U0 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [535576 2014-12-22] (IBM Corp.)
R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [558872 2014-12-22] (IBM Corp.)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2014-03-03] (Duplex Secure Ltd.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-01-30] (Avast Software)
S3 vzandnetdiag; C:\Windows\system32\DRIVERS\lgvzandnetdiag64.sys [29696 2014-05-27] (LG Electronics Inc.)
S3 vzandnetmodem; C:\Windows\system32\DRIVERS\lgvzandnetmdm64.sys [36864 2014-05-27] (LG Electronics Inc.)
S3 vzandnetndis; C:\Windows\system32\DRIVERS\lgvzandnetndis64.sys [94208 2014-05-26] (LG Electronics Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-02 11:21 - 2015-02-02 11:21 - 00023665 _____ () C:\Users\John\Downloads\FRST.txt
2015-02-02 11:20 - 2015-02-02 11:21 - 00000000 ____D () C:\FRST
2015-02-02 11:19 - 2015-02-02 11:20 - 02129920 _____ (Farbar) C:\Users\John\Downloads\FRST64.exe
2015-02-02 11:19 - 2015-02-02 11:19 - 03768128 _____ () C:\Users\John\Downloads\aswMBR.exe.part
2015-02-02 11:19 - 2015-02-02 11:19 - 01121280 _____ (Farbar) C:\Users\John\Downloads\FRST.exe
2015-02-02 11:19 - 2015-02-02 11:19 - 00000000 _____ () C:\Users\John\Downloads\aswMBR.exe
2015-02-01 13:21 - 2014-12-22 17:52 - 00535576 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportKE64.sys
2015-02-01 13:21 - 2014-12-22 17:52 - 00290520 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportHades64.sys
2015-02-01 13:19 - 2015-02-01 13:19 - 00000000 ____D () C:\Users\John\AppData\Local\Trusteer
2015-02-01 13:19 - 2015-02-01 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection
2015-02-01 13:19 - 2015-02-01 13:19 - 00000000 ____D () C:\Program Files (x86)\Trusteer
2015-02-01 13:15 - 2015-02-01 13:15 - 00436504 _____ (IBM Corp.) C:\Users\John\Downloads\RapportSetup.exe
2015-02-01 13:15 - 2015-02-01 13:15 - 00000000 ____D () C:\ProgramData\Trusteer
2015-01-30 18:05 - 2015-01-30 18:05 - 00000000 ____D () C:\WINDOWS\SysWOW64\vbox
2015-01-30 18:05 - 2015-01-30 18:05 - 00000000 ____D () C:\WINDOWS\system32\vbox
2015-01-30 13:28 - 2015-01-30 13:30 - 00000000 ____D () C:\Users\John\Downloads\BabyAspenProducts
2015-01-30 13:28 - 2015-01-30 13:28 - 00000000 ____D () C:\Users\John\Downloads\BabyAspenPriceList
2015-01-30 13:25 - 2015-01-30 13:27 - 109267544 _____ () C:\Users\John\Downloads\BabyAspenProducts.zip
2015-01-30 13:25 - 2015-01-30 13:26 - 19954139 _____ () C:\Users\John\Downloads\Spring2015_BACatalog.pdf.zip
2015-01-30 13:24 - 2015-01-30 13:24 - 00050910 _____ () C:\Users\John\Downloads\BabyAspenPriceList.zip
2015-01-30 08:08 - 2015-01-30 08:08 - 00001942 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-01-30 08:07 - 2015-01-30 08:07 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2015-01-30 08:07 - 2015-01-30 08:07 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2015-01-28 21:07 - 2015-01-28 21:08 - 00000000 ____D () C:\ProgramData\WebEx
2015-01-28 21:07 - 2015-01-28 21:07 - 00217384 _____ (Cisco WebEx LLC) C:\Users\John\Downloads\bWVldC5sZHMub3JnLyAvNDE1MzYyLy02MzI5MTQ7NjMyOTE0L09NQy8wfDAvUWVNRWFiaUVDclZ0Q1RXMGNpQ0o3MTVhWWVtV29Jb2wzWi0tMVVENmY4cz0vMg==_webex.exe
2015-01-28 21:07 - 2015-01-28 21:07 - 00000000 ____D () C:\Users\John\AppData\Local\WebEx
2015-01-26 13:39 - 2015-01-26 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-01-26 11:22 - 2015-01-26 11:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-24 17:54 - 2015-01-24 17:54 - 01294088 _____ (Mojang) C:\Users\Meserole\Downloads\Minecraft(3).exe
2015-01-24 17:47 - 2015-01-24 17:47 - 01294088 _____ (Mojang) C:\Users\Meserole\Downloads\Minecraft(2).exe
2015-01-24 17:46 - 2015-01-24 17:46 - 00000000 ____D () C:\Users\Meserole\Downloads\runtime
2015-01-24 17:46 - 2015-01-24 17:46 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\java
2015-01-24 17:46 - 2015-01-24 17:46 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\.minecraft
2015-01-24 17:45 - 2015-01-24 17:46 - 00000000 ____D () C:\Users\Meserole\Downloads\game
2015-01-24 17:45 - 2015-01-24 17:45 - 01294088 _____ (Mojang) C:\Users\Meserole\Downloads\Minecraft(1).exe
2015-01-24 17:37 - 2015-01-24 17:38 - 00845960 _____ () C:\Users\Meserole\Downloads\Minecraft.exe
2015-01-23 10:09 - 2015-01-23 10:09 - 00000000 ____D () C:\Users\John\AppData\Local\{6E747A3C-0917-4F2C-9A25-F7476C407976}
2015-01-23 10:06 - 2015-01-23 10:06 - 00000000 ____D () C:\Users\John\Downloads\Girl-child-in-the-snow
2015-01-23 10:06 - 2015-01-23 10:06 - 00000000 ____D () C:\Users\John\Downloads\Four-little-girls
2015-01-23 10:05 - 2015-01-23 10:05 - 00000000 ____D () C:\Users\John\Downloads\Girl-with-basket
2015-01-23 10:02 - 2015-01-23 10:02 - 10285143 _____ () C:\Users\John\Downloads\Girl-child-in-the-snow.zip
2015-01-23 10:02 - 2015-01-23 10:02 - 01957898 _____ () C:\Users\John\Downloads\Girl-with-basket.zip
2015-01-23 10:01 - 2015-01-23 10:01 - 08088250 _____ () C:\Users\John\Downloads\Four-little-girls.zip
2015-01-22 12:54 - 2015-01-24 13:54 - 04070576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2015-01-21 13:17 - 2015-01-21 13:17 - 00000000 ____D () C:\Users\John\Downloads\yaquote_script
2015-01-21 13:16 - 2015-01-21 13:16 - 00000000 ____D () C:\Users\John\Downloads\Ruda
2015-01-21 13:16 - 2015-01-21 13:16 - 00000000 ____D () C:\Users\John\Downloads\Montserrat
2015-01-21 13:15 - 2015-01-21 13:15 - 00000000 ____D () C:\Users\John\Downloads\Titillium_Web
2015-01-21 13:15 - 2015-01-21 13:15 - 00000000 ____D () C:\Users\John\Downloads\stainy
2015-01-21 13:15 - 2015-01-21 13:15 - 00000000 ____D () C:\Users\John\Downloads\kg_eyes_wide_open
2015-01-21 13:15 - 2015-01-21 13:15 - 00000000 ____D () C:\Users\John\Downloads\Esteban
2015-01-21 13:14 - 2015-01-21 13:14 - 00000000 ____D () C:\Users\John\Downloads\stamping_nico
2015-01-21 13:13 - 2015-01-21 13:13 - 00000000 ____D () C:\Users\John\Downloads\scriptina_pro
2015-01-21 13:13 - 2015-01-21 13:13 - 00000000 ____D () C:\Users\John\Downloads\hello_goodbye
2015-01-21 13:12 - 2015-01-21 13:12 - 00000000 ____D () C:\Users\John\Downloads\Norican
2015-01-21 13:12 - 2015-01-21 13:12 - 00000000 ____D () C:\Users\John\Downloads\BlackJack
2015-01-21 13:11 - 2015-01-21 13:11 - 00000000 ____D () C:\Users\John\Downloads\Titillium
2015-01-21 13:10 - 2015-01-21 13:10 - 00000000 ____D () C:\Users\John\Downloads\birds_of_paradise
2015-01-21 13:10 - 2015-01-21 13:10 - 00000000 ____D () C:\Users\John\Downloads\a_love_of_thunder
2015-01-21 13:09 - 2015-01-21 13:09 - 00000000 ____D () C:\Users\John\Downloads\Pacifico
2015-01-21 13:09 - 2015-01-21 13:09 - 00000000 ____D () C:\Users\John\Downloads\bebas
2015-01-21 13:06 - 2015-01-21 13:06 - 00000000 ____D () C:\Users\John\Downloads\Proxima Nova 120 font families
2015-01-21 13:06 - 2015-01-21 13:06 - 00000000 ____D () C:\Users\John\Downloads\acryle_script
2015-01-21 13:05 - 2015-01-21 13:05 - 00000000 ____D () C:\Users\John\Downloads\mastoc
2015-01-21 13:05 - 2015-01-21 13:05 - 00000000 ____D () C:\Users\John\Downloads\brain_flower
2015-01-21 13:05 - 2015-01-21 13:05 - 00000000 ____D () C:\Users\John\Downloads\Asap
2015-01-21 13:04 - 2015-01-21 13:04 - 00000000 ____D () C:\Users\John\Downloads\traveling_typewriter
2015-01-21 13:04 - 2015-01-21 13:04 - 00000000 ____D () C:\Users\John\Downloads\suilly_la_tour
2015-01-21 13:04 - 2015-01-21 13:04 - 00000000 ____D () C:\Users\John\Downloads\mathilde
2015-01-21 13:04 - 2015-01-21 13:04 - 00000000 ____D () C:\Users\John\Downloads\halohandletter
2015-01-21 13:03 - 2015-01-21 13:03 - 00000000 ____D () C:\Users\John\Downloads\angelique_ma_douce_colombe
2015-01-21 13:03 - 2015-01-21 13:03 - 00000000 ____D () C:\Users\John\Downloads\abscissa
2015-01-21 13:02 - 2015-01-21 13:02 - 00000000 ____D () C:\Users\John\Downloads\thirsty_script_extrabold_demo
2015-01-21 13:01 - 2015-01-21 13:01 - 00000000 ____D () C:\Users\John\Downloads\typewriterhand
2015-01-21 13:01 - 2015-01-21 13:01 - 00000000 ____D () C:\Users\John\Downloads\nexa
2015-01-21 13:00 - 2015-01-21 13:00 - 00000000 ____D () C:\Users\John\Downloads\varsity_regular
2015-01-21 13:00 - 2015-01-21 13:00 - 00000000 ____D () C:\Users\John\Downloads\nevis
2015-01-21 13:00 - 2015-01-21 13:00 - 00000000 ____D () C:\Users\John\Downloads\Montserrat(1)
2015-01-21 12:59 - 2015-01-21 12:59 - 00000000 ____D () C:\Users\John\Downloads\champagne_limousines
2015-01-21 12:59 - 2015-01-21 12:59 - 00000000 ____D () C:\Users\John\Downloads\alex-brush
2015-01-21 12:58 - 2015-01-21 12:58 - 00000000 ____D () C:\Users\John\Downloads\the_only_exception
2015-01-21 12:58 - 2015-01-21 12:58 - 00000000 ____D () C:\Users\John\Downloads\sanchez
2015-01-21 12:58 - 2015-01-21 12:58 - 00000000 ____D () C:\Users\John\Downloads\Libre_Baskerville
2015-01-21 12:58 - 2015-01-21 12:58 - 00000000 ____D () C:\Users\John\Downloads\Aller(1)
2015-01-21 12:57 - 2015-01-21 12:57 - 00000000 ____D () C:\Users\John\Downloads\optimusprinceps
2015-01-21 12:57 - 2015-01-21 12:57 - 00000000 ____D () C:\Users\John\Downloads\Domine
2015-01-21 12:56 - 2015-01-21 12:56 - 00000000 ____D () C:\Users\John\Downloads\typo
2015-01-21 12:56 - 2015-01-21 12:56 - 00000000 ____D () C:\Users\John\Downloads\the_skinny
2015-01-21 12:56 - 2015-01-21 12:56 - 00000000 ____D () C:\Users\John\Downloads\langdon.otf
2015-01-21 12:55 - 2015-01-21 12:55 - 00000000 ____D () C:\Users\John\Downloads\amplify
2015-01-21 12:55 - 2015-01-21 12:55 - 00000000 ____D () C:\Users\John\Downloads\always_in_my_heart
2015-01-21 12:54 - 2015-01-21 12:54 - 00000000 ____D () C:\Users\John\Downloads\great-vibes
2015-01-21 12:52 - 2015-01-21 12:52 - 00000000 ____D () C:\Users\John\Downloads\u_s_101
2015-01-21 12:52 - 2015-01-21 12:52 - 00000000 ____D () C:\Users\John\Downloads\Aller(2)
2015-01-21 12:51 - 2015-01-21 12:51 - 00000000 ____D () C:\Users\John\Downloads\mailart_rubberstamp
2015-01-21 12:50 - 2015-01-21 12:50 - 00000000 ____D () C:\Users\John\Downloads\Patua_One
2015-01-21 12:49 - 2015-01-21 12:49 - 00000000 ____D () C:\Users\John\Downloads\Josefin_Sans
2015-01-21 12:48 - 2015-01-21 12:48 - 00000000 ____D () C:\Users\John\Downloads\wicked_grit
2015-01-21 12:47 - 2015-01-21 12:47 - 00000000 ____D () C:\Users\John\Downloads\karla
2015-01-21 12:46 - 2015-01-21 12:46 - 00000000 ____D () C:\Users\John\Downloads\ballpark_weiner
2015-01-21 12:45 - 2015-01-21 12:45 - 00000000 ____D () C:\Users\John\Downloads\linowrite
2015-01-21 12:45 - 2015-01-21 12:45 - 00000000 ____D () C:\Users\John\Downloads\coneria_script
2015-01-21 12:36 - 2015-01-21 12:36 - 00189677 _____ () C:\Users\John\Downloads\linowrite.zip
2015-01-21 12:35 - 2015-01-21 12:35 - 00498409 _____ () C:\Users\John\Downloads\coneria_script.zip
2015-01-21 12:34 - 2015-01-21 12:35 - 00223054 _____ () C:\Users\John\Downloads\ballpark_weiner.zip
2015-01-21 12:33 - 2015-01-21 12:33 - 00045382 _____ () C:\Users\John\Downloads\karla.zip
2015-01-21 12:32 - 2015-01-21 12:32 - 00439858 _____ () C:\Users\John\Downloads\Josefin_Sans.zip
2015-01-21 12:32 - 2015-01-21 12:32 - 00138322 _____ () C:\Users\John\Downloads\wicked_grit.zip
2015-01-21 12:31 - 2015-01-21 12:31 - 00100217 _____ () C:\Users\John\Downloads\Cooper Black.ttf
2015-01-21 12:31 - 2015-01-21 12:31 - 00021928 _____ () C:\Users\John\Downloads\Patua_One.zip
2015-01-21 12:30 - 2015-01-21 12:30 - 00162251 _____ () C:\Users\John\Downloads\mailart_rubberstamp.zip
2015-01-21 12:29 - 2015-01-21 12:29 - 00415090 _____ () C:\Users\John\Downloads\Aller(2).zip
2015-01-21 12:29 - 2015-01-21 12:29 - 00042358 _____ () C:\Users\John\Downloads\great-vibes.zip
2015-01-21 12:29 - 2015-01-21 12:29 - 00025138 _____ () C:\Users\John\Downloads\u_s_101.zip
2015-01-21 12:28 - 2015-01-21 12:28 - 00031720 _____ () C:\Users\John\Downloads\always_in_my_heart.zip
2015-01-21 12:27 - 2015-01-21 12:27 - 01050656 _____ () C:\Users\John\Downloads\amplify.zip
2015-01-21 12:26 - 2015-01-21 12:26 - 00017036 _____ () C:\Users\John\Downloads\typo.zip
2015-01-21 12:26 - 2015-01-21 12:26 - 00013500 _____ () C:\Users\John\Downloads\the_skinny.zip
2015-01-21 12:26 - 2015-01-21 12:26 - 00013412 _____ () C:\Users\John\Downloads\langdon.otf.zip
2015-01-21 12:25 - 2015-01-21 12:25 - 00112972 _____ () C:\Users\John\Downloads\Domine.zip
2015-01-21 12:25 - 2015-01-21 12:25 - 00035262 _____ () C:\Users\John\Downloads\Eagle CG Bold.otf
2015-01-21 12:24 - 2015-01-21 12:24 - 00057296 _____ () C:\Users\John\Downloads\optimusprinceps.zip
2015-01-21 12:24 - 2015-01-21 12:24 - 00025791 _____ () C:\Users\John\Downloads\the_only_exception.zip
2015-01-21 12:23 - 2015-01-21 12:23 - 00415090 _____ () C:\Users\John\Downloads\Aller(1).zip
2015-01-21 12:23 - 2015-01-21 12:23 - 00200133 _____ () C:\Users\John\Downloads\Libre_Baskerville.zip
2015-01-21 12:23 - 2015-01-21 12:23 - 00071290 _____ () C:\Users\John\Downloads\sanchez.zip
2015-01-21 12:21 - 2015-01-21 12:22 - 00027602 _____ () C:\Users\John\Downloads\alex-brush.zip
2015-01-21 12:20 - 2015-01-21 12:20 - 00210443 _____ () C:\Users\John\Downloads\champagne_limousines.zip
2015-01-21 12:19 - 2015-01-21 12:20 - 00016387 _____ () C:\Users\John\Downloads\varsity_regular.zip
2015-01-21 12:19 - 2015-01-21 12:19 - 02142744 _____ (SafeInstall, LLC) C:\Users\John\Downloads\manualdownload.exe
2015-01-21 12:19 - 2015-01-21 12:19 - 00007834 _____ () C:\Users\John\Downloads\nevis.zip
2015-01-21 12:18 - 2015-01-21 12:18 - 00036623 _____ () C:\Users\John\Downloads\Montserrat(1).zip
2015-01-21 12:17 - 2015-01-21 12:17 - 00083468 _____ () C:\Users\John\Downloads\Optima
2015-01-21 12:15 - 2015-01-21 12:15 - 00221763 _____ () C:\Users\John\Downloads\nexa.zip
2015-01-21 12:15 - 2015-01-21 12:15 - 00017719 _____ () C:\Users\John\Downloads\typewriterhand.zip
2015-01-21 12:14 - 2015-01-21 12:14 - 01820540 _____ () C:\Users\John\Downloads\thirsty_script_extrabold_demo.zip
2015-01-21 12:14 - 2015-01-21 12:14 - 00116359 _____ () C:\Users\John\Downloads\abscissa.zip
2015-01-21 12:13 - 2015-01-21 12:13 - 00989291 _____ () C:\Users\John\Downloads\traveling_typewriter.zip
2015-01-21 12:13 - 2015-01-21 12:13 - 00024871 _____ () C:\Users\John\Downloads\angelique_ma_douce_colombe.zip
2015-01-21 12:13 - 2015-01-21 12:13 - 00020783 _____ () C:\Users\John\Downloads\halohandletter.zip
2015-01-21 12:12 - 2015-01-21 12:12 - 00403224 _____ () C:\Users\John\Downloads\TrajanPro-Regular.ttf
2015-01-21 12:11 - 2015-01-21 12:11 - 00084164 _____ () C:\Users\John\Downloads\suilly_la_tour.zip
2015-01-21 12:11 - 2015-01-21 12:11 - 00067173 _____ () C:\Users\John\Downloads\Asap.zip
2015-01-21 12:11 - 2015-01-21 12:11 - 00031414 _____ () C:\Users\John\Downloads\mathilde.zip
2015-01-21 12:10 - 2015-01-21 12:10 - 01026650 _____ () C:\Users\John\Downloads\mastoc.zip
2015-01-21 12:10 - 2015-01-21 12:10 - 00333439 _____ () C:\Users\John\Downloads\brain_flower.zip
2015-01-21 12:09 - 2015-01-21 12:09 - 03634084 _____ () C:\Users\John\Downloads\Proxima Nova 120 font families.zip
2015-01-21 12:09 - 2015-01-21 12:09 - 00899929 _____ () C:\Users\John\Downloads\acryle_script.zip
2015-01-21 12:08 - 2015-01-21 12:08 - 00030729 _____ () C:\Users\John\Downloads\Pacifico.zip
2015-01-21 12:06 - 2015-01-21 12:06 - 01148964 _____ () C:\Users\John\Downloads\bebas.zip
2015-01-21 12:05 - 2015-01-21 12:05 - 00956071 _____ () C:\Users\John\Downloads\birds_of_paradise.zip
2015-01-21 12:05 - 2015-01-21 12:05 - 00125073 _____ () C:\Users\John\Downloads\a_love_of_thunder.zip
2015-01-21 12:04 - 2015-01-21 12:04 - 00578481 _____ () C:\Users\John\Downloads\Titillium.zip
2015-01-21 12:04 - 2015-01-21 12:04 - 00029960 _____ () C:\Users\John\Downloads\Norican.zip
2015-01-21 12:04 - 2015-01-21 12:04 - 00028333 _____ () C:\Users\John\Downloads\BlackJack.zip
2015-01-21 12:03 - 2015-01-21 12:03 - 00887240 _____ () C:\Users\John\Downloads\hello_goodbye.zip
2015-01-21 12:02 - 2015-01-21 12:02 - 00415090 _____ () C:\Users\John\Downloads\Aller.zip
2015-01-21 12:02 - 2015-01-21 12:02 - 00234636 _____ () C:\Users\John\Downloads\scriptina_pro.zip
2015-01-21 12:01 - 2015-01-21 12:01 - 00370009 _____ () C:\Users\John\Downloads\Titillium_Web.zip
2015-01-21 12:01 - 2015-01-21 12:01 - 00018334 _____ () C:\Users\John\Downloads\stamping_nico.zip
2015-01-21 12:00 - 2015-01-21 12:00 - 00035430 _____ () C:\Users\John\Downloads\kg_eyes_wide_open.zip
2015-01-21 11:59 - 2015-01-21 11:59 - 00844528 _____ () C:\Users\John\Downloads\stainy.zip
2015-01-21 11:59 - 2015-01-21 11:59 - 00025721 _____ () C:\Users\John\Downloads\Esteban.zip
2015-01-21 11:58 - 2015-01-21 11:58 - 00046754 _____ () C:\Users\John\Downloads\Ruda.zip
2015-01-21 11:57 - 2015-01-21 11:57 - 00036623 _____ () C:\Users\John\Downloads\Montserrat.zip
2015-01-21 11:56 - 2015-01-21 11:56 - 01587539 _____ () C:\Users\John\Downloads\yaquote_script.zip
2015-01-21 11:43 - 2015-01-21 11:45 - 00000000 ____D () C:\Users\John\Downloads\107-Logo-Templates-Designs-Bundle
2015-01-21 11:40 - 2015-01-21 11:42 - 156702789 _____ () C:\Users\John\Downloads\107-Logo-Templates-Designs-Bundle.zip
2015-01-21 11:21 - 2015-01-21 11:21 - 00033964 _____ () C:\Users\John\Downloads\Little-Trouble-Girl.zip
2015-01-21 11:21 - 2015-01-21 11:21 - 00000000 ____D () C:\Users\John\Downloads\Little-Trouble-Girl
2015-01-21 11:20 - 2015-01-21 11:20 - 00000000 ____D () C:\Users\John\Downloads\LemonChicken
2015-01-21 11:19 - 2015-01-21 11:19 - 00000000 ____D () C:\Users\John\Downloads\spicy-rice
2015-01-21 11:19 - 2015-01-21 11:19 - 00000000 ____D () C:\Users\John\Downloads\Promocyja
2015-01-21 11:18 - 2015-01-21 11:18 - 00038459 _____ () C:\Users\John\Downloads\spicy-rice.zip
2015-01-21 11:17 - 2015-01-21 11:17 - 00093645 _____ () C:\Users\John\Downloads\Promocyja.zip
2015-01-21 11:17 - 2015-01-21 11:17 - 00013942 _____ () C:\Users\John\Downloads\LemonChicken.zip
2015-01-21 11:16 - 2015-01-21 11:16 - 00000000 ____D () C:\Users\John\Downloads\league-script-1
2015-01-21 11:15 - 2015-01-21 11:15 - 00078858 _____ () C:\Users\John\Downloads\amatic.zip
2015-01-21 11:15 - 2015-01-21 11:15 - 00000000 ____D () C:\Users\John\Downloads\amatic
2015-01-21 11:14 - 2015-01-21 11:14 - 00033432 _____ () C:\Users\John\Downloads\league-script-1.zip
2015-01-21 10:50 - 2015-01-21 10:50 - 00031046 _____ () C:\Users\John\AppData\Local\recently-used.xbel
2015-01-21 09:58 - 2015-01-21 09:58 - 02917669 _____ () C:\Users\John\Downloads\Swirl Floral Element Vector Illustration.zip
2015-01-21 09:58 - 2015-01-21 09:58 - 01344763 _____ () C:\Users\John\Downloads\Swirl Floral Decorative Element Vector Graphic.zip
2015-01-21 09:04 - 2015-01-21 09:04 - 00475484 _____ () C:\Users\John\Downloads\vines_flowers.zip
2015-01-21 09:03 - 2015-01-21 09:03 - 02539985 _____ () C:\Users\John\Downloads\groovy_gift_box(1).zip
2015-01-21 09:02 - 2015-01-21 09:02 - 02539985 _____ () C:\Users\John\Downloads\groovy_gift_box.zip
2015-01-21 09:01 - 2015-01-21 09:01 - 00699674 _____ () C:\Users\John\Downloads\mushroom_frames_02.zip
2015-01-21 09:00 - 2015-01-21 09:01 - 00339229 _____ () C:\Users\John\Downloads\Owls.zip
2015-01-20 21:33 - 2015-01-20 21:33 - 00001701 _____ () C:\Users\John\Desktop\Scan_Doc0027 - Shortcut.lnk
2015-01-20 04:34 - 2015-01-20 04:34 - 00000000 ____D () C:\Users\John\AppData\Local\{9E6E26AD-ADAB-48C5-AA87-A1BB409E84E2}
2015-01-19 23:44 - 2015-01-19 23:44 - 00000000 ____D () C:\Users\John\Downloads\you_are_precious
2015-01-19 23:40 - 2015-01-19 23:40 - 00000000 ____D () C:\Users\John\Downloads\love_letters
2015-01-19 23:40 - 2015-01-19 23:40 - 00000000 ____D () C:\Users\John\Downloads\janda_swirly_twirly
2015-01-19 23:39 - 2015-01-19 23:39 - 00000000 ____D () C:\Users\John\Downloads\janda_curly_girl
2015-01-19 23:39 - 2015-01-19 23:39 - 00000000 ____D () C:\Users\John\Downloads\ginger_snaps
2015-01-19 23:38 - 2015-01-19 23:38 - 00000000 ____D () C:\Users\John\Downloads\curly_shirley
2015-01-19 23:36 - 2015-01-19 23:36 - 00000000 ____D () C:\Users\John\Downloads\one_starry_night
2015-01-19 23:36 - 2015-01-19 23:36 - 00000000 ____D () C:\Users\John\Downloads\austie_bost_you_wear_flowers
2015-01-19 23:36 - 2015-01-19 23:36 - 00000000 ____D () C:\Users\John\Downloads\a_yummy_apology
2015-01-19 23:35 - 2015-01-19 23:35 - 00000000 ____D () C:\Users\John\Downloads\mystery_quest
2015-01-19 22:40 - 2015-01-19 22:40 - 00047921 _____ () C:\Users\John\Downloads\ginger_snaps.zip
2015-01-19 22:40 - 2015-01-19 22:40 - 00041149 _____ () C:\Users\John\Downloads\janda_swirly_twirly.zip
2015-01-19 22:40 - 2015-01-19 22:40 - 00031429 _____ () C:\Users\John\Downloads\you_are_precious.zip
2015-01-19 22:40 - 2015-01-19 22:40 - 00029783 _____ () C:\Users\John\Downloads\mystery_quest.zip
2015-01-19 22:39 - 2015-01-19 22:39 - 00076742 _____ () C:\Users\John\Downloads\janda_curly_girl.zip
2015-01-19 22:38 - 2015-01-19 22:38 - 00624736 _____ () C:\Users\John\Downloads\austie_bost_you_wear_flowers.zip
2015-01-19 22:38 - 2015-01-19 22:38 - 00029387 _____ () C:\Users\John\Downloads\a_yummy_apology.zip
2015-01-19 22:37 - 2015-01-19 22:37 - 00078518 _____ () C:\Users\John\Downloads\curly_shirley.zip
2015-01-19 22:37 - 2015-01-19 22:37 - 00039136 _____ () C:\Users\John\Downloads\one_starry_night.zip
2015-01-19 22:37 - 2015-01-19 22:37 - 00023062 _____ () C:\Users\John\Downloads\love_letters.zip
2015-01-19 04:39 - 2015-01-19 04:39 - 01423369 _____ () C:\Users\John\Documents\PattyLou's Discount Boutique.xcf
2015-01-18 13:51 - 2015-01-18 13:51 - 00000000 ____D () C:\Users\John\AppData\Local\{3DAAA5EF-E325-4FE5-B556-7108E63D01AC}
2015-01-13 22:35 - 2015-01-14 19:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-13 19:55 - 2015-01-13 19:55 - 00965965 _____ () C:\Users\John\Downloads\vector_floral_elements_for_design_148116.zip
2015-01-13 19:54 - 2015-01-13 19:54 - 00522562 _____ () C:\Users\John\Downloads\vector_floral_ornamental_design_elements_148635.zip
2015-01-13 19:54 - 2015-01-13 19:54 - 00520859 _____ () C:\Users\John\Downloads\vintage_beautiful_design_elements_vector_set_267741.zip
2015-01-13 19:47 - 2015-01-13 19:47 - 00000000 ____D () C:\Users\John\Downloads\VectorFree-Swirling-Floral-Vectors
2015-01-13 19:46 - 2015-01-13 19:46 - 00000000 ____D () C:\Users\John\Downloads\VectorFree-Vector-Plant-Design
2015-01-13 19:46 - 2015-01-13 19:46 - 00000000 ____D () C:\Users\John\Downloads\VectorFree-Spring-Designs-Graphics(1)
2015-01-13 19:46 - 2015-01-13 19:46 - 00000000 ____D () C:\Users\John\Downloads\VectorFree-Spring-Designs-Graphics
2015-01-13 19:43 - 2015-01-13 19:43 - 00691884 _____ () C:\Users\John\Downloads\VectorFree-Vector-Plant-Design.zip
2015-01-13 19:42 - 2015-01-13 19:42 - 01377677 _____ () C:\Users\John\Downloads\VectorFree-Spring-Designs-Graphics(1).zip
2015-01-13 19:41 - 2015-01-13 19:41 - 01377677 _____ () C:\Users\John\Downloads\VectorFree-Spring-Designs-Graphics.zip
2015-01-13 19:40 - 2015-01-13 19:40 - 00560597 _____ () C:\Users\John\Downloads\VectorFree-Swirling-Floral-Vectors.zip
2015-01-13 16:11 - 2014-12-19 00:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 16:11 - 2014-12-11 20:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 16:11 - 2014-12-11 18:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 16:11 - 2014-12-08 19:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 16:11 - 2014-12-08 13:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 16:11 - 2014-12-08 13:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 16:11 - 2014-12-08 13:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 16:11 - 2014-12-08 13:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 16:11 - 2014-12-08 13:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 16:11 - 2014-12-08 13:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 16:11 - 2014-12-08 13:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 16:11 - 2014-12-08 13:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 16:11 - 2014-12-05 21:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 16:11 - 2014-12-05 19:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 16:11 - 2014-12-05 19:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 16:11 - 2014-10-28 22:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 16:11 - 2014-10-28 22:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 16:11 - 2014-10-28 21:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 16:11 - 2014-10-28 21:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 16:11 - 2014-10-28 21:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 16:11 - 2014-10-28 21:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 16:11 - 2014-10-28 21:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 16:11 - 2014-10-28 21:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 16:11 - 2014-10-28 21:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 16:11 - 2014-10-28 21:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 16:11 - 2014-10-28 21:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 16:11 - 2014-10-28 20:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 16:11 - 2014-10-28 19:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 16:11 - 2014-10-28 19:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 16:11 - 2014-10-28 19:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-13 16:11 - 2014-10-28 19:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-12 22:00 - 2015-01-12 22:00 - 00000000 ____D () C:\Users\John\Downloads\create-apply-patterns
2015-01-12 21:59 - 2015-01-12 21:59 - 00987244 _____ () C:\Users\John\Downloads\create-apply-patterns.zip
2015-01-12 21:56 - 2015-01-12 21:56 - 00003518 _____ () C:\WINDOWS\System32\Tasks\AdobeAAMUpdater-1.0-familypc-John Meserole
2015-01-12 21:56 - 2015-01-12 21:56 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2015-01-12 21:55 - 2015-01-30 13:32 - 00000033 _____ () C:\Users\John\AppData\Roaming\AdobeWLCMCache.dat
2015-01-12 21:21 - 2015-01-12 21:21 - 00611787 _____ () C:\Users\John\Downloads\ (4)
2015-01-12 20:45 - 2015-01-12 20:45 - 00617040 _____ () C:\Users\John\Downloads\ (1)
2015-01-12 20:45 - 2015-01-12 20:45 - 00611787 _____ () C:\Users\John\Downloads\ (3)
2015-01-12 20:45 - 2015-01-12 20:45 - 00567079 _____ () C:\Users\John\Downloads\ (2)
2015-01-12 20:24 - 2015-01-12 20:32 - 00000000 ____D () C:\Program Files\Adobe
2015-01-12 20:24 - 2015-01-12 20:24 - 00001473 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CC 2014.lnk
2015-01-12 20:24 - 2015-01-12 20:24 - 00000000 ____D () C:\ProgramData\ALM
2015-01-12 20:22 - 2015-01-12 20:24 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-01-12 19:40 - 2015-01-12 19:40 - 00000000 ___RD () C:\Users\John\Creative Cloud Files
2015-01-12 19:38 - 2015-01-12 19:38 - 00001335 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2015-01-12 19:38 - 2015-01-12 19:38 - 00001323 _____ () C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2015-01-12 19:38 - 2015-01-12 19:38 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-12 19:34 - 2015-01-12 19:34 - 00672432 _____ (Adobe Systems Incorporated) C:\Users\John\Downloads\CreativeCloudSet-Up.exe
2015-01-12 16:34 - 2015-02-02 08:13 - 00000000 ___RD () C:\Users\John\Dropbox
2015-01-12 16:34 - 2015-01-12 16:34 - 00001176 _____ () C:\Users\John\Desktop\Dropbox.lnk
2015-01-12 16:33 - 2015-01-12 16:33 - 00000000 ____D () C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-12 16:30 - 2015-02-02 08:12 - 00000000 ____D () C:\Users\John\AppData\Roaming\Dropbox
2015-01-12 16:30 - 2015-01-12 16:30 - 00324136 _____ (Dropbox, Inc.) C:\Users\John\Downloads\DropboxInstaller.exe
2015-01-10 03:10 - 2015-01-10 03:10 - 00000000 ____D () C:\Users\John\Downloads\aubrey
2015-01-10 03:07 - 2015-01-10 03:07 - 00016353 _____ () C:\Users\John\Downloads\aubrey.zip
2015-01-06 16:00 - 2015-01-06 16:00 - 00000222 _____ () C:\Users\Meserole\Desktop\Brick-Force.url
2015-01-06 15:59 - 2015-01-06 15:59 - 01142128 _____ () C:\Users\Meserole\Downloads\SteamSetup.exe
2015-01-04 18:34 - 2015-01-04 18:34 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\Unity
2015-01-04 18:13 - 2015-01-04 18:37 - 00000000 ____D () C:\Users\Meserole\AppData\Local\wf-launcher
2015-01-04 18:13 - 2015-01-04 18:36 - 00000000 ____D () C:\ProgramData\GFACE
2015-01-04 18:13 - 2015-01-04 18:15 - 00000000 ____D () C:\Users\Meserole\AppData\Local\Warface Launcher
2015-01-04 18:13 - 2015-01-04 18:13 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warface Launcher
2015-01-04 17:22 - 2015-01-04 17:23 - 29350504 _____ () C:\Users\Meserole\Downloads\warface-launcher.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-02 11:19 - 2013-10-18 13:19 - 00000306 _____ () C:\WINDOWS\Tasks\DigitalSite.job
2015-02-02 11:13 - 2014-03-03 20:31 - 01820546 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-02 11:09 - 2013-08-25 16:56 - 00000390 _____ () C:\WINDOWS\Tasks\WpsUpdateTask_John.job
2015-02-02 11:00 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-02 10:54 - 2014-02-24 11:24 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-02-02 10:44 - 2013-12-05 16:08 - 00000398 _____ () C:\WINDOWS\Tasks\WpsUpdateTask_Meserole.job
2015-02-02 10:41 - 2014-12-18 19:59 - 00000000 ____D () C:\Users\John\Desktop\PLDB
2015-02-02 10:30 - 2014-05-17 15:15 - 00000408 _____ () C:\WINDOWS\Tasks\WpsUpdateTask_John Meserole.job
2015-02-02 08:45 - 2013-04-17 20:36 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2574247163-3884555990-3468575119-1001
2015-02-02 08:13 - 2013-07-19 07:52 - 00000000 ____D () C:\Users\John\AppData\Local\Adobe
2015-02-02 08:12 - 2013-08-22 08:46 - 00426051 _____ () C:\WINDOWS\setupact.log
2015-01-31 19:57 - 2013-09-06 13:43 - 00003938 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{86279D80-09C8-4862-B508-B3039270FC25}
2015-01-31 16:45 - 2013-09-06 13:49 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2574247163-3884555990-3468575119-1031
2015-01-31 00:13 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-30 22:39 - 2014-11-12 22:30 - 00001409 _____ () C:\Users\John\Desktop\ROBLOX Player.lnk
2015-01-30 22:39 - 2014-11-12 22:29 - 00001224 _____ () C:\Users\John\Desktop\ROBLOX Studio.lnk
2015-01-30 22:39 - 2014-11-12 22:29 - 00000000 ____D () C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2015-01-30 18:01 - 2013-11-14 01:20 - 00511418 _____ () C:\WINDOWS\PFRO.log
2015-01-30 18:01 - 2013-08-22 08:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-30 18:00 - 2013-08-22 07:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-30 11:52 - 2014-12-31 17:39 - 00000000 ____D () C:\Users\John\.gimp-2.8
2015-01-30 08:55 - 2013-04-17 20:26 - 00000000 ____D () C:\Users\John\AppData\Local\Packages
2015-01-30 08:11 - 2013-08-22 07:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-30 08:08 - 2013-11-14 01:28 - 00956476 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-30 08:07 - 2014-08-06 16:12 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-01-30 08:07 - 2013-12-29 23:40 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys
2015-01-30 08:07 - 2013-06-21 11:25 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2015-01-30 08:07 - 2013-06-21 11:25 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys
2015-01-30 08:07 - 2013-06-21 11:25 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-01-30 08:07 - 2013-06-21 11:25 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2015-01-30 08:07 - 2013-06-21 11:25 - 00083280 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2015-01-30 08:07 - 2013-06-21 11:25 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-01-30 08:07 - 2013-06-21 11:25 - 00003924 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-01-30 08:02 - 2014-02-15 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-30 08:02 - 2013-08-22 08:44 - 00708608 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-29 22:31 - 2014-11-11 19:25 - 00001413 _____ () C:\Users\Meserole\Desktop\ROBLOX Player.lnk
2015-01-29 22:31 - 2014-11-11 19:24 - 00001228 _____ () C:\Users\Meserole\Desktop\ROBLOX Studio.lnk
2015-01-29 22:31 - 2014-11-11 19:24 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2015-01-28 21:06 - 2014-03-30 12:56 - 00012391 _____ () C:\WINDOWS\system32\lvcoinst.log
2015-01-28 21:06 - 2014-03-30 12:56 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2015-01-28 03:51 - 2012-07-26 01:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-26 19:39 - 2014-03-30 13:04 - 00000000 ____D () C:\Users\John\AppData\Roaming\Skype
2015-01-26 13:39 - 2014-03-30 13:04 - 00002713 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-01-26 13:39 - 2014-03-30 13:04 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-26 13:39 - 2014-03-30 13:04 - 00000000 ____D () C:\ProgramData\Skype
2015-01-25 10:49 - 2013-11-19 19:52 - 00000000 ____D () C:\Users\John\Documents\My Scans
2015-01-24 14:20 - 2013-08-22 09:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 14:20 - 2013-08-22 09:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-24 13:54 - 2014-02-24 11:24 - 00003718 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-01-21 17:17 - 2014-04-25 20:40 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-21 11:46 - 2013-04-17 20:28 - 00000000 ____D () C:\Users\John\AppData\Roaming\Adobe
2015-01-21 10:09 - 2015-01-01 21:48 - 00000000 ____D () C:\Users\John\AppData\Local\gtk-2.0
2015-01-19 01:02 - 2013-10-19 15:22 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-15 22:08 - 2014-08-20 11:02 - 00000000 ____D () C:\Users\Meserole\AppData\Local\Adobe
2015-01-15 22:08 - 2013-09-06 13:43 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\Adobe
2015-01-15 21:31 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-14 23:32 - 2013-09-03 21:54 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-14 23:25 - 2013-04-18 22:02 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-14 22:09 - 2014-03-03 20:16 - 00000000 ____D () C:\Users\John
2015-01-12 19:41 - 2013-04-17 21:16 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-12 19:37 - 2013-10-19 15:21 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-10 20:06 - 2012-11-15 17:02 - 00000000 ____D () C:\ProgramData\Temp
2015-01-10 03:10 - 2014-07-22 21:43 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-06 19:47 - 2014-07-22 21:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-06 16:00 - 2014-06-03 06:55 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-01-06 04:02 - 2014-07-22 21:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-06 04:02 - 2013-06-21 11:05 - 00001120 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

==================== Files in the root of some directories =======

2015-01-12 21:55 - 2015-01-30 13:32 - 0000033 _____ () C:\Users\John\AppData\Roaming\AdobeWLCMCache.dat
2013-10-19 11:19 - 2013-10-19 11:19 - 0000097 _____ () C:\Users\John\AppData\Roaming\WB.CFG
2013-10-19 11:19 - 2013-10-19 11:19 - 0000006 _____ () C:\Users\John\AppData\Roaming\WBPU-TTL.DAT
2013-09-21 12:25 - 2013-09-21 14:01 - 0121333 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash
2013-09-21 12:45 - 2013-09-21 12:45 - 0004858 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921134531.gnucash
2013-09-21 12:52 - 2013-09-21 12:52 - 0004858 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921135231.gnucash
2013-09-21 12:53 - 2013-09-21 12:55 - 0537401 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921135307.log
2013-09-21 12:58 - 2013-09-21 12:58 - 0004938 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921135801.gnucash
2013-09-21 12:58 - 2013-09-21 13:39 - 0310537 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921135801.log
2013-09-21 13:39 - 2013-09-21 13:39 - 0075246 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921143907.gnucash
2013-09-21 13:39 - 2013-09-21 13:44 - 0000172 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921143907.log
2013-09-21 13:44 - 2013-09-21 13:44 - 0083433 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921144456.gnucash
2013-09-21 13:44 - 2013-09-21 13:50 - 1154483 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921144456.log
2013-09-21 13:52 - 2013-09-21 13:52 - 0083498 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921145229.gnucash
2013-09-21 13:52 - 2013-09-21 14:00 - 0409957 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921145229.log
2013-09-21 14:01 - 2013-09-21 14:01 - 0068728 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921150114.gnucash
2013-09-21 14:01 - 2013-09-21 14:07 - 0781957 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921150114.log
2013-09-21 14:07 - 2013-09-21 14:13 - 0021758 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash
2013-09-21 14:07 - 2013-09-21 14:13 - 0128274 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash.20130921150744.log
2013-09-21 14:13 - 2013-09-21 14:13 - 0003307 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash.20130921151343.gnucash
2013-09-21 14:13 - 2013-09-21 14:15 - 0001523 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash.20130921151343.log
2013-09-21 14:16 - 2013-09-21 14:24 - 0001973 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash.20130921151616.log
2013-09-21 15:11 - 2013-09-22 16:42 - 0051563 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash
2013-09-21 15:11 - 2013-09-21 16:34 - 0278939 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921161111.log
2013-09-21 16:34 - 2013-09-21 16:34 - 0005164 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921173442.gnucash
2013-09-21 16:34 - 2013-09-21 16:40 - 0398136 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921173442.log
2013-09-21 16:40 - 2013-09-21 16:40 - 0005385 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921174009.gnucash
2013-09-21 16:40 - 2013-09-21 16:45 - 0273947 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921174009.log
2013-09-21 16:45 - 2013-09-21 16:45 - 0031669 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921174552.gnucash
2013-09-21 16:45 - 2013-09-21 16:51 - 1189664 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921174552.log
2013-09-21 16:51 - 2013-09-21 16:51 - 0038867 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921175101.gnucash
2013-09-21 16:51 - 2013-09-21 17:01 - 0186245 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921175101.log
2013-09-21 17:01 - 2013-09-21 17:01 - 0023713 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921180125.gnucash
2013-09-21 17:01 - 2013-09-21 17:04 - 0004158 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921180125.log
2013-09-21 17:07 - 2013-09-21 17:07 - 0014862 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921180752.gnucash
2013-09-21 17:07 - 2013-09-21 17:12 - 0120940 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921180752.log
2013-09-21 17:12 - 2013-09-21 17:12 - 0015866 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921181253.gnucash
2013-09-21 17:12 - 2013-09-21 17:21 - 0077228 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921181253.log
2013-09-21 17:21 - 2013-09-21 17:21 - 0033796 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921182110.gnucash
2013-09-21 17:21 - 2013-09-21 17:26 - 0100727 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921182110.log
2013-09-21 17:26 - 2013-09-21 17:26 - 0033859 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921182613.gnucash
2013-09-21 17:26 - 2013-09-21 17:31 - 0008071 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921182613.log
2013-09-21 17:31 - 2013-09-21 17:31 - 0033840 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921183130.gnucash
2013-09-21 17:31 - 2013-09-21 17:37 - 0000172 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921183130.log
2013-09-21 17:37 - 2013-09-21 17:37 - 0034169 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921183730.gnucash
2013-09-21 17:37 - 2013-09-21 17:42 - 0000172 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921183730.log
2013-09-21 17:42 - 2013-09-21 17:42 - 0034667 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921184233.gnucash
2013-09-21 17:42 - 2013-09-21 17:47 - 0109996 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921184233.log
2013-09-21 17:47 - 2013-09-21 17:47 - 0034892 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921184734.gnucash
2013-09-21 17:47 - 2013-09-21 17:51 - 0000488 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921184734.log
2013-09-21 17:53 - 2013-09-21 17:53 - 0049395 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921185310.gnucash
2013-09-21 17:53 - 2013-09-21 17:57 - 0003086 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921185310.log
2013-09-21 17:58 - 2013-09-21 17:58 - 0049602 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921185822.gnucash
2013-09-21 17:58 - 2013-09-21 18:05 - 0006794 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921185822.log
2013-09-21 18:05 - 2013-09-21 18:05 - 0050703 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921190512.gnucash
2013-09-21 18:05 - 2013-09-21 18:09 - 0002124 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921190512.log
2013-09-21 18:10 - 2013-09-21 18:10 - 0050943 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921191015.gnucash
2013-09-21 18:10 - 2013-09-21 18:15 - 0005443 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921191015.log
2013-09-21 18:15 - 2013-09-21 18:15 - 0051343 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921191540.gnucash
2013-09-21 18:15 - 2013-09-21 18:19 - 0003259 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921191540.log
2013-09-21 18:20 - 2013-09-21 18:20 - 0051423 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921192043.gnucash
2013-09-21 18:20 - 2013-09-22 16:42 - 0001478 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921192043.log
2013-09-22 16:42 - 2013-09-22 16:42 - 0051632 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130922174246.gnucash
2013-09-22 16:42 - 2013-09-22 16:42 - 0000000 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130922174246.log
2013-09-21 15:11 - 2013-09-21 15:11 - 0000000 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.LCK
2013-09-21 14:24 - 2013-09-21 14:40 - 0023702 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash
2013-09-21 14:24 - 2013-09-21 14:29 - 0195214 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921152429.log
2013-09-21 14:30 - 2013-09-21 14:30 - 0005074 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153015.gnucash
2013-09-21 14:30 - 2013-09-21 14:31 - 0424717 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153015.log
2013-09-21 14:31 - 2013-09-21 14:31 - 0000172 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153111.log
2013-09-21 14:32 - 2013-09-21 14:32 - 0003108 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153205.log
2013-09-21 14:32 - 2013-09-21 14:32 - 0023688 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153213.gnucash
2013-09-21 14:32 - 2013-09-21 14:33 - 0000172 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153213.log
2013-09-21 14:34 - 2013-09-21 14:35 - 0283253 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153430.log
2013-09-21 14:40 - 2013-09-21 14:40 - 0023682 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921154029.gnucash
2013-09-21 14:40 - 2013-09-21 15:11 - 0000805 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921154029.log
2015-01-21 10:50 - 2015-01-21 10:50 - 0031046 _____ () C:\Users\John\AppData\Local\recently-used.xbel
2013-11-19 19:02 - 2013-11-19 19:51 - 0000819 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\John\AppData\Local\Temp\bfguni.exe
C:\Users\John\AppData\Local\Temp\BRSVC_1113689968_hlp.exe
C:\Users\John\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmps8yipk.dll
C:\Users\John\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe
C:\Users\John\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Meserole\AppData\Local\Temp\InstallIMVU_502.0.exe
C:\Users\Meserole\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-01 09:29

==================== End Of Log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015
Ran by [removed] at 2015-02-02 11:23:01
Running from C:\Users\[removed]\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4500_G510af_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
4500G510af (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
4500G510af_Software_Min (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Active@ ISO Burner (HKLM-x32\…\{7694E0B1-2332-448B-9235-929F84B41E3F}) (Version: 2.5.1 - LSoft Technologies)
Adobe Creative Cloud (HKLM-x32\…\Adobe Creative Cloud) (Version: 2.9.0.465 - Adobe Systems Incorporated)
Adobe Digital Editions 4.0 (HKLM-x32\…\Adobe Digital Editions 4.0) (Version: 4.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Illustrator CC 2014 (HKLM-x32\…\{2B4B4082-8043-4646-8334-B0A29E641211}) (Version: 18.1.1 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\…\{BFDEF3C4-C349-AE43-4D36-8814E4A9DC87}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\…\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\…\avast) (Version: 10.0.2208 - AVAST Software)
Be a King: Golden Empire (HKLM-x32\…\BFG-Be a King - Golden Empire) (Version:  - )
Big Fish: Game Manager (HKLM-x32\…\BFGC) (Version: 3.3.0.2 - )
Brick-Force (HKLM-x32\…\Steam App 272490) (Version:  - Exe Games Inc.)
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Bus Driver (HKLM-x32\…\BFG-Bus Driver) (Version:  - )
Clone Wars (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\SOE-Clone Wars) (Version:  - Sony Online Entertainment)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Coupon Printer for Windows (HKLM-x32\…\Coupon Printer for Windows5.0.0.9) (Version: 5.0.0.9 - Coupons.com Incorporated)
CyberLink LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1.5510 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.1.1916 - CyberLink Corp.)
CyberLink PhotoDirector (HKLM-x32\…\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.1.3109 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.1.1902 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.1.1925 - CyberLink Corp.)
CyberLink PowerDVD (HKLM-x32\…\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.1.4319 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DC Universe Online (HKLM-x32\…\Steam App 24200) (Version:  - Sony Online Entertainment)
Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
Dropbox (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Dropbox) (Version: 3.0.5 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\…\ESET Online Scanner) (Version:  - )
Fax (x32 Version: 140.0.307.000 - Hewlett-Packard) Hidden
Free Realms (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\SOE-Free Realms) (Version:  - Sony Online Entertainment)
GIMP 2.8.14 (HKLM\…\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GnuCash 2.4.13 (HKLM-x32\…\GnuCash_is1) (Version:  - GnuCash Development Team)
Hewlett-Packard ACLM.NET v1.2.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Imaging Device Functions 14.0 (HKLM\…\HP Imaging Device Functions) (Version: 14.0 - HP)
HP MyRoom (HKLM-x32\…\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
HP Officejet 4500 G510a-f 14.0 Rel. 6 (HKLM\…\{A49C5804-8F24-433C-99B2-9F9F541090C7}) (Version: 14.0 - HP)
HP Registration Service (HKLM\…\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Update (HKLM-x32\…\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6418.0 - IDT)
Inkscape 0.48.5 (HKLM-x32\…\Inkscape) (Version: 0.48.5 - )
Java 7 Update 67 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
KidsRuby 1.4.0 (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\{613C3EA5-1248-4E35-B61A-6D0B31BBC0DB}_is1) (Version: 1.4.0 - KidsRuby Team)
King Arthur (HKLM-x32\…\BFG-King Arthur) (Version:  - )
King Mania (HKLM-x32\…\BFG-King Mania) (Version:  - )
King's Smith 2 (HKLM-x32\…\BFG-King's Smith 2) (Version:  - )
Kingsoft Office 2013 (9.1.0.4246) (HKLM-x32\…\Kingsoft Office) (Version: 9.1.0.4246 - Kingsoft Corp.)
Kodu Game Lab (HKLM-x32\…\{C27FE0CD-51B3-4D2B-A0BD-EF87561429CB}) (Version: 1.0.94 - Microsoft Research)
LEGO Minifigures Online (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\423b93224c69643b) (Version: 1.0.0.0 - Funcom)
LG VZW United Drivers (HKLM-x32\…\{FF712194-6643-4E4D-A340-2D447A644F75}) (Version: 2.16.1 - LG Electronics)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
ManyCam 4.0.77 (HKLM-x32\…\ManyCam) (Version: 4.0.77 - Visicom Media Inc.)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\…\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\…\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\…\{95140000-0137-0409-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\…\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 en-US) (HKLM-x32\…\Mozilla Thunderbird 31.4.0 (x86 en-US)) (Version: 31.4.0 - Mozilla)
OCR Software by I.R.I.S. 14.0 (HKLM\…\HPOCR) (Version: 14.0 - HP)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Outta This Kingdom (HKLM-x32\…\BFG-Outta This Kingdom) (Version:  - )
Plantasia (HKLM-x32\…\BFG-Plantasia) (Version:  - )
Q10 Editor (HKLM-x32\…\Q10) (Version:  - )
QBeez 2 (HKLM-x32\…\BFG-QBeez 2) (Version:  - )
QuickTime 7 (HKLM-x32\…\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Ralink RT5390R 802.11bgn Wi-Fi Adapter (HKLM-x32\…\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.0.0 - Ralink)
Rapport (x32 Version: 3.5.1404.61 - Trusteer) Hidden
Recovery Manager (x32 Version: 5.5.0.5530 - CyberLink Corp.) Hidden
ROBLOX Player for John Meserole (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - ROBLOX Corporation)
ROBLOX Studio for John Meserole (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version:  - ROBLOX Corporation)
Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
SeaMonkey 2.29.1 (x86 en-US) (HKLM-x32\…\SeaMonkey 2.29.1 (x86 en-US)) (Version: 2.29.1 - Mozilla)
Secure Download Manager (HKLM-x32\…\{E040B65B-8683-4228-8C33-D44A141E40EA}) (Version: 3.1.60 - Kivuto Solutions Inc.)
Skype Click to Call (HKLM-x32\…\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Star Wars The Old Republic (HKLM-x32\…\swtor_swtor) (Version: 7.0.0.41 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\…\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden
Steam (HKLM-x32\…\Steam) (Version:  - Valve Corporation)
Stencyl (HKLM-x32\…\Stencyl) (Version: 1.1.1 - Stencyl, LLC)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Team Fortress 2 (HKLM-x32\…\Steam App 440) (Version:  - Valve)
Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
Trusteer Endpoint Protection (HKLM-x32\…\Rapport_msi) (Version: 3.5.1404.61 - Trusteer)
Turbo Fiesta (HKLM-x32\…\BFG-Turbo Fiesta) (Version:  - )
Turbo Pizza (HKLM-x32\…\BFG-Turbo Pizza) (Version:  - )
Turbo Subs (HKLM-x32\…\BFG-Turbo Subs) (Version:  - )
Unity Web Player (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\UnityWebPlayer) (Version: 2.6.1f3_31223 - Unity Technologies ApS)
Viking Saga (HKLM-x32\…\BFG-Viking Saga) (Version:  - )
Visual Studio 2010 x64 Redistributables (HKLM\…\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Warface Launcher (Beta) (HKLM-x32\…\{28D1723C-31C4-4A83-9799-DFFB3739026D}) (Version: 1.0.0 - Crytek GmbH)
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Westward Kingdoms (HKLM-x32\…\BFG-Westward Kingdoms) (Version:  - )
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Wondershare PDF to PowerPoint (Build 4.0.1) (HKLM-x32\…\{25EB79AD-5D32-491C-9179-E12D79159550}_is1) (Version: 4.0.1 - Wondershare Software)
Zuma Deluxe (HKLM-x32\…\BFG-Zuma Deluxe) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\InprocServer32 -> C:\Users\John\AppData\Local\Roblox\Versions\version-5d9b22aa9d594ee1\RobloxProxy64.dll (ROBLOX Corporation)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

23-01-2015 17:24:12 Scheduled Checkpoint
28-01-2015 03:50:10 Windows Update
30-01-2015 08:04:55 avast! antivirus system restore point
01-02-2015 13:18:52 Installed Rapport

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 07:25 - 2013-08-22 07:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0BCC9570-A861-4D67-893D-FC74CD0FB91B} - \Buzz-it_wd No Task File <==== ATTENTION
Task: {0EECCAA0-3A7C-4933-A326-03F86C024A68} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-14] (Microsoft Corporation)
Task: {1792B1AA-25B8-4A8A-991C-CEE6DD826B45} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {20B7C1FD-CC35-4C36-9D5A-EE9DAA245929} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\SymErr.exe
Task: {2CAD9CA4-804E-470A-9B6F-2454E20DF8EF} - System32\Tasks\WpsUpdateTask_Meserole => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe [2014-08-05] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {3208F307-8FEC-4DEF-AD17-796454528E53} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Critical Actions Pending => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {36FC69EB-50CE-45C6-84E6-03F9827DFCD6} - System32\Tasks\WpsUpdateTask_John => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe [2014-08-05] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {37513931-B94D-4D45-A0F4-9CDF5B31796D} - System32\Tasks\{0CF3FF2C-686E-417C-AECB-9D04A9FB9D6A} => pcalua.exe -a C:\Users\John\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveSetup.exe -c  /uninstall
Task: {3C265DC1-1041-4C93-8E9A-B9EC26ED3482} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {41EDAD88-8A89-4556-A817-6C8124ABBB67} - \Buzz-it Update No Task File <==== ATTENTION
Task: {54A84B86-6B80-45BC-BDAD-53246DB1F979} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {5935EA37-05D7-4935-A45D-3E789844FF1C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-24] (Adobe Systems Incorporated)
Task: {6D26CB25-861E-4654-9E53-7BF596BE73FA} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\SymErr.exe
Task: {886CE928-4871-4127-8DA4-1EDEAD902A5F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-30] (AVAST Software)
Task: {8AC11914-B6F9-47D3-ADBB-FC77FF025BDB} - System32\Tasks\AdobeAAMUpdater-1.0-familypc-John Meserole => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-09-19] (Adobe Systems Incorporated)
Task: {8E5F426D-DCA9-4D85-AB8C-510F37CD0659} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {98BA706A-8A9F-4E32-AA5C-8B64C5652D3C} - System32\Tasks\WpsUpdateTask_John Meserole => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe [2014-08-05] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {AB740DB9-B43B-4669-A137-80959A346147} - \BackgroundContainer Startup Task No Task File <==== ATTENTION
Task: {AC3BD736-1940-436F-9B6E-77DE4EC321AC} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-11] (Microsoft Corporation)
Task: {C5D2CA13-44B4-417E-BDD6-41FF4FB1B88A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\WSCStub.exe
Task: {C8789B5A-6B1B-408D-8D27-69FDB6D4DD4E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {CC505538-DD52-44A6-B540-44BCD5D1401B} - System32\Tasks\DigitalSite => C:\Users\John\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DigitalSite.job => C:\Users\John\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\WINDOWS\Tasks\WpsUpdateTask_John Meserole.job => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe
Task: C:\WINDOWS\Tasks\WpsUpdateTask_John.job => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe
Task: C:\WINDOWS\Tasks\WpsUpdateTask_Meserole.job => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe

==================== Loaded Modules (whitelisted) =============

2014-03-20 15:20 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-01-30 08:07 - 2015-01-30 08:07 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2015-01-30 08:07 - 2015-01-30 08:07 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2014-12-19 15:57 - 2014-12-19 15:57 - 01039008 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2014-11-22 08:17 - 2014-09-23 07:36 - 08897696 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-12-19 15:57 - 2014-12-19 15:57 - 05979808 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2012-05-04 18:42 - 2012-05-04 18:42 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2015-01-30 12:05 - 2015-01-30 12:05 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15013000\algo.dll
2015-01-30 08:07 - 2015-01-30 08:07 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-02-02 10:50 - 2015-02-02 10:50 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15020200\algo.dll
2014-03-23 16:04 - 2014-03-23 16:04 - 00557056 _____ () C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll
2012-11-15 17:07 - 2012-06-07 21:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 13:34 - 2012-06-08 13:34 - 00016400 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-01-12 16:33 - 2015-01-08 14:44 - 00750080 _____ () C:\Users\John\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-02-02 08:12 - 2015-02-02 08:12 - 00043008 _____ () c:\users\john\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmps8yipk.dll
2015-01-12 16:33 - 2015-01-08 14:44 - 00047616 _____ () C:\Users\John\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-01-12 16:33 - 2015-01-08 14:44 - 00863744 _____ () C:\Users\John\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-01-12 16:33 - 2015-01-08 14:44 - 00200704 _____ () C:\Users\John\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-01-30 08:07 - 2015-01-30 08:07 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 36730032 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libcef.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 00746160 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libglesv2.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 00136368 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libegl.dll
2015-01-26 11:22 - 2015-01-26 11:22 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:10D98D98
AlternateDataStreams: C:\ProgramData\Temp:162E02F7
AlternateDataStreams: C:\ProgramData\Temp:1663E41B
AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
AlternateDataStreams: C:\ProgramData\Temp:432EC713
AlternateDataStreams: C:\ProgramData\Temp:4C3504B5
AlternateDataStreams: C:\ProgramData\Temp:6677D85A
AlternateDataStreams: C:\ProgramData\Temp:67842DB7
AlternateDataStreams: C:\ProgramData\Temp:696F7DA7
AlternateDataStreams: C:\ProgramData\Temp:69FE2EE4
AlternateDataStreams: C:\ProgramData\Temp:6B7447D4
AlternateDataStreams: C:\ProgramData\Temp:7BB584AA
AlternateDataStreams: C:\ProgramData\Temp:89FC8EEB
AlternateDataStreams: C:\ProgramData\Temp:928DF32E
AlternateDataStreams: C:\ProgramData\Temp:95775248
AlternateDataStreams: C:\ProgramData\Temp:969C0C96
AlternateDataStreams: C:\ProgramData\Temp:A1D3FEF0
AlternateDataStreams: C:\ProgramData\Temp:A3E39C6A
AlternateDataStreams: C:\ProgramData\Temp:A6B07419
AlternateDataStreams: C:\ProgramData\Temp:B02249C3
AlternateDataStreams: C:\ProgramData\Temp:B7843388
AlternateDataStreams: C:\ProgramData\Temp:C0913157
AlternateDataStreams: C:\ProgramData\Temp:C9BC8592
AlternateDataStreams: C:\ProgramData\Temp:DA9A88B3
AlternateDataStreams: C:\ProgramData\Temp:EA7D76BE
AlternateDataStreams: C:\Users\John\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\…\StartupApproved\Run32: => "QuickTime Task"
HKLM\…\StartupApproved\Run32: => "APSDaemon"
HKLM\…\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\…\StartupApproved\Run32: => "Adobe ARM"
HKLM\…\StartupApproved\Run32: => "HP Software Update"
HKLM\…\StartupApproved\Run32: => "mobilegeni daemon"
HKLM\…\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\StartupApproved\StartupFolder: => "Send to OneNote.lnk"
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\StartupApproved\Run: => "OutfoxTV"
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\StartupApproved\Run: => "ManyCam"

========================= Accounts: ==========================

Administrator (S-1-5-21-2574247163-3884555990-3468575119-500 - Administrator - Disabled)
Guest (S-1-5-21-2574247163-3884555990-3468575119-501 - Limited - Disabled) => C:\Users\Guest
John Meserole (S-1-5-21-2574247163-3884555990-3468575119-1001 - Administrator - Enabled) => C:\Users\John
Meserole (S-1-5-21-2574247163-3884555990-3468575119-1031 - Limited - Enabled) => C:\Users\Meserole
safekids (S-1-5-21-2574247163-3884555990-3468575119-1004 - Limited - Enabled) => C:\Users\safekids

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/02/2015 11:16:10 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 35.0.1.5500 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1138

Start Time: 01d03f0ad2a71b5b

Termination Time: 4294967295

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Report Id: 2bf15d58-aaff-11e4-befc-6894231cc84b

Faulting package full name:

Faulting package-relative application ID:

Error: (02/02/2015 11:16:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 35.0.1.5500, time stamp: 0x54c1f9f3
Faulting module name: mozalloc.dll, version: 35.0.1.5500, time stamp: 0x54c1f224
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x1730
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (02/02/2015 11:07:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 35.0.1.5500, time stamp: 0x54c1f9f3
Faulting module name: mozalloc.dll, version: 35.0.1.5500, time stamp: 0x54c1f224
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x1498
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (02/02/2015 08:48:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/01/2015 09:49:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 35.0.1.5500, time stamp: 0x54c1f9f3
Faulting module name: mozalloc.dll, version: 35.0.1.5500, time stamp: 0x54c1f224
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x13e4
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (02/01/2015 07:58:54 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (02/01/2015 04:10:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 35.0.1.5500 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 268

Start Time: 01d03e50e1e68167

Termination Time: 4294967295

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Report Id: 2f44ea90-aa5f-11e4-befc-6894231cc84b

Faulting package full name:

Faulting package-relative application ID:

Error: (02/01/2015 04:10:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 35.0.1.5500, time stamp: 0x54c1f9f3
Faulting module name: mozalloc.dll, version: 35.0.1.5500, time stamp: 0x54c1f224
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x134c
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (02/01/2015 09:34:37 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/01/2015 09:31:06 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.


System errors:
=============
Error: (02/02/2015 08:46:40 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (02/02/2015 08:46:10 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (02/01/2015 03:13:00 PM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (01/31/2015 07:13:56 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 70. The Windows SChannel error state is 105.

Error: (01/31/2015 10:49:50 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (01/31/2015 10:49:20 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (01/31/2015 09:14:35 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (01/31/2015 09:14:05 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (01/31/2015 01:48:01 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "WORKGROUP      :1d" could not be registered on the interface with IP address 192.168.254.1.
The computer with the IP address 192.168.254.3 did not allow the name to be claimed by
this computer.

Error: (01/30/2015 06:12:48 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "WORKGROUP      :1d" could not be registered on the interface with IP address 192.168.254.1.
The computer with the IP address 192.168.254.3 did not allow the name to be claimed by
this computer.


Microsoft Office Sessions:
=========================
Error: (02/02/2015 11:16:10 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: firefox.exe35.0.1.5500113801d03f0ad2a71b5b4294967295C:\Program Files (x86)\Mozilla Firefox\firefox.exe2bf15d58-aaff-11e4-befc-6894231cc84b

Error: (02/02/2015 11:16:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f2248000000300001425173001d03f0ada84eceaC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll2c476dcd-aaff-11e4-befc-6894231cc84b

Error: (02/02/2015 11:07:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f2248000000300001425149801d03f07e7729678C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll08d60723-aafe-11e4-befc-6894231cc84b

Error: (02/02/2015 08:48:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (02/01/2015 09:49:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f224800000030000142513e401d03e890ef167daC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll88ff2c2b-aa8e-11e4-befc-6894231cc84b

Error: (02/01/2015 07:58:54 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (02/01/2015 04:10:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: firefox.exe35.0.1.550026801d03e50e1e681674294967295C:\Program Files (x86)\Mozilla Firefox\firefox.exe2f44ea90-aa5f-11e4-befc-6894231cc84b

Error: (02/01/2015 04:10:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f2248000000300001425134c01d03e5a852b3df1C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll3017c7c3-aa5f-11e4-befc-6894231cc84b

Error: (02/01/2015 09:34:37 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (02/01/2015 09:31:06 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe


CodeIntegrity Errors:
===================================
  Date: 2015-01-30 10:47:11.193
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:10.896
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:10.583
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:10.318
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:09.990
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:09.615
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:09.318
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:09.068
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:08.661
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:08.349
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: AMD A6-5400K APU with Radeon™ HD Graphics
Percentage of memory in use: 31%
Total physical RAM: 5527.29 MB
Available physical RAM: 3809.65 MB
Total Pagefile: 6495.52 MB
Available Pagefile: 4201.87 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:918.97 GB) (Free:762.1 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:10.73 GB) (Free:1.26 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (My Book) (Fixed) (Total:298.02 GB) (Free:107.55 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: CC03408F)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 298.1 GB) (Disk ID: 44FDFE06)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=0C)

==================== End Of Log ============================

 

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-02-02 11:25:16
—————————–
11:25:16.567    OS Version: Windows x64 6.2.9200
11:25:16.568    Number of processors: 2 586 0x1001
11:25:16.569    ComputerName: FAMILYPC  UserName:
11:25:19.762    Initialize success
11:25:19.777    VM: initialized successfully
11:25:19.778    VM: Amd CPU supported virtualized
11:25:22.904    AVAST engine defs: 15020200
11:25:36.442    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000025
11:25:36.445    Disk 0 Vendor: Hitachi_HDS721010CLA630 JP4OA41A Size: 953869MB BusType: 11
11:25:36.596    Disk 0 MBR read successfully
11:25:36.601    Disk 0 MBR scan
11:25:36.610    Disk 0 unknown MBR code
11:25:36.617    Disk 0 Partition 1 00     EE          GPT            953869 MB offset 1
11:25:36.642    Disk 0 scanning C:\WINDOWS\system32\drivers
11:25:46.255    Service scanning
11:26:08.723    Modules scanning
11:26:08.741    Disk 0 trace - called modules:
11:26:08.766    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys
11:26:08.787    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe00023fe3060]
11:26:08.792    3 CLASSPNP.SYS[fffff8011001e27b] -> nt!IofCallDriver -> [0xffffe00023b1e040]
11:26:08.798    5 amd_xata.sys[fffff801100d8634] -> nt!IofCallDriver -> \Device\00000025[0xffffe00023b237f0]
11:26:10.717    AVAST engine scan C:\WINDOWS
11:26:14.692    AVAST engine scan C:\WINDOWS\system32
11:28:57.767    AVAST engine scan C:\WINDOWS\system32\drivers
11:29:12.850    AVAST engine scan C:\Users\John
12:31:17.196    File: C:\Users\John\Downloads\manualdownload.exe  **INFECTED** Win32:Evo-gen [Susp]
12:35:44.928    AVAST engine scan C:\ProgramData
12:52:37.853    Disk 0 statistics 5206051/0/0 @ 0.54 MB/s
12:52:37.863    Scan finished successfully
13:31:57.502    Disk 0 MBR has been saved successfully to "C:\Users\John\Desktop\MBR.dat"
13:31:57.527    The log file has been saved successfully to "C:\Users\John\Desktop\aswMBR.txt"

 

Post #2

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 

 

 

 

Fix with FRST (normal mode)

WARNING: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 

  • Download the attached fixlist.txt and save it to the location where FRST is saved to.
  • Run FRST.exe (on 64bit, run FRST64.exe) and press the Fix button just once and wait.
  • The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.

Full System Scan with Malwarebytes Antimalware



  • If not existing, please download Malwarebytes Anti-Malware to your desktop.
  • Double-click the downloaded setup file and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
  • Click Finish.

If the program is already installed:

  • Run Malwarebytes Antimalware
  • On the Dashboard, click the 'Update Now >>' link
  • After the update completes, click the 'Scan Now >>' button.
  • Or, on the Dashboard, click the Scan Now >> button.
  • If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
  • In most cases, a restart will be required.
  • Wait for the prompt to restart the computer to appear, then click on Yes.

  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file….
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.

 

Attachments:

Post #3

ESET scanner is running right now, here are the other two results you requested:

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/7/2015
Scan Time: 12:48:43 PM
Logfile:
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.07.07
Rootkit Database: v2015.02.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: John Meserole

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 482647
Time Elapsed: 30 min, 49 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.SweeTTunes.A, HKLM\SOFTWARE\WOW6432NODE\SweetTunes, Quarantined, [d8cbfd1e5e2cb87eb10a94f543c010f0],
PUP.Optional.SweeTTunes.A, HKU\S-1-5-21-2574247163-3884555990-3468575119-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\SweetTunes, Quarantined, [e8bbc05b5139ab8bf7c605849f64fb05],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.DownloadAdmin, C:\Users\Meserole\Downloads\Minecraft.exe, No Action By User, [0d969b806d1d66d05449e474e21e9868],

Physical Sectors: 0
(No malicious items detected)


(end)

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-02-2015
Ran by [removed] at 2015-02-07 00:08:59 Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Task: C:\WINDOWS\Tasks\DigitalSite.job => C:\Users\John\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {CC505538-DD52-44A6-B540-44BCD5D1401B} - System32\Tasks\DigitalSite => C:\Users\John\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {AB740DB9-B43B-4669-A137-80959A346147} - \BackgroundContainer Startup Task No Task File <==== ATTENTION
Task: {41EDAD88-8A89-4556-A817-6C8124ABBB67} - \Buzz-it Update No Task File <==== ATTENTION
Task: {0BCC9570-A861-4D67-893D-FC74CD0FB91B} - \Buzz-it_wd No Task File <==== ATTENTION
CHR HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Chrome\Extension: [blklojfklgnogjaijkibhfjepakiocng] - C:\Users\John\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx [2013-12-28]
CHR HKLM-x32\…\Chrome\Extension: [blklojfklgnogjaijkibhfjepakiocng] - C:\Users\John\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx [2013-12-28]
CHR Extension: (SweetTunes) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blklojfklgnogjaijkibhfjepakiocng [2014-03-02]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-26]
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
SearchScopes: HKLM-x32 -> {51e4e850-63c0-41bd-ba38-4b03541d5223} URL = http://search.condui…5163226023&UM;=2
SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = http://speedial.com/…=1186556038&ir;=
SearchScopes: HKLM -> DefaultScope value is missing.
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1031\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1004\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1001\User: Group Policy restriction detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM-x32\…\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

AlternateDataStreams: C:\ProgramData\Temp:10D98D98
AlternateDataStreams: C:\ProgramData\Temp:162E02F7
AlternateDataStreams: C:\ProgramData\Temp:1663E41B
AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
AlternateDataStreams: C:\ProgramData\Temp:432EC713
AlternateDataStreams: C:\ProgramData\Temp:4C3504B5
AlternateDataStreams: C:\ProgramData\Temp:6677D85A
AlternateDataStreams: C:\ProgramData\Temp:67842DB7
AlternateDataStreams: C:\ProgramData\Temp:696F7DA7
AlternateDataStreams: C:\ProgramData\Temp:69FE2EE4
AlternateDataStreams: C:\ProgramData\Temp:6B7447D4
AlternateDataStreams: C:\ProgramData\Temp:7BB584AA
AlternateDataStreams: C:\ProgramData\Temp:89FC8EEB
AlternateDataStreams: C:\ProgramData\Temp:928DF32E
AlternateDataStreams: C:\ProgramData\Temp:95775248
AlternateDataStreams: C:\ProgramData\Temp:969C0C96
AlternateDataStreams: C:\ProgramData\Temp:A1D3FEF0
AlternateDataStreams: C:\ProgramData\Temp:A3E39C6A
AlternateDataStreams: C:\ProgramData\Temp:A6B07419
AlternateDataStreams: C:\ProgramData\Temp:B02249C3
AlternateDataStreams: C:\ProgramData\Temp:B7843388
AlternateDataStreams: C:\ProgramData\Temp:C0913157
AlternateDataStreams: C:\ProgramData\Temp:C9BC8592
AlternateDataStreams: C:\ProgramData\Temp:DA9A88B3
AlternateDataStreams: C:\ProgramData\Temp:EA7D76BE

C:\Program Files (x86)\Mobogenie
C:\Users\John\Downloads\manualdownload.exe
C:\Users\John\AppData\Roaming\DIGITA~1

EmptyTemp:

*****************

C:\WINDOWS\Tasks\DigitalSite.job => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CC505538-DD52-44A6-B540-44BCD5D1401B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CC505538-DD52-44A6-B540-44BCD5D1401B}" => Key deleted successfully.
C:\Windows\System32\Tasks\DigitalSite => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DigitalSite" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AB740DB9-B43B-4669-A137-80959A346147}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB740DB9-B43B-4669-A137-80959A346147}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BackgroundContainer Startup Task" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{41EDAD88-8A89-4556-A817-6C8124ABBB67}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{41EDAD88-8A89-4556-A817-6C8124ABBB67}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Buzz-it Update" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0BCC9570-A861-4D67-893D-FC74CD0FB91B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0BCC9570-A861-4D67-893D-FC74CD0FB91B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Buzz-it_wd" => Key deleted successfully.
"HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\SOFTWARE\Google\Chrome\Extensions\blklojfklgnogjaijkibhfjepakiocng" => Key deleted successfully.
C:\Users\John\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx => Moved successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\blklojfklgnogjaijkibhfjepakiocng" => Key deleted successfully.
"C:\Users\John\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx" => File/Directory not found.
C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blklojfklgnogjaijkibhfjepakiocng => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi => Moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully.
HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully.
HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{51e4e850-63c0-41bd-ba38-4b03541d5223}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{51e4e850-63c0-41bd-ba38-4b03541d5223} => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}" => Key deleted successfully.
HKCR\CLSID\{31090377-0740-419E-BEFC-A56E50500D5B} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\GDriveSharedOverlay" => Key deleted successfully.
HKCR\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => Key not found.
C:\WINDOWS\system32\GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1031\User => Moved successfully.
C:\WINDOWS\system32\GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1004\User => Moved successfully.
C:\WINDOWS\system32\GroupPolicyUsers\S-1-5-21-2574247163-3884555990-3468575119-1001\User => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\SOFTWARE\Policies\Google" => Key deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => value deleted successfully.
C:\ProgramData\Temp => ":10D98D98" ADS removed successfully.
C:\ProgramData\Temp => ":162E02F7" ADS removed successfully.
C:\ProgramData\Temp => ":1663E41B" ADS removed successfully.
C:\ProgramData\Temp => ":2CB9631F" ADS removed successfully.
C:\ProgramData\Temp => ":432EC713" ADS removed successfully.
C:\ProgramData\Temp => ":4C3504B5" ADS removed successfully.
C:\ProgramData\Temp => ":6677D85A" ADS removed successfully.
C:\ProgramData\Temp => ":67842DB7" ADS removed successfully.
C:\ProgramData\Temp => ":696F7DA7" ADS removed successfully.
C:\ProgramData\Temp => ":69FE2EE4" ADS removed successfully.
C:\ProgramData\Temp => ":6B7447D4" ADS removed successfully.
C:\ProgramData\Temp => ":7BB584AA" ADS removed successfully.
C:\ProgramData\Temp => ":89FC8EEB" ADS removed successfully.
C:\ProgramData\Temp => ":928DF32E" ADS removed successfully.
C:\ProgramData\Temp => ":95775248" ADS removed successfully.
C:\ProgramData\Temp => ":969C0C96" ADS removed successfully.
C:\ProgramData\Temp => ":A1D3FEF0" ADS removed successfully.
C:\ProgramData\Temp => ":A3E39C6A" ADS removed successfully.
C:\ProgramData\Temp => ":A6B07419" ADS removed successfully.
C:\ProgramData\Temp => ":B02249C3" ADS removed successfully.
C:\ProgramData\Temp => ":B7843388" ADS removed successfully.
C:\ProgramData\Temp => ":C0913157" ADS removed successfully.
C:\ProgramData\Temp => ":C9BC8592" ADS removed successfully.
C:\ProgramData\Temp => ":DA9A88B3" ADS removed successfully.
C:\ProgramData\Temp => ":EA7D76BE" ADS removed successfully.
"C:\Program Files (x86)\Mobogenie" => File/Directory not found.
C:\Users\John\Downloads\manualdownload.exe => Moved successfully.
C:\Users\John\AppData\Roaming\DIGITA~1 => Moved successfully.
EmptyTemp: => Removed 5.9 GB temporary data.


The system needed a reboot.

==== End of Fixlog 00:19:45 ====

Post #4

Here is the ESET result list:

 

C:\FRST\Quarantine\C\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blklojfklgnogjaijkibhfjepakiocng\10.24.3.3_1\nativeMessaging\TBMessagingHost.exe    a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\FRST\Quarantine\C\Users\John\Downloads\manualdownload.exe.xBAD    a variant of Win32/InstallIQ.A potentially unwanted application
C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll    Win32/Toolbar.Conduit.Y potentially unwanted application
C:\Program Files (x86)\Conduit\CT3306061\plugins\TBVerifier.dll    a variant of Win32/Toolbar.Conduit.AM potentially unwanted application
C:\ProgramData\Conduit\Multi\CT3306061\UninstallerUI.exe    a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application
C:\ProgramData\Conduit\Multi\CT3311875\UninstallerUI.exe    a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application
C:\Users\All Users\Conduit\Multi\CT3306061\UninstallerUI.exe    a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application
C:\Users\All Users\Conduit\Multi\CT3311875\UninstallerUI.exe    a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application
C:\Users\John\AppData\Local\Conduit\APISupport\APISupport.dll    a variant of Win32/Conduit.SearchProtect.P potentially unwanted application
C:\Users\John\AppData\Local\Conduit\APISupport\APISupport.old    a variant of Win32/Conduit.SearchProtect.N potentially unwanted application
C:\Users\John\AppData\Local\Conduit\APISupport\APISupport_2.0.1.1\ApiSupport.dll    a variant of Win32/Conduit.SearchProtect.P potentially unwanted application
C:\Users\John\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll    Win32/Toolbar.Conduit.Y potentially unwanted application
C:\Users\John\AppData\Local\Conduit\BackgroundContainer\TBUpdaterLogic_1.0.0.1.dll    Win32/Toolbar.Conduit.Y potentially unwanted application
C:\Users\John\AppData\Local\Conduit\Chrome\CT3311875\CHUninstaller.exe    a variant of Win32/Conduit.SearchProtect.N potentially unwanted application
C:\Users\John\AppData\Local\Conduit\Chrome\CT3311875\UninstallerUI.exe    a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application
C:\Users\John\AppData\Local\NativeMessaging\CT3311875\1_0_0_10\TBMessagingHost.exe    a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Users\John\AppData\Local\NativeMessaging\CT3311875\1_0_0_7\TBMessagingHost.exe    a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Users\John\AppData\Local\NativeMessaging\CT3311875\1_0_0_9\TBMessagingHost.exe    Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Users\John\Downloads\Adobe_Reader_setup.exe    Win32/InstallCore.EL potentially unwanted application
C:\Users\John\Downloads\cbsidlm-cbsi134-Kingsoft_Office_Free_2013-SEO-75563178.exe    a variant of Win32/CNETInstaller.B potentially unwanted application
C:\Users\John\Downloads\cbsidlm-cbsi145-Free_M4a_to_MP3_Converter-SEO-187723.exe    a variant of Win32/CNETInstaller.B potentially unwanted application
C:\Users\John\Downloads\Shockwave_Installer_Slim.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\John\Pictures\zafwSetupWeb_110_000_504.exe    Win32/Toolbar.Conduit potentially unwanted application
C:\Users\Meserole\Downloads\Minecraft.exe    a variant of Win32/DownloadAdmin.H potentially unwanted application
C:\Windows\System32\Adobe\Shockwave 12\gt.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
 

Post #5

Then we can do the cleanup - if you are facing any issues, report that immediately.

Delete junk with adwCleaner


Please download AdwCleaner to your desktop.


  • Run adwcleaner.exe

  • Hit Scan and wait for the scan to finish.

  • Confirm the message but don´t uncheck anything.

  • Hit Clean

  • When the run is finished, it will open up a text file

  • Please post its contents within your next reply

  • You´ll find the log file at C:\AdwCleaner[S1].txt also




Delete junk with JRT

[external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.

  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

  • The tool will open and start scanning your system.

  • Please be patient as this can take a while to complete depending on your system's specifications.

  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

  • Post the contents of JRT.txt into your next message.




SecurityCheck

Reboot your system before starting!

Please download SecurityCheck: LINK1 LINK2

  • Save it to your desktop, start it and follow the instructions in the window.

  • After the scan finished the (checkup.txt) will open. Copy its content to your thread.

Post #6

# AdwCleaner v4.110 - Logfile created 10/02/2015 at 16:39:52
# Updated 05/02/2015 by Xplode
# Database : 2015-02-09.1 [Server]
# Operating system : Windows 8.1  (x64)
# Username : John Meserole - FAMILYPC
# Running from : C:\Users\John\Downloads\adwcleaner_4.110.exe
# Option : Cleaning

***** [ Services ] *****

Service Deleted : CouponPrinterService

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Conduit
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Coupons
Folder Deleted : C:\WINDOWS\SysWOW64\SearchProtect
Folder Deleted : C:\Users\John\AppData\Local\Conduit
Folder Deleted : C:\Users\John\AppData\Local\genienext
Folder Deleted : C:\Users\John\AppData\Local\Mobogenie
Folder Deleted : C:\Users\John\AppData\Local\NativeMessaging
Folder Deleted : C:\Users\John\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\John\AppData\Roaming\SearchProtect
Folder Deleted : C:\Users\John\AppData\Roaming\Systweak
Folder Deleted : C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Weather Alerts
Folder Deleted : C:\Users\John\Documents\Mobogenie
Folder Deleted : C:\Users\John\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cmaiofennmphjldldcpphcechfnnohja
File Deleted : C:\END
File Deleted : C:\WINDOWS\System32\roboot64.exe
File Deleted : C:\Users\John\daemonprocess.txt
File Deleted : C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\user.js
File Deleted : C:\Users\John\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\hxxp_services.hearstmags.com_0.localstorage-journal
File Deleted : C:\Users\John\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\hxxp_services.hearstmags.com_0.localstorage
File Deleted : C:\Users\John\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journal

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3311875
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\BackgroundContainer
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\HappyLyrics
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\systweak
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.0.9
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v35.0.1 (x86 en-US)


-\\ Google Chrome v

[C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
[C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\John\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://movies1.netflix.com/WiSearch?raw_query=flubber&ac_category_type=none&ac_rel_posn=-1&ac_abs_posn=-1&v1={searchTerms}&search_submit=

-\\ Comodo Dragon v

[C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
[C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\John\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://movies1.netflix.com/WiSearch?raw_query=flubber&ac_category_type=none&ac_rel_posn=-1&ac_abs_posn=-1&v1={searchTerms}&search_submit=

*************************

AdwCleaner[R0].txt - [7233 bytes] - [10/02/2015 16:30:33]
AdwCleaner[S0].txt - [7533 bytes] - [10/02/2015 16:39:52]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7592  bytes] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 8.1 x64
Ran by [removed] on Tue 02/10/2015 at 16:54:51.57
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\WINDOWS\couponprinter.ocx"



~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\AlawarEntertainment
Successfully deleted: [Folder] "C:\Users\John\appdata\local\cre"
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{04CA88BF-5B35-4CB0-9C6A-94ECA830EEEE}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{053DF7E2-48BC-460C-B0D6-0D86D65727BF}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{0E60BF47-8F4F-4AA3-BB0A-DC8D6F1EF103}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{282DAA18-9C3C-482D-B746-492B29679432}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{31C24040-1093-4C59-B90D-DF7F56024717}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{3DAAA5EF-E325-4FE5-B556-7108E63D01AC}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{42E80B15-B433-42C6-AD24-7CB314882AE3}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{438DD975-3946-406C-B553-9E6E208D1754}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{6BF82207-B018-442D-B2A4-E2576914DC56}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{6E747A3C-0917-4F2C-9A25-F7476C407976}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{794DD194-7660-4F9C-AC3A-41C1353DB61B}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{88A62E2F-F3FB-42EC-9409-438D29029F48}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{8F3BA98F-06E7-4126-95E7-9F4265AB0D35}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{9C097BE1-BC37-4A31-8CFB-578483F4B864}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{9E6E26AD-ADAB-48C5-AA87-A1BB409E84E2}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{A58445C0-830B-4DE7-8B99-970D01147A58}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{B62A2135-54C3-41FB-80E7-A95C880F3349}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{C2B33CED-CF22-48C8-B00E-64D05670EA68}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{C9A1FE3E-0AB9-452F-8063-0DAF79646131}
Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{F798B585-BA36-41B5-A880-2EC517E414C7}



~~~ FireFox

Emptied folder: C:\Users\John\AppData\Roaming\mozilla\firefox\profiles\7ypogjw1.default-1392514649814\minidumps [43 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 02/10/2015 at 17:06:28.55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


 

Post #7

 Results of screen317's Security Check version 0.99.96  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Windows Defender   
avast! Antivirus   
 Antivirus out of date!  
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 67  
 Java version 32-bit out of Date!
  Java 64-bit 8 Update 31  
 Adobe Flash Player     16.0.0.305  
 Adobe Reader XI  
 Mozilla Firefox (35.0.1)
 Mozilla Thunderbird (31.4.0)
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast ng vbox\AvastVBoxSVC.exe
 AVAST Software Avast ng ngservice.exe
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````
 

Post #8

Your system is clean now! :)

 

 

Java runtime Environment out of date

Your Java runtime environment is outdated. We will fix this.

  • Get the actual JRE from here
  • Save jxpiinstall.exe to your desktop
  • Close all running programs, especially your browser(s)
  • Run jxpiinstall.exe. This will download the newest JRE installer and install the software
  • when finished, go to
    • Start–>control panel–>add/remove programs and remove all older Java versions. (if existing)
  • When finished, reboot your computer.

After the reboot
  • Open control panel again and click the java symbol.
  • Click Settings under Temporary Internet Files.
    • The Temporary Files Settings dialog box appears.
  • Click Delete Files.
    • The Delete Temporary Files dialog box appears
  • Click OK on Delete Temporary Files window.
  • Click OK again.

 

 

 

Update your antivirus as well!

 

 

 

Uninstall our tools using delfix

Please follow these steps in order:

  1. In the case we used Defogger to turn off your CD emulation software. You can start it again and use the Enable button.
  2. In the case we used Combofix. Deactivate your antivirus software once more, then rename the combofix.exe to uninstall.exe and run it one last time. You shall be noted that Combofix has been removed.
  3. In any case please download delfix to your desktop.
    • Close all other programms and start delfix.
    • Please check all the boxes and run the tool.
    • delfix will now delete all found traces of our removal process

  4. If there is still something left please delete it manualy.




Delete System Restore Points

To ensure your System Restore Points are free of malware, we will delete all of them but the most recent or create a new one.

On Windows Vista: Please follow these instructions to delete all but the most common System Protection Restore Points.
On Windows 7/8: Please follow these instructions to delete all but the most common System Protection Restore Points.
On Windows XP: Please follow these instructions to delete all but the most common System Protection Restore Points.

 

 

 

Recommendations: How to protect yourself

  • System Updates
    • Please ensure to have automatic updates activated in your control panel.
    For further information and a tutorial, see this Microsoft Support article.
  • Protection
    • What you need is one (not more) virus scanner with background protection. Additionally I recommend a special malware scanner to run on demand weekly.
    Personally I am using avast! Antivirus Free Edition and Malwarebytes Anti-Malware. They offer good protection for free.
    • To keep your browser free of advertising, you may install the Adblock Plus browser extension.
      • It will filter unwanted advertising out of the website´s content.
    • To protect yourself from accidentally visiting malicious web sites, install the Web of Trust (WOT) browser extension.
      • It will display a green (safe), yellow (unknown) or red (potentially dangerous) icon for a visited website within your browser.
      In addition, before accessing a dangerous classified web site, a warning screen is displayed.


  • Up to date Software
    • Keep your Windows and your third party software up to date. The easiest way to get infected is an outdated windows, followed by: browser(s) (including add-ons and plug-ins), Adobe Flash Player and Adobe Reader, Java Runtime Environment, your antivirus program and so on. These links may help you to check:
    • Secunia Personal Software Inspector - checks if your software has updates available.

    • SecurityCheck (by screen317) - scans your computer for most vulnerable outdated software.

    • Mozilla: Check your plugins - The webpage will tell you if you have outdated plugins running in your Firefox browser.


  • Backup
    • Hardware issues, malware, fire, lightning strike: There is a long list of different ways to loose all your data. Back up your files regularly. Use the windows internal backup function or a third party tool and save your data onto an external hard drive, cloud storage, optical media like CDs or DVDs or (if available) a professional network backup system.
  • Behaviour
    • The commonest error when using a computer is "error 80" - what means that the error is located about 80cm in front of the monitor. This is a common joke between IT support technicians but it shows that all the safety mechanisms won´t help if you aren´t careful enough.
    • While surfing the internet, don´t click on anything you don´t know. In the worst case, it infects your system with malware.

    • Watch your step in social networks! Many cyber criminals use them to spread malware, mine personal pata (to be sold to advertising companies, for example) or simply do damage to other users. Even if a received hyperlink within a message seems to be coming from one of your friends, have a closer look. In addition, don´t click everything.

    • When installing software, have a look to each of the setup windows and uncheck any additional toolbars or free programs that may be offered additionally. Most of today´s setup procedures contain potentially unwanted programs so keep them off your system.

    • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
      • They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.

Post #9

I completed the tasks (Except the restore points.) Unfortunately, I am having problems.  Two days ago, every time I tried to go to a site, it had to be refreshed several times to load.  I cleared the cache and ran some scans with nothing big being found, but sites now load but not all functions are available.  Some sites load without the rich content until I reload them.  Some don't ever work.  Here are the results of some scans I ran.  I don't know if you need me to open a new topic or not, but here are the results: ( I updated java today, so the scans that were ran before today may not indicate this.)

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by [removed] (administrator) on FAMILYPC on 06-03-2015 10:56:36
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
() C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Dropbox, Inc.) C:\Users\John\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-09-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-07] (CyberLink)
HKLM-x32\…\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-02] (CyberLink Corp.)
HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-30] (AVAST Software)
HKLM-x32\…\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1691136 2012-05-31] (Wondershare)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\…\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\…\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2015-01-07] (Adobe Systems Incorporated)
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Run: [ManyCam] => C:\Program Files (x86)\ManyCam\ManyCam.exe [8473064 2014-03-26] (Visicom Media Inc.)
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2874048 2015-02-18] (Valve Corporation)
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Run: [BIBLauncher] => C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe [3950440 2014-10-16] ()
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\MountPoints2: {4b191b83-4112-11e4-bef0-78e3b5b3c153} - "H:\VerizonSWUpgradeAssistantLauncher.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\John\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Meserole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk
ShortcutTarget: IMVU.lnk -> C:\Users\John\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe (No File)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&src;=IE-SearchBox&FORM;=IE10SR
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = www.bing.com
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
SearchScopes: HKLM -> {0ABF015E-E08C-4AA1-BA04-3FB7766AB13A} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 -> {0ABF015E-E08C-4AA1-BA04-3FB7766AB13A} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll No File
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.254.254

FireFox:
========
FF ProfilePath: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814
FF DefaultSearchEngine: DuckDuckGo
FF DefaultSearchEngine.US: DuckDuckGo
FF SelectedSearchEngine: DuckDuckGo
FF Homepage: hxxp://www.ldsscripturemastery.net/en/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-2574247163-3884555990-3468575119-1001: @nsroblox.roblox.com/launcher -> C:\Users\John\AppData\Local\Roblox\Versions\version-5d9b22aa9d594ee1\\NPRobloxProxy.dll ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2574247163-3884555990-3468575119-1001: @nsroblox.roblox.com/launcher64 -> C:\Users\John\AppData\Local\Roblox\Versions\version-5d9b22aa9d594ee1\\NPRobloxProxy64.dll ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2574247163-3884555990-3468575119-1001: @soe.sony.com/installer,version=1.0.3 -> C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\299hw44i.default-1372520734002\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll No File
FF Plugin HKU\S-1-5-21-2574247163-3884555990-3468575119-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\John\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF SearchPlugin: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\searchplugins\duckduckgo.xml
FF SearchPlugin: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\searchplugins\startpage-ssl.xml
FF Extension: Firebug - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\[removed] [2014-12-27]
FF Extension: Pin It Button - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\[removed] [2015-01-07]
FF Extension: Buffer - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\[removed] [2015-03-06]
FF Extension: WiseStamp Web - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\[removed] [2015-02-17]
FF Extension: Boomerang for GMail - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\{65e41d20-f092-41b7-bb83-c6e8a9ab0f57}.xpi [2015-03-03]
FF Extension: MeasureIt - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}.xpi [2015-02-17]
FF Extension: FirefoxAdKiller - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\7ypogjw1.default-1392514649814\Extensions\{b1df372d-8b32-4c7d-b6b4-9c5b78cf6fb1}.xpi [2014-04-13]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-21]

Chrome:
=======
CHR Profile: C:\Users\John\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-21]
CHR Extension: (Google Drive) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-21]
CHR Extension: (YouTube) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-21]
CHR Extension: (Google Search) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-21]
CHR Extension: (Google Wallet) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-03]
CHR Extension: (Gmail) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-21]
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-30]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-30] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-01-30] (Avast Software)
S2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
S3 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2711736 2015-01-13] (Microsoft Corporation)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [1919256 2015-02-12] (IBM Corp.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-11-20] (IDT, Inc.) [File not signed]
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-03-03] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-30] ()
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-30] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-30] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-30] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-30] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-30] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 CpqDfw; C:\Windows\System32\drivers\CpqDfw.sys [27456 2012-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 ManyCam; C:\Windows\system32\DRIVERS\mcvidrv.sys [52128 2013-11-26] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\system32\drivers\mcaudrv_x64.sys [35232 2013-12-06] (Visicom Media Inc.)
R4 RapportCerberus_80120; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80120.sys [845464 2015-02-01] (IBM Corp.)
R1 RapportCerberus_80128; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80128.sys [844440 2015-02-26] (IBM Corp.)
R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [445816 2015-02-12] (IBM Corp.)
R0 RapportHades64; C:\Windows\System32\Drivers\RapportHades64.sys [290520 2015-02-12] (IBM Corp.)
R0 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [535576 2015-02-12] (IBM Corp.)
R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [558872 2015-02-12] (IBM Corp.)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2014-03-03] (Duplex Secure Ltd.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-01-30] (Avast Software)
S3 vzandnetdiag; C:\Windows\system32\DRIVERS\lgvzandnetdiag64.sys [29696 2014-05-27] (LG Electronics Inc.)
S3 vzandnetmodem; C:\Windows\system32\DRIVERS\lgvzandnetmdm64.sys [36864 2014-05-27] (LG Electronics Inc.)
S3 vzandnetndis; C:\Windows\system32\DRIVERS\lgvzandnetndis64.sys [94208 2014-05-26] (LG Electronics Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 10:56 - 2015-03-06 10:57 - 00023752 _____ () C:\Users\John\Desktop\FRST.txt
2015-03-05 17:42 - 2015-03-05 17:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-03 16:15 - 2015-03-01 23:45 - 01388333 _____ (Thisisu) C:\Users\John\Desktop\JRT_NEW.exe
2015-03-02 13:19 - 2015-03-02 13:19 - 00000000 ____D () C:\Users\John\Downloads\order forms pdf
2015-03-02 13:18 - 2015-03-02 13:18 - 00372840 _____ () C:\Users\John\Downloads\order forms pdf.zip
2015-02-26 09:17 - 2015-02-26 11:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-02-26 08:44 - 2015-02-26 08:44 - 00000000 ____D () C:\Users\Default\AppData\Local\Trusteer
2015-02-26 08:44 - 2015-02-26 08:44 - 00000000 ____D () C:\Users\Default User\AppData\Local\Trusteer
2015-02-24 20:52 - 2014-12-13 15:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls
2015-02-24 20:52 - 2014-12-13 15:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls
2015-02-24 20:52 - 2014-10-28 19:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2015-02-24 20:52 - 2014-10-28 19:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2015-02-24 20:52 - 2014-10-28 19:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2015-02-24 20:52 - 2014-10-28 19:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2015-02-24 03:11 - 2015-02-24 03:11 - 00000000 ____D () C:\Users\John\AppData\Roaming\PDAppFlex
2015-02-24 00:23 - 2015-02-25 07:36 - 00000000 ____D () C:\Users\John\Documents\Business-in-a-Box Files
2015-02-24 00:23 - 2015-02-24 00:55 - 00000000 _____ () C:\Users\John\AppData\Roaming\bibstats
2015-02-24 00:23 - 2015-02-24 00:23 - 00001153 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Business-in-a-Box.lnk
2015-02-24 00:23 - 2015-02-24 00:23 - 00001147 _____ () C:\Users\Public\Desktop\Business-in-a-Box.lnk
2015-02-24 00:23 - 2015-02-24 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business-in-a-Box
2015-02-24 00:21 - 2015-02-24 00:50 - 00000000 ____D () C:\Program Files (x86)\Business-in-a-Box
2015-02-24 00:20 - 2015-02-24 00:20 - 00519016 _____ (Biztree Inc.) C:\Users\John\Downloads\business-in-a-box_setup.exe
2015-02-23 23:10 - 2015-02-23 23:10 - 00021504 _____ () C:\Users\John\Documents\shipping-invoice-template.xls
2015-02-21 14:27 - 2015-02-21 14:27 - 00000000 ____D () C:\Users\Meserole\AppData\Local\Steam
2015-02-20 17:25 - 2015-02-20 17:25 - 00000000 ____D () C:\Users\John\AppData\Local\Steam
2015-02-18 13:48 - 2015-02-18 13:48 - 00000000 ____D () C:\Users\Meserole\Documents\My Scans
2015-02-17 21:46 - 2015-02-17 21:46 - 00000000 ____D () C:\Users\John\AppData\Local\{23414FB3-8F9C-4428-B4C8-457E0C319F8B}
2015-02-17 19:37 - 2015-02-17 19:37 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\HP
2015-02-17 19:37 - 2015-02-17 19:37 - 00000000 ____D () C:\Users\Meserole\AppData\Local\HP
2015-02-12 15:20 - 2015-02-12 15:21 - 29720272 _____ () C:\Users\Meserole\Downloads\SWTOR_setup.exe
2015-02-12 13:37 - 2015-02-12 13:37 - 00000000 ____D () C:\WINDOWS\Minidump
2015-02-11 08:43 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-02-11 08:43 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-02-10 17:13 - 2015-02-10 17:13 - 00852594 _____ () C:\Users\John\Downloads\SecurityCheck.exe
2015-02-10 16:53 - 2015-02-10 16:54 - 01388274 _____ (Thisisu) C:\Users\John\Downloads\JRT.exe
2015-02-10 16:43 - 2015-01-15 16:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-02-10 16:43 - 2015-01-15 16:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-02-10 16:43 - 2015-01-13 22:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-02-10 16:43 - 2015-01-13 21:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-02-10 16:43 - 2015-01-13 16:11 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-02-10 16:43 - 2015-01-13 16:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-02-10 16:43 - 2015-01-10 03:10 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-02-10 16:43 - 2015-01-10 03:10 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-02-10 16:43 - 2015-01-10 02:28 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-02-10 16:43 - 2014-12-08 21:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll
2015-02-10 16:43 - 2014-12-08 19:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll
2015-02-10 16:43 - 2014-10-28 20:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll
2015-02-10 16:43 - 2014-10-28 20:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2015-02-10 16:43 - 2014-10-28 20:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2015-02-10 16:43 - 2014-10-28 20:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll
2015-02-10 16:43 - 2014-10-28 20:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-02-10 16:43 - 2014-10-28 20:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-02-10 16:43 - 2014-10-28 19:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll
2015-02-10 16:43 - 2014-10-28 19:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-02-10 16:43 - 2014-10-28 19:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll
2015-02-10 16:43 - 2014-10-28 19:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll
2015-02-10 16:43 - 2014-10-28 19:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe
2015-02-10 16:43 - 2014-10-28 19:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe
2015-02-10 16:43 - 2014-10-28 19:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe
2015-02-10 16:42 - 2015-01-19 12:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2015-02-10 16:42 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-02-10 16:42 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-02-10 16:42 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-02-10 16:42 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-02-10 16:42 - 2015-01-11 20:34 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-02-10 16:42 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-02-10 16:42 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2015-02-10 16:42 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-02-10 16:42 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-02-10 16:42 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-02-10 16:42 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-02-10 16:42 - 2015-01-11 19:58 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-02-10 16:42 - 2015-01-11 19:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-02-10 16:42 - 2015-01-11 19:51 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-02-10 16:42 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-02-10 16:42 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-02-10 16:42 - 2015-01-11 19:48 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-02-10 16:42 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-02-10 16:42 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2015-02-10 16:42 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-02-10 16:42 - 2015-01-11 19:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-02-10 16:42 - 2015-01-11 19:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-02-10 16:42 - 2015-01-11 19:27 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-02-10 16:42 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-02-10 16:42 - 2015-01-11 19:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-02-10 16:42 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-02-10 16:42 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-02-10 16:42 - 2015-01-11 19:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-02-10 16:42 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-02-10 16:42 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-02-10 16:42 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-02-10 16:42 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-02-10 16:42 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-02-10 16:42 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-02-10 16:42 - 2015-01-10 01:00 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-02-10 16:42 - 2015-01-10 00:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-02-10 16:42 - 2014-12-19 02:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2015-02-10 16:42 - 2014-12-19 02:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2015-02-10 16:42 - 2014-12-08 17:12 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-02-10 16:41 - 2015-01-10 02:22 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-02-10 16:30 - 2015-02-10 16:40 - 00000000 ____D () C:\AdwCleaner
2015-02-10 16:29 - 2015-02-10 16:30 - 02112512 _____ () C:\Users\John\Downloads\adwcleaner_4.110.exe
2015-02-09 16:59 - 2015-02-09 16:59 - 00022021 _____ () C:\Users\John\AppData\Local\recently-used.xbel
2015-02-07 13:25 - 2015-02-07 13:25 - 02347384 _____ (ESET) C:\Users\John\Downloads\esetsmartinstaller_enu.exe
2015-02-07 00:08 - 2015-03-06 10:56 - 00000000 ____D () C:\Users\John\Desktop\FRST-OlderVersion
2015-02-05 14:38 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_7.dll
2015-02-05 14:38 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_7.dll
2015-02-05 14:38 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_7.dll
2015-02-05 14:38 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_7.dll
2015-02-05 14:38 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_5.dll
2015-02-05 14:38 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_5.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dcsx_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dcsx_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx11_43.dll
2015-02-05 14:38 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx11_43.dll
2015-02-05 14:38 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_6.dll
2015-02-05 14:38 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_6.dll
2015-02-05 14:38 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_6.dll
2015-02-05 14:38 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_6.dll
2015-02-05 14:38 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_4.dll
2015-02-05 14:38 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_4.dll
2015-02-05 14:38 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_7.dll
2015-02-05 14:38 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_7.dll
2015-02-05 14:38 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_5.dll
2015-02-05 14:38 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_5.dll
2015-02-05 14:38 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_5.dll
2015-02-05 14:38 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_3.dll
2015-02-05 14:38 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dcsx_42.dll
2015-02-05 14:38 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dcsx_42.dll
2015-02-05 14:38 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_42.dll
2015-02-05 14:38 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_42.dll
2015-02-05 14:38 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_42.dll
2015-02-05 14:38 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_42.dll
2015-02-05 14:38 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx11_42.dll
2015-02-05 14:38 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx11_42.dll
2015-02-05 14:38 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_4.dll
2015-02-05 14:38 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_4.dll
2015-02-05 14:38 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_4.dll
2015-02-05 14:38 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_4.dll
2015-02-05 14:38 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_6.dll
2015-02-05 14:38 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_6.dll
2015-02-05 14:38 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_41.dll
2015-02-05 14:38 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_41.dll
2015-02-05 14:38 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_41.dll
2015-02-05 14:38 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_41.dll
2015-02-05 14:38 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_3.dll
2015-02-05 14:38 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_3.dll
2015-02-05 14:38 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_3.dll
2015-02-05 14:38 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_3.dll
2015-02-05 14:38 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_2.dll
2015-02-05 14:38 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_2.dll
2015-02-05 14:38 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_5.dll
2015-02-05 14:38 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_5.dll
2015-02-05 14:38 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_40.dll
2015-02-05 14:38 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_40.dll
2015-02-05 14:38 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_40.dll
2015-02-05 14:38 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_40.dll
2015-02-05 14:38 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_40.dll
2015-02-05 14:38 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_40.dll
2015-02-05 14:38 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_2.dll
2015-02-05 14:38 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_2.dll
2015-02-05 14:38 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_1.dll
2015-02-05 14:38 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_1.dll
2015-02-05 14:38 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_2.dll
2015-02-05 14:38 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_2.dll
2015-02-05 14:38 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_39.dll
2015-02-05 14:38 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_39.dll
2015-02-05 14:38 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_39.dll
2015-02-05 14:38 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_39.dll
2015-02-05 14:38 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_39.dll
2015-02-05 14:38 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_39.dll
2015-02-05 14:38 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_1.dll
2015-02-05 14:38 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_1.dll
2015-02-05 14:38 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_1.dll
2015-02-05 14:38 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_1.dll
2015-02-05 14:38 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_0.dll
2015-02-05 14:38 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_0.dll
2015-02-05 14:38 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_4.dll
2015-02-05 14:38 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_4.dll
2015-02-05 14:38 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_38.dll
2015-02-05 14:38 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_38.dll
2015-02-05 14:38 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_38.dll
2015-02-05 14:38 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_38.dll
2015-02-05 14:38 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_38.dll
2015-02-05 14:38 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_38.dll
2015-02-05 14:38 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_0.dll
2015-02-05 14:38 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_0.dll
2015-02-05 14:38 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine3_0.dll
2015-02-05 14:38 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine3_0.dll
2015-02-05 14:38 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_3.dll
2015-02-05 14:38 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_3.dll
2015-02-05 14:38 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_37.dll
2015-02-05 14:38 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_37.dll
2015-02-05 14:38 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_37.dll
2015-02-05 14:38 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_37.dll
2015-02-05 14:38 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_37.dll
2015-02-05 14:38 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_37.dll
2015-02-05 14:38 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_10.dll
2015-02-05 14:38 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_10.dll
2015-02-05 14:38 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\WINDOWS\system32\X3DAudio1_2.dll
2015-02-05 14:38 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\X3DAudio1_2.dll
2015-02-05 14:38 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_36.dll
2015-02-05 14:38 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_36.dll
2015-02-05 14:38 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_36.dll
2015-02-05 14:38 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_36.dll
2015-02-05 14:38 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_36.dll
2015-02-05 14:38 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_36.dll
2015-02-05 14:38 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_9.dll
2015-02-05 14:38 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_9.dll
2015-02-05 14:38 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_35.dll
2015-02-05 14:38 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_35.dll
2015-02-05 14:38 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_35.dll
2015-02-05 14:38 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_35.dll
2015-02-05 14:38 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_35.dll
2015-02-05 14:38 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_35.dll
2015-02-05 14:38 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_8.dll
2015-02-05 14:38 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_8.dll
2015-02-05 14:37 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_34.dll
2015-02-05 14:37 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_34.dll
2015-02-05 14:37 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_34.dll
2015-02-05 14:37 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_34.dll
2015-02-05 14:37 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_34.dll
2015-02-05 14:37 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_34.dll
2015-02-05 14:37 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_7.dll
2015-02-05 14:37 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_7.dll
2015-02-05 14:37 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\WINDOWS\system32\xinput1_3.dll
2015-02-05 14:37 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xinput1_3.dll
2015-02-05 14:37 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_33.dll
2015-02-05 14:37 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_33.dll
2015-02-05 14:37 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_33.dll
2015-02-05 14:37 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_33.dll
2015-02-05 14:37 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_33.dll
2015-02-05 14:37 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_33.dll
2015-02-05 14:37 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\WINDOWS\system32\x3daudio1_1.dll
2015-02-05 14:37 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\x3daudio1_1.dll
2015-02-05 14:37 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_6.dll
2015-02-05 14:37 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_6.dll
2015-02-05 14:37 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_5.dll
2015-02-05 14:37 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_5.dll
2015-02-05 14:37 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10.dll
2015-02-05 14:37 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10.dll
2015-02-05 14:37 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_31.dll
2015-02-05 14:37 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_31.dll
2015-02-05 14:37 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_4.dll
2015-02-05 14:37 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_4.dll
2015-02-05 14:37 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\WINDOWS\system32\xinput1_2.dll
2015-02-05 14:37 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_3.dll
2015-02-05 14:37 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_3.dll
2015-02-05 14:37 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xinput1_2.dll
2015-02-05 14:37 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_2.dll
2015-02-05 14:37 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_2.dll
2015-02-05 14:37 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_30.dll
2015-02-05 14:37 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_30.dll
2015-02-05 14:37 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_1.dll
2015-02-05 14:37 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_1.dll
2015-02-05 14:37 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\WINDOWS\system32\xinput1_1.dll
2015-02-05 14:37 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xinput1_1.dll
2015-02-05 14:37 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_29.dll
2015-02-05 14:37 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_29.dll
2015-02-05 14:37 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\WINDOWS\system32\xactengine2_0.dll
2015-02-05 14:37 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xactengine2_0.dll
2015-02-05 14:37 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\WINDOWS\system32\x3daudio1_0.dll
2015-02-05 14:37 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\x3daudio1_0.dll
2015-02-05 14:37 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_28.dll
2015-02-05 14:37 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_28.dll
2015-02-05 14:37 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_27.dll
2015-02-05 14:37 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_27.dll
2015-02-05 14:37 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_26.dll
2015-02-05 14:37 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_26.dll
2015-02-05 14:37 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_25.dll
2015-02-05 14:37 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_25.dll
2015-02-05 14:37 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_24.dll
2015-02-05 14:37 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_24.dll
2015-02-05 10:08 - 2015-02-05 10:08 - 00000981 _____ () C:\Users\Public\Desktop\Steam.lnk
2015-02-05 10:07 - 2015-02-05 10:07 - 01142128 _____ () C:\Users\John\Downloads\SteamSetup(1).exe
2015-02-04 10:49 - 2015-02-04 10:49 - 00000000 ____D () C:\Users\Meserole\AppData\Local\Trusteer

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 10:56 - 2015-02-02 11:20 - 00000000 ____D () C:\FRST
2015-03-06 10:56 - 2015-02-02 11:19 - 02092544 _____ (Farbar) C:\Users\John\Desktop\FRST64.exe
2015-03-06 10:54 - 2014-02-24 11:24 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-03-06 10:44 - 2013-12-05 16:08 - 00000398 _____ () C:\WINDOWS\Tasks\WpsUpdateTask_Meserole.job
2015-03-06 10:30 - 2014-05-17 15:15 - 00000408 _____ () C:\WINDOWS\Tasks\WpsUpdateTask_John Meserole.job
2015-03-06 10:15 - 2014-03-03 20:31 - 01163326 _____ () C:\WINDOWS\WindowsUpdate.log
2015-03-06 10:09 - 2013-08-25 16:56 - 00000390 _____ () C:\WINDOWS\Tasks\WpsUpdateTask_John.job
2015-03-06 10:00 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-03-06 09:00 - 2013-04-17 20:36 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2574247163-3884555990-3468575119-1001
2015-03-06 07:51 - 2014-03-30 12:56 - 00062017 _____ () C:\WINDOWS\system32\lvcoinst.log
2015-03-06 07:51 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-03-06 07:42 - 2013-07-19 07:52 - 00000000 ____D () C:\Users\John\AppData\Local\Adobe
2015-03-06 07:41 - 2015-01-12 16:34 - 00000000 ___RD () C:\Users\John\Dropbox
2015-03-06 07:41 - 2015-01-12 16:30 - 00000000 ____D () C:\Users\John\AppData\Roaming\Dropbox
2015-03-06 07:39 - 2014-04-25 20:40 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-05 16:38 - 2014-07-22 21:43 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-03-04 17:24 - 2013-09-06 13:49 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2574247163-3884555990-3468575119-1031
2015-03-04 16:55 - 2013-09-06 13:43 - 00003938 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{86279D80-09C8-4862-B508-B3039270FC25}
2015-03-04 13:44 - 2013-08-22 08:46 - 00432322 _____ () C:\WINDOWS\setupact.log
2015-03-03 10:54 - 2013-11-19 19:52 - 00000000 ____D () C:\Users\John\Documents\My Scans
2015-03-02 12:04 - 2014-12-18 19:59 - 00000000 ____D () C:\Users\John\Desktop\PLDB
2015-02-27 21:31 - 2014-11-11 19:25 - 00001413 _____ () C:\Users\Meserole\Desktop\ROBLOX Player.lnk
2015-02-27 21:31 - 2014-11-11 19:24 - 00001228 _____ () C:\Users\Meserole\Desktop\ROBLOX Studio.lnk
2015-02-27 21:31 - 2014-11-11 19:24 - 00000000 ____D () C:\Users\Meserole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2015-02-27 19:54 - 2013-08-22 08:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-26 11:49 - 2014-02-15 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-26 08:44 - 2015-02-01 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection
2015-02-26 08:42 - 2013-11-14 01:20 - 00518812 _____ () C:\WINDOWS\PFRO.log
2015-02-26 08:41 - 2013-08-22 07:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-25 10:37 - 2012-07-26 01:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-02-24 22:31 - 2013-04-23 15:41 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-02-24 03:10 - 2015-01-12 21:55 - 00000033 _____ () C:\Users\John\AppData\Roaming\AdobeWLCMCache.dat
2015-02-21 23:08 - 2014-03-03 20:16 - 00000000 ____D () C:\Users\John
2015-02-17 22:53 - 2015-01-20 21:33 - 00001701 _____ () C:\Users\John\Desktop\Scan_Doc0027 - Shortcut.lnk
2015-02-15 16:51 - 2013-06-21 11:25 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-02-15 16:47 - 2012-11-15 17:02 - 00000000 ____D () C:\ProgramData\Temp
2015-02-13 00:39 - 2014-03-03 20:16 - 00000000 ____D () C:\Users\Meserole
2015-02-12 18:31 - 2015-01-12 16:34 - 00001068 _____ () C:\Users\John\Desktop\Dropbox.lnk
2015-02-12 18:31 - 2015-01-12 16:33 - 00000000 ____D () C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-12 13:37 - 2013-03-07 19:48 - 00133623 ____N () C:\WINDOWS\Minidump\021215-40515-01.dmp
2015-02-12 10:00 - 2015-02-01 13:21 - 00535576 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportKE64.sys
2015-02-12 10:00 - 2015-02-01 13:21 - 00290520 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportHades64.sys
2015-02-12 08:37 - 2013-08-22 09:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-02-11 15:10 - 2015-01-24 17:45 - 00000000 ____D () C:\Users\Meserole\Downloads\game
2015-02-11 08:44 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-10 17:23 - 2013-08-22 08:44 - 00708608 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-10 17:21 - 2013-09-03 21:54 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-02-10 17:14 - 2013-04-18 22:02 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-02-09 23:02 - 2014-04-28 00:59 - 00000000 ____D () C:\Program Files (x86)\QBeez 2
2015-02-09 17:00 - 2015-01-01 21:48 - 00000000 ____D () C:\Users\John\AppData\Local\gtk-2.0
2015-02-09 17:00 - 2014-12-31 17:39 - 00000000 ____D () C:\Users\John\.gimp-2.8
2015-02-05 14:38 - 2012-11-15 17:16 - 00044885 _____ () C:\WINDOWS\DirectX.log
2015-02-04 13:54 - 2014-02-24 11:24 - 00003718 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

==================== Files in the root of some directories =======

2015-01-12 21:55 - 2015-02-24 03:10 - 0000033 _____ () C:\Users\John\AppData\Roaming\AdobeWLCMCache.dat
2015-02-24 00:23 - 2015-02-24 00:55 - 0000000 _____ () C:\Users\John\AppData\Roaming\bibstats
2013-10-19 11:19 - 2013-10-19 11:19 - 0000097 _____ () C:\Users\John\AppData\Roaming\WB.CFG
2013-10-19 11:19 - 2013-10-19 11:19 - 0000006 _____ () C:\Users\John\AppData\Roaming\WBPU-TTL.DAT
2013-09-21 12:25 - 2013-09-21 14:01 - 0121333 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash
2013-09-21 12:45 - 2013-09-21 12:45 - 0004858 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921134531.gnucash
2013-09-21 12:52 - 2013-09-21 12:52 - 0004858 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921135231.gnucash
2013-09-21 12:53 - 2013-09-21 12:55 - 0537401 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921135307.log
2013-09-21 12:58 - 2013-09-21 12:58 - 0004938 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921135801.gnucash
2013-09-21 12:58 - 2013-09-21 13:39 - 0310537 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921135801.log
2013-09-21 13:39 - 2013-09-21 13:39 - 0075246 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921143907.gnucash
2013-09-21 13:39 - 2013-09-21 13:44 - 0000172 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921143907.log
2013-09-21 13:44 - 2013-09-21 13:44 - 0083433 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921144456.gnucash
2013-09-21 13:44 - 2013-09-21 13:50 - 1154483 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921144456.log
2013-09-21 13:52 - 2013-09-21 13:52 - 0083498 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921145229.gnucash
2013-09-21 13:52 - 2013-09-21 14:00 - 0409957 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921145229.log
2013-09-21 14:01 - 2013-09-21 14:01 - 0068728 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921150114.gnucash
2013-09-21 14:01 - 2013-09-21 14:07 - 0781957 _____ () C:\Users\John\AppData\Local\092013budgetgnucash.gnucash.20130921150114.log
2013-09-21 14:07 - 2013-09-21 14:13 - 0021758 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash
2013-09-21 14:07 - 2013-09-21 14:13 - 0128274 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash.20130921150744.log
2013-09-21 14:13 - 2013-09-21 14:13 - 0003307 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash.20130921151343.gnucash
2013-09-21 14:13 - 2013-09-21 14:15 - 0001523 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash.20130921151343.log
2013-09-21 14:16 - 2013-09-21 14:24 - 0001973 _____ () C:\Users\John\AppData\Local\moneymgmt092013.gnucash.20130921151616.log
2013-09-21 15:11 - 2013-09-22 16:42 - 0051563 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash
2013-09-21 15:11 - 2013-09-21 16:34 - 0278939 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921161111.log
2013-09-21 16:34 - 2013-09-21 16:34 - 0005164 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921173442.gnucash
2013-09-21 16:34 - 2013-09-21 16:40 - 0398136 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921173442.log
2013-09-21 16:40 - 2013-09-21 16:40 - 0005385 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921174009.gnucash
2013-09-21 16:40 - 2013-09-21 16:45 - 0273947 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921174009.log
2013-09-21 16:45 - 2013-09-21 16:45 - 0031669 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921174552.gnucash
2013-09-21 16:45 - 2013-09-21 16:51 - 1189664 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921174552.log
2013-09-21 16:51 - 2013-09-21 16:51 - 0038867 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921175101.gnucash
2013-09-21 16:51 - 2013-09-21 17:01 - 0186245 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921175101.log
2013-09-21 17:01 - 2013-09-21 17:01 - 0023713 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921180125.gnucash
2013-09-21 17:01 - 2013-09-21 17:04 - 0004158 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921180125.log
2013-09-21 17:07 - 2013-09-21 17:07 - 0014862 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921180752.gnucash
2013-09-21 17:07 - 2013-09-21 17:12 - 0120940 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921180752.log
2013-09-21 17:12 - 2013-09-21 17:12 - 0015866 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921181253.gnucash
2013-09-21 17:12 - 2013-09-21 17:21 - 0077228 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921181253.log
2013-09-21 17:21 - 2013-09-21 17:21 - 0033796 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921182110.gnucash
2013-09-21 17:21 - 2013-09-21 17:26 - 0100727 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921182110.log
2013-09-21 17:26 - 2013-09-21 17:26 - 0033859 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921182613.gnucash
2013-09-21 17:26 - 2013-09-21 17:31 - 0008071 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921182613.log
2013-09-21 17:31 - 2013-09-21 17:31 - 0033840 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921183130.gnucash
2013-09-21 17:31 - 2013-09-21 17:37 - 0000172 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921183130.log
2013-09-21 17:37 - 2013-09-21 17:37 - 0034169 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921183730.gnucash
2013-09-21 17:37 - 2013-09-21 17:42 - 0000172 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921183730.log
2013-09-21 17:42 - 2013-09-21 17:42 - 0034667 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921184233.gnucash
2013-09-21 17:42 - 2013-09-21 17:47 - 0109996 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921184233.log
2013-09-21 17:47 - 2013-09-21 17:47 - 0034892 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921184734.gnucash
2013-09-21 17:47 - 2013-09-21 17:51 - 0000488 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921184734.log
2013-09-21 17:53 - 2013-09-21 17:53 - 0049395 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921185310.gnucash
2013-09-21 17:53 - 2013-09-21 17:57 - 0003086 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921185310.log
2013-09-21 17:58 - 2013-09-21 17:58 - 0049602 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921185822.gnucash
2013-09-21 17:58 - 2013-09-21 18:05 - 0006794 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921185822.log
2013-09-21 18:05 - 2013-09-21 18:05 - 0050703 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921190512.gnucash
2013-09-21 18:05 - 2013-09-21 18:09 - 0002124 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921190512.log
2013-09-21 18:10 - 2013-09-21 18:10 - 0050943 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921191015.gnucash
2013-09-21 18:10 - 2013-09-21 18:15 - 0005443 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921191015.log
2013-09-21 18:15 - 2013-09-21 18:15 - 0051343 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921191540.gnucash
2013-09-21 18:15 - 2013-09-21 18:19 - 0003259 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921191540.log
2013-09-21 18:20 - 2013-09-21 18:20 - 0051423 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921192043.gnucash
2013-09-21 18:20 - 2013-09-22 16:42 - 0001478 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130921192043.log
2013-09-22 16:42 - 2013-09-22 16:42 - 0051632 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130922174246.gnucash
2013-09-22 16:42 - 2013-09-22 16:42 - 0000000 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.20130922174246.log
2013-09-21 15:11 - 2013-09-21 15:11 - 0000000 _____ () C:\Users\John\AppData\Local\moneymgmt2013.gnucash.LCK
2013-09-21 14:24 - 2013-09-21 14:40 - 0023702 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash
2013-09-21 14:24 - 2013-09-21 14:29 - 0195214 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921152429.log
2013-09-21 14:30 - 2013-09-21 14:30 - 0005074 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153015.gnucash
2013-09-21 14:30 - 2013-09-21 14:31 - 0424717 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153015.log
2013-09-21 14:31 - 2013-09-21 14:31 - 0000172 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153111.log
2013-09-21 14:32 - 2013-09-21 14:32 - 0003108 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153205.log
2013-09-21 14:32 - 2013-09-21 14:32 - 0023688 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153213.gnucash
2013-09-21 14:32 - 2013-09-21 14:33 - 0000172 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153213.log
2013-09-21 14:34 - 2013-09-21 14:35 - 0283253 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921153430.log
2013-09-21 14:40 - 2013-09-21 14:40 - 0023682 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921154029.gnucash
2013-09-21 14:40 - 2013-09-21 15:11 - 0000805 _____ () C:\Users\John\AppData\Local\ourinfo2013.gnucash.20130921154029.log
2015-02-09 16:59 - 2015-02-09 16:59 - 0022021 _____ () C:\Users\John\AppData\Local\recently-used.xbel
2013-11-19 19:02 - 2013-11-19 19:51 - 0000819 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\John\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpeenq4o.dll
C:\Users\John\AppData\Local\Temp\Quarantine.exe
C:\Users\John\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-04 17:24

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-03-2015 01
Ran by [removed] at 2015-03-06 10:58:15
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4500_G510af_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
4500G510af (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
4500G510af_Software_Min (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Active@ ISO Burner (HKLM-x32\…\{7694E0B1-2332-448B-9235-929F84B41E3F}) (Version: 2.5.1 - LSoft Technologies)
Adobe Creative Cloud (HKLM-x32\…\Adobe Creative Cloud) (Version: 2.9.0.465 - Adobe Systems Incorporated)
Adobe Digital Editions 4.0 (HKLM-x32\…\Adobe Digital Editions 4.0) (Version: 4.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Illustrator CC 2014 (HKLM-x32\…\{2B4B4082-8043-4646-8334-B0A29E641211}) (Version: 18.1.1 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\…\{BFDEF3C4-C349-AE43-4D36-8814E4A9DC87}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\…\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\…\avast) (Version: 10.0.2208 - AVAST Software)
Be a King: Golden Empire (HKLM-x32\…\BFG-Be a King - Golden Empire) (Version:  - )
Big Fish: Game Manager (HKLM-x32\…\BFGC) (Version: 3.3.0.2 - )
Brick-Force (HKLM-x32\…\Steam App 272490) (Version:  - Exe Games Inc.)
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Bus Driver (HKLM-x32\…\BFG-Bus Driver) (Version:  - )
Business-in-a-Box (HKLM-x32\…\Business-in-a-Box) (Version: 5.1.1 - Biztree Inc.)
Clone Wars (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\SOE-Clone Wars) (Version:  - Sony Online Entertainment)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1.5510 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.1.1916 - CyberLink Corp.)
CyberLink PhotoDirector (HKLM-x32\…\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.1.3109 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.1.1902 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.1.1925 - CyberLink Corp.)
CyberLink PowerDVD (HKLM-x32\…\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.1.4319 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DC Universe Online (HKLM-x32\…\Steam App 24200) (Version:  - Sony Online Entertainment)
Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
Dropbox (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\…\ESET Online Scanner) (Version:  - )
Fax (x32 Version: 140.0.307.000 - Hewlett-Packard) Hidden
Free Realms (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\SOE-Free Realms) (Version:  - Sony Online Entertainment)
GIMP 2.8.14 (HKLM\…\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GnuCash 2.4.13 (HKLM-x32\…\GnuCash_is1) (Version:  - GnuCash Development Team)
Hewlett-Packard ACLM.NET v1.2.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Imaging Device Functions 14.0 (HKLM\…\HP Imaging Device Functions) (Version: 14.0 - HP)
HP MyRoom (HKLM-x32\…\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
HP Officejet 4500 G510a-f 14.0 Rel. 6 (HKLM\…\{A49C5804-8F24-433C-99B2-9F9F541090C7}) (Version: 14.0 - HP)
HP Registration Service (HKLM\…\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Update (HKLM-x32\…\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6418.0 - IDT)
Inkscape 0.48.5 (HKLM-x32\…\Inkscape) (Version: 0.48.5 - )
Java 7 Update 67 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
KidsRuby 1.4.0 (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\{613C3EA5-1248-4E35-B61A-6D0B31BBC0DB}_is1) (Version: 1.4.0 - KidsRuby Team)
King Arthur (HKLM-x32\…\BFG-King Arthur) (Version:  - )
King Mania (HKLM-x32\…\BFG-King Mania) (Version:  - )
King's Smith 2 (HKLM-x32\…\BFG-King's Smith 2) (Version:  - )
Kingsoft Office 2013 (9.1.0.4246) (HKLM-x32\…\Kingsoft Office) (Version: 9.1.0.4246 - Kingsoft Corp.)
Kodu Game Lab (HKLM-x32\…\{C27FE0CD-51B3-4D2B-A0BD-EF87561429CB}) (Version: 1.0.94 - Microsoft Research)
LEGO Minifigures Online (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\423b93224c69643b) (Version: 1.0.0.0 - Funcom)
LG VZW United Drivers (HKLM-x32\…\{FF712194-6643-4E4D-A340-2D447A644F75}) (Version: 2.16.1 - LG Electronics)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
ManyCam 4.0.77 (HKLM-x32\…\ManyCam) (Version: 4.0.77 - Visicom Media Inc.)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4693.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\…\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\…\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\…\{95140000-0137-0409-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\…\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 36.0.1 (x86 en-US)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.5.0 (x86 en-US) (HKLM-x32\…\Mozilla Thunderbird 31.5.0 (x86 en-US)) (Version: 31.5.0 - Mozilla)
OCR Software by I.R.I.S. 14.0 (HKLM\…\HPOCR) (Version: 14.0 - HP)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Outta This Kingdom (HKLM-x32\…\BFG-Outta This Kingdom) (Version:  - )
Plantasia (HKLM-x32\…\BFG-Plantasia) (Version:  - )
Q10 Editor (HKLM-x32\…\Q10) (Version:  - )
QBeez 2 (HKLM-x32\…\BFG-QBeez 2) (Version:  - )
QuickTime 7 (HKLM-x32\…\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Ralink RT5390R 802.11bgn Wi-Fi Adapter (HKLM-x32\…\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.0.0 - Ralink)
Rapport (x32 Version: 3.5.1404.75 - Trusteer) Hidden
Recovery Manager (x32 Version: 5.5.0.5530 - CyberLink Corp.) Hidden
ROBLOX Player for John Meserole (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - ROBLOX Corporation)
ROBLOX Studio for John Meserole (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version:  - ROBLOX Corporation)
Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
SeaMonkey 2.29.1 (x86 en-US) (HKLM-x32\…\SeaMonkey 2.29.1 (x86 en-US)) (Version: 2.29.1 - Mozilla)
Secure Download Manager (HKLM-x32\…\{E040B65B-8683-4228-8C33-D44A141E40EA}) (Version: 3.1.60 - Kivuto Solutions Inc.)
Skype Click to Call (HKLM-x32\…\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Star Wars The Old Republic (HKLM-x32\…\swtor_swtor) (Version: 7.0.0.41 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\…\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden
Steam (HKLM-x32\…\Steam) (Version: 2.10.91.91 - Valve Corporation)
Stencyl (HKLM-x32\…\Stencyl) (Version: 1.1.1 - Stencyl, LLC)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Team Fortress 2 (HKLM-x32\…\Steam App 440) (Version:  - Valve)
Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
Trusteer Endpoint Protection (HKLM-x32\…\Rapport_msi) (Version: 3.5.1404.75 - Trusteer)
Turbo Fiesta (HKLM-x32\…\BFG-Turbo Fiesta) (Version:  - )
Turbo Pizza (HKLM-x32\…\BFG-Turbo Pizza) (Version:  - )
Turbo Subs (HKLM-x32\…\BFG-Turbo Subs) (Version:  - )
Unity Web Player (HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\UnityWebPlayer) (Version: 2.6.1f3_31223 - Unity Technologies ApS)
Viking Saga (HKLM-x32\…\BFG-Viking Saga) (Version:  - )
Visual Studio 2010 x64 Redistributables (HKLM\…\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Warface Launcher (Beta) (HKLM-x32\…\{28D1723C-31C4-4A83-9799-DFFB3739026D}) (Version: 1.0.0 - Crytek GmbH)
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Westward Kingdoms (HKLM-x32\…\BFG-Westward Kingdoms) (Version:  - )
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Wondershare PDF to PowerPoint (Build 4.0.1) (HKLM-x32\…\{25EB79AD-5D32-491C-9179-E12D79159550}_is1) (Version: 4.0.1 - Wondershare Software)
Zuma Deluxe (HKLM-x32\…\BFG-Zuma Deluxe) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\InprocServer32 -> C:\Users\John\AppData\Local\Roblox\Versions\version-5d9b22aa9d594ee1\RobloxProxy64.dll (ROBLOX Corporation)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2574247163-3884555990-3468575119-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\John\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points  =========================

17-02-2015 17:37:01 Scheduled Checkpoint
25-02-2015 10:36:08 Windows Update
04-03-2015 17:58:33 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 07:25 - 2013-08-22 07:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {20B7C1FD-CC35-4C36-9D5A-EE9DAA245929} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\SymErr.exe
Task: {2CAD9CA4-804E-470A-9B6F-2454E20DF8EF} - System32\Tasks\WpsUpdateTask_Meserole => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe [2014-08-05] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {3208F307-8FEC-4DEF-AD17-796454528E53} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Critical Actions Pending => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {36FC69EB-50CE-45C6-84E6-03F9827DFCD6} - System32\Tasks\WpsUpdateTask_John => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe [2014-08-05] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {37513931-B94D-4D45-A0F4-9CDF5B31796D} - System32\Tasks\{0CF3FF2C-686E-417C-AECB-9D04A9FB9D6A} => pcalua.exe -a C:\Users\John\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveSetup.exe -c  /uninstall
Task: {3C265DC1-1041-4C93-8E9A-B9EC26ED3482} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {46020F0D-68A7-4D20-BCA0-8484CEC94391} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-12-30] (Microsoft Corporation)
Task: {54A84B86-6B80-45BC-BDAD-53246DB1F979} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {5935EA37-05D7-4935-A45D-3E789844FF1C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {6D26CB25-861E-4654-9E53-7BF596BE73FA} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\SymErr.exe
Task: {886CE928-4871-4127-8DA4-1EDEAD902A5F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-30] (AVAST Software)
Task: {8AC11914-B6F9-47D3-ADBB-FC77FF025BDB} - System32\Tasks\AdobeAAMUpdater-1.0-familypc-John Meserole => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-09-19] (Adobe Systems Incorporated)
Task: {8E5F426D-DCA9-4D85-AB8C-510F37CD0659} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {98BA706A-8A9F-4E32-AA5C-8B64C5652D3C} - System32\Tasks\WpsUpdateTask_John Meserole => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe [2014-08-05] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {ABF932EB-AA3E-4C32-A129-C1261C3BEDE8} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-12-30] (Microsoft Corporation)
Task: {AC3BD736-1940-436F-9B6E-77DE4EC321AC} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-01-13] (Microsoft Corporation)
Task: {C5D2CA13-44B4-417E-BDD6-41FF4FB1B88A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\WSCStub.exe
Task: {C8789B5A-6B1B-408D-8D27-69FDB6D4DD4E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\WpsUpdateTask_John Meserole.job => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe
Task: C:\WINDOWS\Tasks\WpsUpdateTask_John.job => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe
Task: C:\WINDOWS\Tasks\WpsUpdateTask_Meserole.job => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-01-30 08:07 - 2015-01-30 08:07 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2015-01-30 08:07 - 2015-01-30 08:07 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2014-03-20 15:20 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-12-19 15:57 - 2014-12-19 15:57 - 01039008 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2015-02-24 22:29 - 2014-12-23 13:53 - 08898728 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-02-24 00:22 - 2014-10-16 15:40 - 03950440 _____ () C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe
2014-12-19 15:57 - 2014-12-19 15:57 - 05979808 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2012-05-04 18:42 - 2012-05-04 18:42 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2015-02-25 15:26 - 2015-02-25 15:26 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15022503\algo.dll
2015-01-30 08:07 - 2015-01-30 08:07 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-03-06 08:41 - 2015-03-06 08:41 - 02918400 _____ () C:\Program Files\AVAST Software\Avast\defs\15030600\algo.dll
2014-03-23 16:04 - 2014-03-23 16:04 - 00557056 _____ () C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll
2012-11-15 17:07 - 2012-06-07 21:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 13:34 - 2012-06-08 13:34 - 00016400 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-01-30 08:07 - 2015-01-30 08:07 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 36730032 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libcef.dll
2015-02-10 15:00 - 2015-02-10 15:00 - 00750080 _____ () C:\Users\John\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-06 07:40 - 2015-03-06 07:40 - 00043008 _____ () c:\users\john\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpeenq4o.dll
2015-02-10 15:00 - 2015-02-10 15:00 - 00047616 _____ () C:\Users\John\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-02-10 15:00 - 2015-02-10 15:00 - 00865280 _____ () C:\Users\John\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-02-10 15:00 - 2015-02-10 15:00 - 00200704 _____ () C:\Users\John\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 00746160 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libglesv2.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 00136368 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libegl.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
AlternateDataStreams: C:\ProgramData\Temp:A1D3FEF0
AlternateDataStreams: C:\ProgramData\Temp:DA9A88B3
AlternateDataStreams: C:\Users\John\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\John\Desktop\flickr-8263996505-original.jpg
DNS Servers: 192.168.254.254

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\…\StartupApproved\Run32: => "QuickTime Task"
HKLM\…\StartupApproved\Run32: => "APSDaemon"
HKLM\…\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\…\StartupApproved\Run32: => "Adobe ARM"
HKLM\…\StartupApproved\Run32: => "HP Software Update"
HKLM\…\StartupApproved\Run32: => "mobilegeni daemon"
HKLM\…\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\StartupApproved\StartupFolder: => "Send to OneNote.lnk"
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\StartupApproved\Run: => "OutfoxTV"
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-2574247163-3884555990-3468575119-1001\…\StartupApproved\Run: => "ManyCam"

==================== Accounts: =============================

Administrator (S-1-5-21-2574247163-3884555990-3468575119-500 - Administrator - Disabled)
Guest (S-1-5-21-2574247163-3884555990-3468575119-501 - Limited - Disabled) => C:\Users\Guest
John Meserole (S-1-5-21-2574247163-3884555990-3468575119-1001 - Administrator - Enabled) => C:\Users\John
Meserole (S-1-5-21-2574247163-3884555990-3468575119-1031 - Limited - Enabled) => C:\Users\Meserole
safekids (S-1-5-21-2574247163-3884555990-3468575119-1004 - Limited - Enabled) => C:\Users\safekids

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/05/2015 09:14:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/05/2015 07:58:57 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (03/04/2015 07:58:59 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (03/04/2015 06:14:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/04/2015 06:08:10 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/04/2015 05:35:00 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/04/2015 05:28:06 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/04/2015 07:27:56 AM) (Source: Desktop Window Manager) (EventID: 9020) (User: )
Description: The Desktop Window Manager has encountered a fatal error (0x8898008d)

Error: (03/03/2015 07:58:54 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (03/03/2015 09:14:35 AM) (Source: Desktop Window Manager) (EventID: 9020) (User: )
Description: The Desktop Window Manager has encountered a fatal error (0x8898008d)


System errors:
=============
Error: (03/06/2015 09:39:50 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (03/06/2015 09:39:20 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (03/06/2015 09:28:18 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (03/06/2015 09:27:47 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (03/06/2015 09:01:16 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (03/06/2015 09:00:46 AM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (03/05/2015 09:12:47 PM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (03/05/2015 09:12:17 PM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (03/05/2015 08:30:52 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 70. The Windows SChannel error state is 105.

Error: (03/05/2015 07:17:20 PM) (Source: DCOM) (EventID: 10010) (User: familypc)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}


Microsoft Office Sessions:
=========================
Error: (03/05/2015 09:14:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/05/2015 07:58:57 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (03/04/2015 07:58:59 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (03/04/2015 06:14:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/04/2015 06:08:10 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/04/2015 05:35:00 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/04/2015 05:28:06 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/04/2015 07:27:56 AM) (Source: Desktop Window Manager) (EventID: 9020) (User: )
Description: 0x8898008d

Error: (03/03/2015 07:58:54 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (03/03/2015 09:14:35 AM) (Source: Desktop Window Manager) (EventID: 9020) (User: )
Description: 0x8898008d


CodeIntegrity Errors:
===================================
  Date: 2015-01-30 10:47:11.193
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:10.896
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:10.583
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:10.318
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:09.990
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:09.615
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:09.318
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:09.068
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:08.661
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-30 10:47:08.349
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: AMD A6-5400K APU with Radeon™ HD Graphics
Percentage of memory in use: 31%
Total physical RAM: 5527.29 MB
Available physical RAM: 3768.54 MB
Total Pagefile: 6710.52 MB
Available Pagefile: 4071.77 MB
Total Virtual: 131072 MB
Available Virtual: 131071.85 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:918.97 GB) (Free:736.2 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:10.73 GB) (Free:1.26 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (My Book) (Fixed) (Total:298.02 GB) (Free:107.55 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: CC03408F)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 298.1 GB) (Disk ID: 44FDFE06)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=0C)

==================== End Of Log ============================

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3/5/2015
Scan Time: 5:35:27 PM
Logfile: mbam 030515.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.03.05.03
Rootkit Database: v2015.02.25.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: John Meserole

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 493423
Time Elapsed: 32 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.DownloadAdmin, C:\Users\Meserole\Downloads\Minecraft.exe, No Action By User, [6b7ca0a139513bfb8d19c395a45cc33d],

Physical Sectors: 0
(No malicious items detected)


(end)

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 8.1 x64
Ran by [removed] on Sat 03/07/2015 at 14:58:52.50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\John\appdata\local\{23414FB3-8F9C-4428-B4C8-457E0C319F8B}



~~~ FireFox

Successfully deleted the following from C:\Users\John\AppData\Roaming\mozilla\firefox\profiles\7ypogjw1.default-1392514649814\prefs.js

user_pref("extensions.wisestamp_web.ss", "{\"signatures\":{\"6702380651380736\":{\"wisestamp_uid_md5\":\"8bcc10dba66b4b87d719f2aea7d50563\",\"html\":\"




~~~ Event Viewer Logs were cleared



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 03/07/2015 at 15:07:57.67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI