Spyware / Malware / Virus Removal

Infected...Again! [Solved]

11 min read

Looking for the outcome? Ask AI

Lytnup Topic Starter

Post #1February 14, 2015, 12:19 AM UTC

Once again I find myself turning to you. In the past you have been wonderful.

My computer is running so slow. It is taking minutes to open programs and startup is painful.

Here is the log:

Run date: 2015-02-13 06:57:25

—————————–

06:57:25.106 OS Version: Windows x64 6.1.7601 Service Pack 1

06:57:25.106 Number of processors: 2 586 0x602

06:57:25.107 ComputerName: CHUCK-PC UserName: Chuck

06:57:27.175 Initialize success

06:57:27.378 VM: initialized successfully

06:57:27.380 VM: Amd CPU supported

06:58:21.688 AVAST engine defs: 15021201

06:59:24.840 The log file has been saved successfully to "C:\Users\Chuck\Desktop\WhatThe Tech\aswMBR.txt"

Run date: 2015-02-13 06:57:25

—————————–

06:57:25.106 OS Version: Windows x64 6.1.7601 Service Pack 1

06:57:25.106 Number of processors: 2 586 0x602

06:57:25.107 ComputerName: CHUCK-PC UserName: Chuck

06:57:27.175 Initialize success

06:57:27.378 VM: initialized successfully

06:57:27.380 VM: Amd CPU supported

06:58:21.688 AVAST engine defs: 15021201

06:59:24.840 The log file has been saved successfully to "C:\Users\Chuck\Desktop\WhatThe Tech\aswMBR.txt"

06:59:31.758 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000062

06:59:31.765 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 3

06:59:31.959 Disk 0 MBR read successfully

06:59:31.966 Disk 0 MBR scan

06:59:32.052 Disk 0 Windows 7 default MBR code

06:59:32.076 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

06:59:32.086 Disk 0 default boot code

06:59:32.110 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 305143 MB offset 206848

06:59:32.158 Disk 0 scanning C:\Windows\system32\drivers

06:59:50.161 Service scanning

07:00:42.891 Modules scanning

07:00:42.894 Disk 0 trace - called modules:

07:00:42.918 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor.sys

07:00:42.919 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8002536060]

07:00:42.920 3 CLASSPNP.SYS[fffff8800192c43f] -> nt!IofCallDriver -> [0xfffffa8002152c20]

07:00:42.921 5 ACPI.sys[fffff88000ed77a1] -> nt!IofCallDriver -> \Device\00000062[0xfffffa80021669c0]

07:00:44.704 AVAST engine scan C:\Windows

07:00:48.359 AVAST engine scan C:\Windows\system32

07:05:39.346 AVAST engine scan C:\Windows\system32\drivers

07:05:56.643 AVAST engine scan C:\Users\Chuck

07:18:04.041 File: C:\Users\Chuck\Downloads\Player-Chrome (1).exe **INFECTED** Win32:Adware-gen [Adw]

07:18:05.462 File: C:\Users\Chuck\Downloads\Player-Chrome.exe **INFECTED** Win32:Adware-gen [Adw]

07:18:41.665 AVAST engine scan C:\ProgramData

07:23:50.709 File: C:\ProgramData\InstallMate\{F47B09DE-7C0C-47F6-A51D-342E2F982B28}\_Setupx.dll **INFECTED** Win32:Dropper-gen [Drp]

07:29:50.229 Disk 0 statistics 5662949/0/0 @ 2.21 MB/s

07:29:50.276 Scan finished successfully

19:12:20.478 Disk 0 MBR has been saved successfully to "C:\Users\Chuck\Desktop\WhatThe Tech\MBR.dat"

19:12:20.502 The log file has been saved successfully to "C:\Users\Chuck\Desktop\WhatThe Tech\aswMBR.txt"

Let me know what I need to do next.

Thanks in advance,

Lytnup

Attachments:

📎aswMBR.txt

ken545

Post #2February 14, 2015, 1:08 AM UTC

Yep, you have a some infected files, lets do this

Please download Farbar Recovery Scan Tool and save it to your DESKTOP

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

A simple way to check your system: Start –> Computer (right click) –> Properties

[external image: FRST_zps5d956a1a.jpg]

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

Please make sure All Users is checked

Just keep the defaults as in the picture checkmarked

Press Scan button.

It will produce a log called FRST.txt in the same directory the tool is run from.

Please copy and paste log back here.

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Lytnup

Post #3February 16, 2015, 3:30 PM UTC

[attachment removed][attachment removed][attachment removed]
Ken,

Thanks for taking this on. Here are the files you requested.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2015

Ran by [removed] (administrator) on CHUCK-PC on 13-02-2015 22:06:24

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgfws.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe

() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

(SpeedBit Ltd.) C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAcceleratorService.exe

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

(PC Drivers Headquarters) C:\Program Files (x86)\Driver Support\Driver Support\DriverSupport.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe

(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe

(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

() C:\Users\Chuck\AppData\Roaming\Mozilla\Firefox\Profiles\48gssio6.default\hotfix-update\FirefoxInstallLauncher.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\prevhost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\Chuck\Downloads\FRST64 (1).exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2327952 2010-07-21] (Microsoft Corporation)

HKLM\…\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-11-29] (LogMeIn, Inc.)

HKLM-x32\…\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)

HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)

HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)

HKLM-x32\…\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3674576 2015-01-06] (AVG Technologies CZ, s.r.o.)

HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\…\Run: [vProt] => C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe [2404376 2013-10-02] ()

HKLM-x32\…\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295072 2013-02-03] (RealNetworks, Inc.)

HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)

HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)

HKLM-x32\…\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Run: [Facebook Update] => C:\Users\Chuck\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.)

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.)

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Run: [Driver Support] => C:\Program Files (x86)\Driver Support\Driver Support\DriverSupport.exe [4785504 2014-11-01] (PC Drivers Headquarters)

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.)

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\RunOnce: [Adobe Speed Launcher] => 1423815876

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk

ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)

Startup: C:\Users\Chuck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk

ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a;=file_14_19_ch&cd;=2XzuyEtN2Y1L1QzutDtDtAtDyCyBtBtC0CtAtDzztByC0A0EtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0A0A0ByByEyCyBtGtBtCtA0DtGyC0B0FyDtGzzyD0AzztGtDzyzztC0D0EtAyDzz0Fzyzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAzzyEyDyB0EyBtGzyyEyEzytG0D0CtDyEtGtDyD0B0CtGyDyCyD0CyCtDyB0CzztB0FyE2Q&cr;=1546132443&ir;=

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a;=file_14_19_ch&cd;=2XzuyEtN2Y1L1QzutDtDtAtDyCyBtBtC0CtAtDzztByC0A0EtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0A0A0ByByEyCyBtGtBtCtA0DtGyC0B0FyDtGzzyD0AzztGtDzyzztC0D0EtAyDzz0Fzyzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAzzyEyDyB0EyBtGzyyEyEzytG0D0CtDyEtGtDyD0B0CtGyDyCyD0CyCtDyB0CzztB0FyE2Q&cr;=1546132443&ir;=

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=msnhome

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a;=file_14_19_ch&cd;=2XzuyEtN2Y1L1QzutDtDtAtDyCyBtBtC0CtAtDzztByC0A0EtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0A0A0ByByEyCyBtGtBtCtA0DtGyC0B0FyDtGzzyD0AzztGtDzyzztC0D0EtAyDzz0Fzyzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAzzyEyDyB0EyBtGzyyEyEzytG0D0CtDyEtGtDyD0B0CtGyDyCyD0CyCtDyB0CzztB0FyE2Q&cr;=1546132443&ir;=

URLSearchHook: HKLM-x32 - Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\tbZyng.dll No File

URLSearchHook: HKU\S-1-5-21-2109932682-201200126-2622220936-1000 - Default Value = {CFBFAE00-17A6-11D0-99CB-00C04FD64497}

URLSearchHook: HKU\S-1-5-21-2109932682-201200126-2622220936-1000 - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q;={searchTerms}&a;=file_14_19_ch&cd;=2XzuyEtN2Y1L1QzutDtDtAtDyCyBtBtC0CtAtDzztByC0A0EtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0A0A0ByByEyCyBtGtBtCtA0DtGyC0B0FyDtGzzyD0AzztGtDzyzztC0D0EtAyDzz0Fzyzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAzzyEyDyB0EyBtGzyyEyEzytG0D0CtDyEtGtDyD0B0CtGyDyCyD0CyCtDyB0CzztB0FyE2Q&cr;=1546132443&ir;=

SearchScopes: HKLM-x32 -> DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource;=4&ctid;=CT2438727

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource;=4&ctid;=CT2438727

SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.soft-quick.info/?l=1&q;={searchTerms}

SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} URL =

SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =

SearchScopes: HKU\S-1-5-21-2109932682-201200126-2622220936-1000 -> DefaultScope {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =

SearchScopes: HKU\S-1-5-21-2109932682-201200126-2622220936-1000 -> {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?p={searchTerms}&fr;=chr-tyc8

BHO-x32: &Yahoo;! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)

BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: No Name -> {1036AD63-AEAC-460B-9060-C96005D4DC86} -> No File

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Zynga Toolbar -> {7b13ec3e-999a-4b70-b9cb-2617b8323822} -> C:\Program Files (x86)\Zynga\tbZyng.dll No File

BHO-x32: AVG SafeGuard toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG SafeGuard toolbar\17.0.1.12\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)

BHO-x32: Arcadesafari BHO -> {adff4c9a-4f49-4a1f-8885-360e107b7938} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)

BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)

Toolbar: HKLM-x32 - Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\tbZyng.dll No File

Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File

Toolbar: HKLM-x32 - No Name - {C80BDEB2-8735-44C6-BD55-A1CCD555667A} - No File

Toolbar: HKLM-x32 - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\17.0.1.12\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)

DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: HKLM-x32 {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll

DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)

Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\syswow64\urlmon.dll (Microsoft Corporation)

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\17.0.12\ViProtocol.dll No File

Winsock: Catalog9 01 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Winsock: Catalog9 02 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Winsock: Catalog9 03 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Winsock: Catalog9 04 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Winsock: Catalog9 05 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Winsock: Catalog9 06 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Winsock: Catalog9 07 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Winsock: Catalog9 08 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Winsock: Catalog9 19 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136] (SpeedBit)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 [removed]

FireFox:

========

FF ProfilePath: C:\Users\Chuck\AppData\Roaming\Mozilla\Firefox\Profiles\48gssio6.default

FF Homepage: hxxp://start.mysearchdial.com/?f=1&a;=file_14_19_ch&cd;=2XzuyEtN2Y1L1QzutDtDtAtDyCyBtBtC0CtAtDzztByC0A0EtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0A0A0ByByEyCyBtGtBtCtA0DtGyC0B0FyDtGzzyD0AzztGtDzyzztC0D0EtAyDzz0Fzyzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAzzyEyDyB0EyBtGzyyEyEzytG0D0CtDyEtGtDyD0B0CtGyDyCyD0CyCtDyB0CzztB0FyE2Q&cr;=1546132443&ir;=

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.0.12\\npsitesafety.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.10.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2109932682-201200126-2622220936-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Chuck\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKU\S-1-5-21-2109932682-201200126-2622220936-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Chuck\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF user.js: detected! => C:\Users\Chuck\AppData\Roaming\Mozilla\Firefox\Profiles\48gssio6.default\user.js

FF SearchPlugin: C:\Users\Chuck\AppData\Roaming\Mozilla\Firefox\Profiles\48gssio6.default\searchplugins\Mysearchdial.xml

FF Extension: Arcadesafari - C:\Users\Chuck\AppData\Roaming\Mozilla\Firefox\Profiles\48gssio6.default\Extensions\[removed] [2014-03-13]

FF Extension: MySearchDial NewTab - C:\Users\Chuck\AppData\Roaming\Mozilla\Firefox\Profiles\48gssio6.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8} [2014-08-25]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-01-15]

FF HKLM-x32\…\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\17.0.1.12

FF Extension: AVG SafeGuard toolbar - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\17.0.1.12 [2013-10-02]

FF HKLM-x32\…\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-02-03]

FF HKLM-x32\…\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Firefox\Extensions: [[removed]] - C:\Users\Chuck\AppData\Local\ArcadeCandy\[removed]

FF HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Firefox\Extensions: [[removed]] - C:\Users\Chuck\AppData\Local\Arcadesafari\[removed]

FF HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome:

=======

CHR HomePage: Default -> hxxp://search.babylon.com/?AF=114022&babsrc;=HP_ss&mntrId;=a0aa26ae00000000000000306721c308

CHR StartupUrls: Default -> "hxxp://www.google.com", "hxxp://start.mysearchdial.com/?f=1&a;=aw0202ch&cd;=2XzuyEtN2Y1L1Qzu0B0CtAtDyD0B0AyDyD0C0C0AtA0ByDzztN0D0Tzu0SyBzztDtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr;=1082793769&ir;=", "hxxp://start.mysearchdial.com/?f=1&a;=dnldstr_14_11_ch&cd;=2XzuyEtN2Y1L1QzutDtDtAtDyCyBtBtC0CtAtDzztByC0A0EtN0D0Tzu0SzztDtCtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V0WtN1L1G1B1V1N2Y1L1Qzu2SyDtC0BtCtA0CtAtCtG0EtBtByBtGzztAyE0EtG0D0A0C0BtGyDyD0B0D0A0BzyyBtAtA0EyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAzzyEyDyB0EyBtGzyyEyEzytG0D0CtDyEtGtDyD0B0CtGyDyCyD0CyCtDyB0CzztB0FyE2Q&cr;=1015790282&ir;=", "hxxp://start.mysearchdial.com/?f=1&a;=file_14_19_ch&cd;=2XzuyEtN2Y1L1QzutDtDtAtDyCyBtBtC0CtAtDzztByC0A0EtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0A0A0ByByEyCyBtGtBtCtA0DtGyC0B0FyDtGzzyD0AzztGtDzyzztC0D0EtAyDzz0Fzyzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAzzyEyDyB0EyBtGzyyEyEzytG0D0CtDyEtGtDyD0B0CtGyDyCyD0CyCtDyB0CzztB0FyE2Q&cr;=1546132443&ir;="

CHR Profile: C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]

CHR Extension: (Adblock Plus) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-14]

CHR Extension: (Privacy SafeGuard) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\geggofhlfbcmanadhknllmlajiafopoh [2013-12-10]

CHR Extension: (RealDownloader) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-03-31]

CHR Extension: (Google Wallet) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Plus-HD-2.3) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec [2013-12-22]

CHR Extension: (MapsGalaxy) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\phofnlkipcbffclfgpdhceelbfjjaage [2014-12-13]

CHR HKLM\…\Chrome\Extension: [geggofhlfbcmanadhknllmlajiafopoh] - C:\Program Files\PrivacySafeGuard\pschrome_bunndle-c1_1_0.crx [2012-04-30]

CHR HKLM\…\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - No Path

CHR HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - No Path

CHR HKLM-x32\…\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path

CHR HKLM-x32\…\Chrome\Extension: [daoincddhgnedmchclkdggndobibobhm] - C:\ProgramData\TheBflix\daoincddhgnedmchclkdggndobibobhm.crx [Not Found]

CHR HKLM-x32\…\Chrome\Extension: [geggofhlfbcmanadhknllmlajiafopoh] - C:\Program Files\PrivacySafeGuard\pschrome_bunndle-c1_1_0.crx [2012-04-30]

CHR HKLM-x32\…\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]

CHR HKLM-x32\…\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG SafeGuard toolbar\ChromeExt\17.0.1.12\avg.crx [2013-10-02]

CHR HKLM-x32\…\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Users\Chuck\AppData\Local\Temp\YontooLayers.crx [Not Found]

CHR HKLM-x32\…\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgfws; C:\Program Files (x86)\AVG\AVG2015\avgfws.exe [1507632 2015-01-06] (AVG Technologies CZ, s.r.o.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3440080 2015-01-06] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-01-06] (AVG Technologies CZ, s.r.o.)

R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [File not signed]

R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [377704 2015-01-13] (LogMeIn, Inc.)

R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2015-01-13] (LogMeIn, Inc.)

R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)

S2 MsMpSvc; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [12784 2010-11-11] (Microsoft Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]

S3 NisSrv; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [282616 2010-11-11] (Microsoft Corporation)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()

R2 VideoAcceleratorService; C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAcceleratorService.exe [265928 2013-02-03] (SpeedBit Ltd.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S2 vToolbarUpdater17.0.12; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2013-10-02] (AVG Technologies)

R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-06-01] (LogMeIn, Inc.)

S4 LMIRfsClientNP; No ImagePath

R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [188928 2010-10-24] (Microsoft Corporation)

S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [72064 2010-10-24] (Microsoft Corporation)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation)

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

U3 aswMBR; \??\C:\Users\Chuck\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Chuck\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-13 21:08 - 2015-02-13 21:09 - 00039078 _____ () C:\Users\Chuck\Downloads\Addition.txt

2015-02-13 21:05 - 2015-02-13 22:06 - 00030229 _____ () C:\Users\Chuck\Downloads\FRST.txt

2015-02-13 21:04 - 2015-02-13 22:06 - 00000000 ____D () C:\FRST

2015-02-13 21:04 - 2015-02-13 21:04 - 02134016 _____ (Farbar) C:\Users\Chuck\Downloads\FRST64 (1).exe

2015-02-13 19:41 - 2015-02-13 19:42 - 00243440 _____ () C:\Users\Chuck\Downloads\Firefox Setup Stub 35.0.1.exe

2015-02-13 19:14 - 2015-02-13 19:14 - 02129920 _____ (Farbar) C:\Users\Chuck\Downloads\FRST64.exe

2015-02-13 06:56 - 2015-02-13 06:57 - 05198336 _____ (AVAST Software) C:\Users\Chuck\Downloads\aswMBR (5).exe

2015-02-13 03:31 - 2015-02-13 03:31 - 00003340 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2109932682-201200126-2622220936-1000

2015-02-13 03:31 - 2015-02-13 03:31 - 00003206 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2109932682-201200126-2622220936-1000

2015-02-12 22:48 - 2015-01-22 23:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-02-12 22:48 - 2015-01-22 23:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-02-12 22:48 - 2015-01-22 22:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-02-12 22:48 - 2015-01-22 22:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-02-12 21:41 - 2015-02-12 21:41 - 05198336 _____ (AVAST Software) C:\Users\Chuck\Downloads\aswMBR.exe

2015-02-12 21:40 - 2015-02-13 21:03 - 00000000 ____D () C:\Users\Chuck\Desktop\WhatThe Tech

2015-02-11 06:50 - 2014-11-25 22:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2015-02-11 06:50 - 2014-11-25 22:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2015-02-11 06:49 - 2015-02-03 22:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-02-11 06:49 - 2015-02-03 22:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-02-11 06:49 - 2015-02-03 22:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-02-11 06:49 - 2015-02-03 22:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-02-11 06:49 - 2015-02-03 22:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-02-11 06:49 - 2015-02-03 22:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2015-02-11 06:49 - 2015-02-03 22:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-02-11 06:49 - 2015-01-27 18:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2015-02-11 06:49 - 2015-01-10 01:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-02-11 06:49 - 2015-01-10 01:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-02-11 06:49 - 2015-01-10 01:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-02-11 06:49 - 2015-01-10 01:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-02-11 06:49 - 2015-01-10 01:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-02-11 06:49 - 2015-01-10 01:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-02-11 06:49 - 2015-01-10 01:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-02-11 06:49 - 2015-01-10 01:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-02-11 06:49 - 2015-01-10 01:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-02-11 06:49 - 2015-01-10 01:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-02-11 06:49 - 2015-01-10 01:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-02-11 06:49 - 2015-01-10 01:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-02-11 06:49 - 2015-01-10 01:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-02-11 06:49 - 2015-01-10 01:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-02-11 06:48 - 2015-01-14 00:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-02-11 06:48 - 2015-01-14 00:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-02-11 06:48 - 2015-01-11 22:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-02-11 06:48 - 2015-01-11 22:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-02-11 06:48 - 2015-01-11 22:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-02-11 06:48 - 2015-01-11 21:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-02-11 06:48 - 2015-01-11 21:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-02-11 06:48 - 2015-01-11 21:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-02-11 06:48 - 2015-01-11 21:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-02-11 06:48 - 2015-01-11 21:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-02-11 06:48 - 2015-01-11 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-02-11 06:48 - 2015-01-11 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-02-11 06:48 - 2015-01-11 21:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-02-11 06:48 - 2015-01-11 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-02-11 06:48 - 2015-01-11 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-02-11 06:48 - 2015-01-11 21:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-02-11 06:48 - 2015-01-11 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-02-11 06:48 - 2015-01-11 21:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-02-11 06:48 - 2015-01-11 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-02-11 06:48 - 2015-01-11 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-02-11 06:48 - 2015-01-11 21:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-02-11 06:48 - 2015-01-11 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-02-11 06:48 - 2015-01-11 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-02-11 06:48 - 2015-01-11 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-02-11 06:48 - 2015-01-11 21:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-02-11 06:48 - 2015-01-11 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-02-11 06:48 - 2015-01-11 21:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-02-11 06:48 - 2015-01-11 21:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-02-11 06:48 - 2015-01-11 21:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-02-11 06:48 - 2015-01-11 20:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-02-11 06:48 - 2015-01-11 20:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-02-11 06:48 - 2015-01-11 20:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-02-11 06:48 - 2015-01-11 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-02-11 06:48 - 2015-01-11 20:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-02-11 06:48 - 2015-01-11 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-02-11 06:48 - 2015-01-11 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-02-11 06:48 - 2015-01-11 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-02-11 06:48 - 2015-01-11 20:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-02-11 06:48 - 2015-01-11 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-02-11 06:48 - 2015-01-11 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-02-11 06:48 - 2015-01-11 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-02-11 06:48 - 2015-01-11 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-02-11 06:48 - 2015-01-11 20:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-02-11 06:48 - 2015-01-11 20:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-02-11 06:48 - 2015-01-11 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-02-11 06:48 - 2015-01-11 20:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-02-11 06:48 - 2015-01-11 20:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-02-11 06:48 - 2015-01-11 20:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-02-11 06:48 - 2015-01-11 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-02-11 06:48 - 2015-01-11 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-02-11 06:48 - 2015-01-11 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-02-11 06:48 - 2015-01-11 19:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-02-11 06:47 - 2015-01-15 03:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-02-11 06:47 - 2015-01-15 03:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-02-11 06:47 - 2015-01-15 03:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-02-11 06:47 - 2015-01-15 03:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-02-11 06:47 - 2015-01-15 03:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-02-11 06:47 - 2015-01-15 03:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-02-11 06:47 - 2015-01-15 03:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-02-11 06:47 - 2015-01-15 03:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-02-11 06:47 - 2015-01-15 03:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-02-11 06:47 - 2015-01-15 03:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-02-11 06:47 - 2015-01-15 03:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-02-11 06:47 - 2015-01-15 02:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-02-11 06:47 - 2015-01-15 02:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-02-11 06:47 - 2015-01-15 02:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-02-11 06:47 - 2015-01-15 02:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-02-11 06:47 - 2015-01-15 02:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-02-11 06:47 - 2015-01-15 02:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-02-11 06:47 - 2015-01-14 23:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2015-02-11 06:47 - 2015-01-12 22:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2015-02-11 06:47 - 2015-01-12 21:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2015-02-11 06:46 - 2014-12-12 00:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2015-02-11 06:46 - 2014-12-12 00:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2015-02-11 06:45 - 2014-12-07 22:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll

2015-02-11 06:45 - 2014-12-07 21:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll

2015-02-11 06:45 - 2014-10-03 21:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2015-02-11 06:45 - 2014-10-03 20:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2015-02-11 06:45 - 2014-10-03 20:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll

2015-02-11 06:43 - 2015-01-14 01:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-02-11 06:43 - 2015-01-14 01:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-02-11 06:43 - 2015-01-14 01:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-02-11 06:43 - 2015-01-14 01:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-02-11 06:43 - 2015-01-14 00:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-02-11 06:43 - 2015-01-14 00:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-02-11 06:43 - 2015-01-14 00:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-02-11 06:42 - 2015-01-08 21:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-01-31 14:30 - 2015-01-31 14:34 - 00000000 ____D () C:\Users\Chuck\Desktop\2015-01-31

2015-01-30 22:17 - 2015-01-30 22:17 - 02044539 _____ () C:\Users\Chuck\Downloads\securedoc_20150130T154857.html

2015-01-30 12:14 - 2015-02-13 12:26 - 00002956 _____ () C:\Windows\System32\Tasks\ReclaimerUpdateXML_Chuck

2015-01-30 12:14 - 2015-02-13 12:26 - 00000366 _____ () C:\Windows\Tasks\ReclaimerUpdateXML_Chuck.job

2015-01-30 12:14 - 2015-02-13 06:20 - 00002960 _____ () C:\Windows\System32\Tasks\ReclaimerUpdateFiles_Chuck

2015-01-30 12:14 - 2015-02-13 06:20 - 00000370 _____ () C:\Windows\Tasks\ReclaimerUpdateFiles_Chuck.job

2015-01-30 12:14 - 2015-02-13 03:23 - 00000376 _____ () C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Chuck.job

2015-01-30 12:14 - 2015-01-30 12:14 - 00003612 _____ () C:\Windows\System32\Tasks\RNUpgradeHelperResumePrompt_Chuck

2015-01-30 12:14 - 2015-01-30 12:14 - 00002664 _____ () C:\Windows\System32\Tasks\RNUpgradeHelperLogonPrompt_Chuck

2015-01-30 06:24 - 2015-01-30 06:24 - 03863460 _____ () C:\Users\Chuck\Downloads\Attachments_2015130.zip

2015-01-14 06:25 - 2014-12-18 22:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 06:25 - 2014-12-18 20:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 06:25 - 2014-12-11 12:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 06:25 - 2014-12-05 23:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-14 06:25 - 2014-12-05 22:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2015-01-14 06:25 - 2014-12-05 22:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-13 22:06 - 2014-03-11 16:06 - 00000292 _____ () C:\Windows\Tasks\UpdaterEX.job

2015-02-13 22:06 - 2011-01-13 23:13 - 01459097 _____ () C:\Windows\WindowsUpdate.log

2015-02-13 21:56 - 2014-03-11 16:07 - 00000292 _____ () C:\Windows\Tasks\MySearchDial.job

2015-02-13 21:55 - 2013-10-19 10:42 - 00000374 _____ () C:\Windows\Tasks\WpsUpdateTask_Chuck.job

2015-02-13 21:42 - 2012-12-29 13:20 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-02-13 21:33 - 2012-11-18 10:14 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-02-13 21:12 - 2011-12-08 18:02 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2109932682-201200126-2622220936-1000UA.job

2015-02-13 20:29 - 2011-04-10 13:57 - 00000000 ____D () C:\ProgramData\MFAData

2015-02-13 20:25 - 2013-02-10 14:29 - 00000464 _____ () C:\Windows\Tasks\Arcadesafari.job

2015-02-13 19:48 - 2014-03-11 16:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-02-13 19:47 - 2014-03-11 16:07 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-02-13 19:47 - 2014-03-11 16:07 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-02-13 19:47 - 2014-03-11 16:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-02-13 18:12 - 2011-12-08 18:02 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2109932682-201200126-2622220936-1000Core.job

2015-02-13 16:42 - 2012-12-29 13:20 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-02-13 07:50 - 2011-06-07 06:50 - 00000402 _____ () C:\Windows\Tasks\Free File Viewer Update Checker.job

2015-02-13 06:49 - 2009-07-13 23:45 - 00021280 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-13 06:49 - 2009-07-13 23:45 - 00021280 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-13 04:12 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache

2015-02-13 03:23 - 2014-01-30 20:46 - 00000923 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk

2015-02-13 03:23 - 2014-01-30 20:46 - 00000907 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk

2015-02-13 03:23 - 2013-01-09 06:41 - 00000418 ____H () C:\Windows\Tasks\ContinueToSaveUpdaterTask{84A2E8B7-B46B-4050-B93A-5F893E706D55}.job

2015-02-13 03:22 - 2013-10-27 11:42 - 00029184 _____ () C:\Windows\setupact.log

2015-02-13 03:22 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-13 03:21 - 2013-01-09 22:13 - 00000000 ____D () C:\ProgramData\LogMeIn

2015-02-12 21:21 - 2009-07-13 23:45 - 00324624 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-02-12 21:19 - 2014-12-11 05:44 - 00000000 ____D () C:\Windows\system32\appraiser

2015-02-12 21:19 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel

2015-02-12 21:18 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2015-02-11 22:02 - 2013-08-14 21:48 - 00000000 ____D () C:\Windows\system32\MRT

2015-02-11 21:47 - 2011-01-28 06:25 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-02-04 21:33 - 2012-11-18 10:14 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-04 21:33 - 2012-11-18 10:14 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-02-04 21:33 - 2011-07-26 08:04 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-04 16:37 - 2012-12-29 13:20 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-02-04 16:37 - 2012-12-29 13:20 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-02-02 22:08 - 2011-01-30 13:32 - 00000000 ____D () C:\Users\Chuck\Documents\My PSP Files

2015-02-02 22:05 - 2009-07-14 00:13 - 00805488 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-31 09:24 - 2013-11-01 04:42 - 00188992 _____ () C:\Windows\PFRO.log

2015-01-25 09:15 - 2014-10-26 12:26 - 00000965 _____ () C:\Users\Public\Desktop\AVG 2015.lnk

2015-01-25 09:15 - 2014-03-31 08:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2015-01-18 09:18 - 2009-07-14 00:08 - 00032622 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-01-15 06:57 - 2014-02-27 21:35 - 00161792 _____ () C:\Users\Chuck\Desktop\AAA Sandals.xls

==================== Files in the root of some directories =======

2011-01-15 11:58 - 2011-01-15 11:58 - 0000093 _____ () C:\Users\Chuck\AppData\Local\fusioncache.dat

2011-01-15 19:34 - 2013-02-02 11:24 - 0004031 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:

====================

C:\Users\Chuck\AppData\Local\Temp\doxillionsetup.exe

C:\Users\Chuck\AppData\Local\Temp\fam-installer.exe

C:\Users\Chuck\AppData\Local\Temp\z6n5henu.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-02-13 00:09

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-02-2015

Ran by [removed] at 2015-02-13 21:08:11

Running from C:\Users\[removed]\Downloads

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Out of date) {108DAC43-C256-20B7-BB05-914135DA5160}

AV: AVG Internet Security 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}

AS: Microsoft Security Essentials (Disabled - Out of date) {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG Internet Security 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

FW: AVG Internet Security 2015 (Enabled) {757AB44A-78C2-7D1A-E37F-CA42A037B368}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4Videosoft iPad Manager 5.0.8 (HKLM-x32\…\{0C8A56C0-3647-4ce2-8F81-AA1E723649C5}_is1) (Version: - )

64 Bit HP CIO Components Installer (Version: 6.2.1 - Hewlett-Packard) Hidden

Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)

Adobe Flash Player 16 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (HKLM-x32\…\Adobe Shockwave Player) (Version: 11.6.1.629 - Adobe Systems, Inc.)

AIO_Scan (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden

Apple Application Support (HKLM-x32\…\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\…\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)

Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Arcadesafari (HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Arcadesafari) (Version: - Arcadesafari LLC)

AVG 2014 (Version: 14.0.3615 - AVG Technologies) Hidden

AVG 2015 (HKLM\…\AVG) (Version: 2015.0.5646 - AVG Technologies)

AVG 2015 (Version: 15.0.4284 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.5646 - AVG Technologies) Hidden

AVG SafeGuard toolbar (HKLM-x32\…\AVG SafeGuard toolbar) (Version: 17.0.1.12 - AVG Technologies)

Bejeweled 2 Deluxe (HKLM-x32\…\BFG-Bejeweled 2 Deluxe) (Version: - )

Bolt PDF Printer (HKLM-x32\…\BoltPDF) (Version: 1.17 - NCH Software)

Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden

C5200 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden

C5200_Help (x32 Version: 100.0.206.000 - Hewlett-Packard) Hidden

CanoScan Toolbox Ver4.9 (HKLM-x32\…\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )

CCleaner (HKLM\…\CCleaner) (Version: 4.00 - Piriform)

Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

ContinueToSave (HKLM\…\{2CE75CD8-E405-49BE-AB55-AC27F7047E2E}) (Version: 1.0 - )

Convert XLS (HKLM-x32\…\Convert XLS_is1) (Version: - Softinterface, Inc.)

Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden

Coupon Printer for Windows (HKLM-x32\…\Coupon Printer for Windows5.0.0.1) (Version: 5.0.0.1 - Coupons.com Incorporated)

Cucusoft DVD to iPad + iPad Video Converter Suite 8.9.8.9 (HKLM\…\Cucusoft DVD to iPad + iPad Video Converter Suite_is1) (Version: - Cucusoft, Inc.)

Destinations (x32 Version: 140.0.77.000 - Hewlett-Packard) Hidden

DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden

DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden

Doxillion Document Converter (HKLM-x32\…\Doxillion) (Version: 2.22 - NCH Software)

Driver Support (HKLM-x32\…\{597FB4A5-DD86-4316-A410-7E8074CC2CCE}) (Version: 8.1 - Driver Support)

Extended Update (HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\UpdaterEX) (Version: - Extended Update) <==== ATTENTION

EZ Label Xpress Lite (HKLM-x32\…\InstallShield_{1DA07BCA-FD11-406E-89A8-5B4496F43FC5}) (Version: 1.00.0000 - EZ MERITLINE)

EZ Label Xpress Lite (x32 Version: 1.00.0000 - EZ MERITLINE) Hidden

Facebook Video Calling 3.1.0.521 (HKLM-x32\…\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)

Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden

File Type Assistant (HKLM-x32\…\Trusted Software Assistant_is1) (Version: - Trusted Software) <==== ATTENTION

Free File Viewer 2011 (HKLM-x32\…\FreeFileViewer_is1) (Version: - Bitberry Software) <==== ATTENTION

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden

GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

honestech VHS to DVD 4.0 Deluxe (HKLM-x32\…\{BA84775E-C53D-41F4-A0C9-B9000D1BF95B}) (Version: 4.0 - honestech)

honestech VHS to DVD 4.0 Deluxe (x32 Version: 4.0 - Honest Technology) Hidden

HP Imaging Device Functions 13.0 (HKLM\…\HP Imaging Device Functions) (Version: 13.0 - HP)

HP Photosmart Essential 3.5 (HKLM\…\HP Photosmart Essential) (Version: 3.5 - HP)

HP Smart Web Printing 4.51 (HKLM\…\HP Smart Web Printing) (Version: 4.51 - HP)

HP Solution Center 13.0 (HKLM\…\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)

HP Update (HKLM-x32\…\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)

HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

iCloud (HKLM\…\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version: 4.0.3.56 - Apple Inc.)

iTunes (HKLM\…\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)

Jasc Paint Shop Pro 9 (HKLM-x32\…\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.00.0000 - Jasc Software Inc)

Java 7 Update 10 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217010FF}) (Version: 7.0.100 - Oracle)

Kingsoft Office 2013 (9.1.0.4246) (HKLM-x32\…\Kingsoft Office) (Version: 9.1.0.4246 - Kingsoft Corp.)

Kingsoft Office Free Download Packages (HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\Kingsoft Office Free Download Packages) (Version: - ) <==== ATTENTION

LogMeIn (HKLM-x32\…\{FA653F5B-483A-4E92-BF75-BB3BBF1D550D}) (Version: 4.1.2634 - LogMeIn, Inc.)

McAfee Security Scan Plus (HKLM\…\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)

Microsoft .NET Framework 1.1 (HKLM-x32\…\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)

Microsoft .NET Framework 4.5.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft IntelliPoint 8.0 (HKLM\…\{563F041C-DFDB-437B-A1E8-E141E0906076}) (Version: 8.0.225.0 - Microsoft)

Microsoft Office 2000 Premium (HKLM-x32\…\{00000409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\…\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\…\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden

NVIDIA Graphics Driver 307.83 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)

NVIDIA Update 1.10.8 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)

OCR Software by I.R.I.S. 13.0 (HKLM\…\HPOCR) (Version: 13.0 - HP)

OpenOffice.org 3.1 (HKLM-x32\…\{E6B87DC4-2B3D-4483-ADFF-E483BF718991}) (Version: 3.1.9399 - OpenOffice.org)

PhotoStage Slideshow Producer (HKLM-x32\…\PhotoStage) (Version: 2.52 - NCH Software)

Privacy SafeGuard version 1.0 (HKLM\…\{B820C985-D9F1-45B5-A7F5-0C5863CBEA04}_is1) (Version: 1.0 - Privacy SafeGuard)

PS_AIO_02_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden

PS_AIO_02_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden

PS_AIO_02_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden

QuickBooks Premier: Mfg and Whsle Edition 2006 (HKLM-x32\…\{69B02159-7636-4DBB-B9EE-F933039830AD}) (Version: - )

QuickTime 7 (HKLM-x32\…\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)

Quiknowledge (HKLM-x32\…\Quiknowledge) (Version: 1.9.0.1 - Quiknowledge) <==== ATTENTION

RealDownloader (x32 Version: 1.3.0 - RealNetworks, Inc.) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Safari (HKLM-x32\…\{FA4C2D53-205F-4245-9717-F3761154824D}) (Version: 5.34.57.2 - Apple Inc.)

Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden

Search Assistant SoftQuick 1.66 (HKLM-x32\…\SP_a8235b05) (Version: - ) <==== ATTENTION

Shop for HP Supplies (HKLM\…\Shop for HP Supplies) (Version: 13.0 - HP)

SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden

SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden

Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden

TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden

Tweaking.com - Windows Repair (All in One) (HKLM-x32\…\Tweaking.com - Windows Repair (All in One)) (Version: 1.9.4 - Tweaking.com)

Unity Web Player (HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\UnityWebPlayer) (Version: 4.5.4f2 - Unity Technologies ApS)

UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden

USB2.0 VIDBOX NW03 (HKLM-x32\…\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}) (Version: 3.0.2 - honestech)

Visual Studio 2008 x64 Redistributables (HKLM-x32\…\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)

Visual Studio 2010 x64 Redistributables (HKLM\…\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)

Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden

WinRAR 5.01 (32-bit) (HKLM-x32\…\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

WinRAR Free Download Packages (HKU\S-1-5-21-2109932682-201200126-2622220936-1000\…\WinRAR Free Download Packages) (Version: - ) <==== ATTENTION

Yahoo! Install Manager (HKLM-x32\…\YInstHelper) (Version: - )

Yahoo! Software Update (HKLM-x32\…\Yahoo! Software Update) (Version: - )

Yahoo! Toolbar (HKLM-x32\…\Yahoo! Companion) (Version: - Yahoo! Inc.)

Yontoo Layers Runtime 1.10.01 (HKLM\…\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.01 - Yontoo LLC) <==== ATTENTION

Zynga Toolbar (HKLM-x32\…\Zynga Toolbar) (Version: 5.7.4.0 - Zynga)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points =========================

25-01-2015 09:10:00 Installed AVG 2015

27-01-2015 10:13:47 Windows Update

03-02-2015 06:13:15 Windows Update

07-02-2015 10:53:42 Windows Update

11-02-2015 05:59:58 Windows Update

11-02-2015 21:43:06 Windows Update

13-02-2015 03:00:40 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2013-11-01 07:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0DFA932D-F4BE-40D9-AB80-297FBA59B06C} - System32\Tasks\ContinueToSaveUpdaterTask{84A2E8B7-B46B-4050-B93A-5F893E706D55} => C:\ProgramData\Premium\ContinueToSave\ContinueToSave.exe <==== ATTENTION

Task: {11050035-7A52-4FED-8BCF-B96E05E1D0E4} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {13D06791-F14B-475F-8787-1E6A9B641DA2} - System32\Tasks\WpsUpdateTask_Chuck => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe [2014-08-06] (Zhuhai Kingsoft Office Software Co.,Ltd)

Task: {1D88D36B-D066-4BBC-836C-00EFB191A2C6} - System32\Tasks\{C5AB713D-EA19-47FB-9E80-B8F5F91DE25F} => C:\Program Files (x86)\iMacsoft\iPad to PC Transfer\iPodManager.exe

Task: {3011C3BB-9205-4708-B0DC-F7A2EBDFC8C5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-29] (Google Inc.)

Task: {37E0F950-3B7C-49A9-8E75-DE438349AE25} - System32\Tasks\winupd => C:\Users\Chuck\AppData\Local\Temp\winupd.exe <==== ATTENTION

Task: {3827CE52-1A88-44A8-9353-B60E2D2D13C8} - System32\Tasks\RNUpgradeHelperLogonPrompt_Chuck => C:\Users\Chuck\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\12.01\agent\rnupgagent.exe [2015-01-30] (RealNetworks, Inc.)

Task: {3A6174B7-8E68-4C94-B21E-7C5AD23C1A98} - System32\Tasks\ReclaimerUpdateFiles_Chuck => C:\Users\Chuck\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\12.01\agent\rnupgagent.exe [2015-01-30] (RealNetworks, Inc.)

Task: {3AD502A2-74EE-4E59-BFE0-626AAD558CBC} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2010-07-21] (Microsoft Corporation)

Task: {3AD77D6B-BADC-47A3-A9A2-2BC6E42BC5CC} - \2137324032 No Task File <==== ATTENTION

Task: {3E77E4BE-25D7-46DC-816A-E0FEBB87288F} - System32\Tasks\FileAssociationManagerUpdater => C:\Program Files (x86)\FileAssociationManager\Updater.exe

Task: {40E4881B-4A2C-44BF-84F3-8CD852F0EC64} - System32\Tasks\Arcadesafari => C:\Users\Chuck\AppData\Local\Arcadesafari\ArcadesafariUpdater.exe [2014-09-01] (Arcadesafari)

Task: {432C9218-78DE-46D3-AB4B-999AB01413C8} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2109932682-201200126-2622220936-1000Core => C:\Users\Chuck\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.)

Task: {45BE9717-66AE-4570-9833-58A1F408EA34} - System32\Tasks\Driver Support-RTMRules => C:\Program Files (x86)\Driver Support\Driver Support\DriverSupport.exe [2014-11-01] (PC Drivers Headquarters)

Task: {5310501B-6F6D-4E6C-A859-7F95569A6B37} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-29] (Google Inc.)

Task: {54393215-68F2-497A-B980-DCE3F0C19475} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2109932682-201200126-2622220936-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)

Task: {676FE7A9-57CB-4B6B-B583-5765EEB93C61} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2109932682-201200126-2622220936-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)

Task: {69CBD1EF-AF15-4E67-A02B-6530AA41A9E8} - System32\Tasks\MySearchDial => C:\Users\Chuck\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {6CB645C6-7657-4AB9-9629-E84DF1AFA2D5} - \3739153152 No Task File <==== ATTENTION

Task: {702C106E-F90E-45F2-A314-64F8955081CE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2109932682-201200126-2622220936-1000UA => C:\Users\Chuck\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.)

Task: {812A50AC-80D2-4F71-A78D-BA64E0DF0C4A} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2014-08-25] (Apple Inc.)

Task: {98D4AE61-D2D9-49AD-9555-F32D59C0E474} - System32\Tasks\{F9621E83-ADF6-45CD-9E62-BC0B1DB1D498} => pcalua.exe -a "C:\Users\Chuck\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LDA8KV8B\GolfCardGpsMGR-2.1.0[1].exe" -d C:\Users\Chuck\Desktop

Task: {9D0A0239-7017-4890-BCF3-9ABC9761A9BA} - System32\Tasks\ReclaimerUpdateXML_Chuck => C:\Users\Chuck\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\12.01\agent\rnupgagent.exe [2015-01-30] (RealNetworks, Inc.)

Task: {A3B0B30D-D410-4777-B9D7-E84D0145C7E2} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)

Task: {A42E465F-DABA-4BE7-A0CA-AD65A5E1E3AB} - System32\Tasks\UpdaterEX => C:\Users\Chuck\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {A964AA9D-88B5-40FF-9840-A1C4E16C5089} - System32\Tasks\Free File Viewer Update Checker => C:\Program Files (x86)\FreeFileViewer\FFVCheckForUpdates.exe [2011-02-05] (Bitberry Software)

Task: {AB200DEA-8D4C-45AC-8BE2-A63EBAD94ADD} - System32\Tasks\Driver Support-RTMScan => C:\Program Files (x86)\Driver Support\Driver Support\DriverSupport.exe [2014-11-01] (PC Drivers Headquarters)

Task: {ADAD4A35-8278-4CD1-A649-C9714301AE7A} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2109932682-201200126-2622220936-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)

Task: {B055E53D-1AC9-4C32-BB9C-B65BB0F97BCA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd)

Task: {BF9AF1F3-9435-4C68-92B8-1315DD16CF1F} - System32\Tasks\RNUpgradeHelperResumePrompt_Chuck => C:\Users\Chuck\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\12.01\agent\rnupgagent.exe [2015-01-30] (RealNetworks, Inc.)

Task: {DBC24E95-43B5-43BB-B7D4-132FC1D6EBDC} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2109932682-201200126-2622220936-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)

Task: {EAE35471-C7C3-4FA5-B339-114AF9C84CA8} - System32\Tasks\Driver Support-RTMUpdater => C:\Program Files (x86)\Driver Support\Driver Support\DriverSupport.exe [2014-11-01] (PC Drivers Headquarters)

Task: {FA14C189-BD4C-4951-A948-8246067C1FD2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)

Task: {FBB8C8E8-B27C-433A-8D5B-C41F9C151446} - System32\Tasks\{CF22EB75-CD1D-42E8-BAB1-ED8C41DEEF5C} => C:\Program Files (x86)\Microsoft Office\Office\OUTLOOK.EXE [1998-12-16] (Microsoft Corporation)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Arcadesafari.job => C:\Users\Chuck\AppData\Local\Arcadesafari\ArcadesafariUpdater.exe

Task: C:\Windows\Tasks\ContinueToSaveUpdaterTask{84A2E8B7-B46B-4050-B93A-5F893E706D55}.job => C:\ProgramData\Premium\ContinueToSave\ContinueToSave.exe <==== ATTENTION

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2109932682-201200126-2622220936-1000Core.job => C:\Users\Chuck\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2109932682-201200126-2622220936-1000UA.job => C:\Users\Chuck\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\Free File Viewer Update Checker.job => C:\Program Files (x86)\FreeFileViewer\FFVCheckForUpdates.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\MySearchDial.job => C:\Users\Chuck\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\ReclaimerUpdateFiles_Chuck.job => C:\Users\Chuck\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\12.01\agent\rnupgagent.exe

Task: C:\Windows\Tasks\ReclaimerUpdateXML_Chuck.job => C:\Users\Chuck\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\12.01\agent\rnupgagent.exe

Task: C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Chuck.job => C:\Users\Chuck\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\12.01\agent\rnupgagent.exe

Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\Chuck\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\WpsUpdateTask_Chuck.job => C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe

==================== Loaded Modules (whitelisted) ==============

2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

2013-04-12 21:56 - 2013-01-31 04:25 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-04-01 08:42 - 2014-11-01 18:34 - 00428424 _____ () C:\Program Files (x86)\Driver Support\Driver Support\Agent.Communication.XmlSerializers.dll

2013-01-21 19:56 - 2013-10-02 04:59 - 02404376 _____ () C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe

2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2009-04-16 12:02 - 2009-04-16 12:02 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll

2015-02-06 16:44 - 2015-02-04 04:02 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libglesv2.dll

2015-02-06 16:44 - 2015-02-04 04:02 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libegl.dll

2015-02-06 16:44 - 2015-02-04 04:02 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:0B4227B4

AlternateDataStreams: C:\ProgramData\TEMP:3A0561F3

AlternateDataStreams: C:\ProgramData\TEMP:A3E39C6A

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\Software\Classes\.exe: => <===== ATTENTION!

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\Software\Classes\exefile: "%1" %* <===== ATTENTION!

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2109932682-201200126-2622220936-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Chuck\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.1.1 - [removed]

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== Accounts: =============================

Administrator (S-1-5-21-2109932682-201200126-2622220936-500 - Administrator - Disabled)

ASPNET (S-1-5-21-2109932682-201200126-2622220936-1004 - Limited - Enabled)

Chuck (S-1-5-21-2109932682-201200126-2622220936-1000 - Administrator - Enabled) => C:\Users\Chuck

Guest (S-1-5-21-2109932682-201200126-2622220936-501 - Limited - Disabled)

LogMeInRemoteUser (S-1-5-21-2109932682-201200126-2622220936-1005 - Administrator - Enabled) => C:\Users\LogMeInRemoteUser

UpdatusUser (S-1-5-21-2109932682-201200126-2622220936-1006 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (02/13/2015 01:38:31 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".

Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (02/13/2015 01:28:52 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".

Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (02/11/2015 07:10:32 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".

Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (02/11/2015 05:49:00 AM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)

Description: Product: Adobe Refresh Manager – Error 1606.Could not access network location %APPDATA%\.

Error: (02/11/2015 05:49:00 AM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)

Description: Product: Adobe Refresh Manager – Error 1606.Could not access network location %APPDATA%\.

Error: (02/10/2015 07:04:08 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".

Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (02/09/2015 07:40:17 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".

Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (02/08/2015 10:31:57 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".

Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (02/07/2015 00:36:00 PM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".

Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (02/07/2015 10:27:31 AM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)

Description: Product: Adobe Refresh Manager – Error 1606.Could not access network location %APPDATA%\.

System errors:

=============

Error: (02/13/2015 03:31:57 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Microsoft Antimalware Service service terminated with the following error:

%%-2147017840

Error: (02/13/2015 03:28:59 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The NVIDIA Update Service Daemon service hung on starting.

Error: (02/13/2015 03:28:20 AM) (Source: Microsoft Antimalware) (EventID: 5101) (User: )

Description: %%860 grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.

Expiration Reason: %%873

Expiration Date (UTC): ‎2/‎13/‎2015 8:28:19 AM

Error Code: 0x80092003

Error Description: An error occurred while reading or writing to a file.

Error: (02/13/2015 03:22:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The vToolbarUpdater17.0.12 service failed to start due to the following error:

%%2

Error: (02/12/2015 09:27:47 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The NVIDIA Update Service Daemon service hung on starting.

Error: (02/12/2015 09:23:40 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Microsoft Antimalware Service service terminated with the following error:

%%-2147017840

Error: (02/12/2015 09:23:33 PM) (Source: Microsoft Antimalware) (EventID: 5101) (User: )

Description: %%860 grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.

Expiration Reason: %%873

Expiration Date (UTC): ‎2/‎13/‎2015 2:23:33 AM

Error Code: 0x80092003

Error Description: An error occurred while reading or writing to a file.

Error: (02/12/2015 09:22:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The vToolbarUpdater17.0.12 service failed to start due to the following error:

%%2

Error: (02/11/2015 06:32:11 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Windows Defender - KB915597 (Definition 1.191.4500.0).

Error: (02/11/2015 05:51:52 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The NVIDIA Update Service Daemon service hung on starting.

Microsoft Office Sessions:

=========================

Error: (02/13/2015 01:38:31 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/13/2015 01:28:52 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/11/2015 07:10:32 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/11/2015 05:49:00 AM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)

Description: Product: Adobe Refresh Manager – Error 1606.Could not access network location %APPDATA%\.(NULL)(NULL)(NULL)(NULL)(NULL)