What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

strange programs accidentally installed [Solved]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

Was trying to get my rrouter set up. I meant to go to routerlogin.net but bing took me to http://www.routerlogin-net.melogin.com/ and I didn't realize until I had installed stuff that I was not in the right place. now I have new programs on my desktop: crossbrowse, mix player, and 3D bubble sound. There's also a search bar across the top of my desktop and my browser search is changed to trovi.com.

 

There may be other things….. O_o

 

Here's the MBR log. The other link (FRST) isn't working, so I couldn't download and run it.

 

Thanks for your help!

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-04-18 00:16:23
—————————–
00:16:23.242    OS Version: Windows x64 6.2.9200
00:16:23.242    Number of processors: 4 586 0x1001
00:16:23.244    ComputerName: GOR187  UserName: andrew
00:16:27.952    Initialize success
00:16:28.260    VM: initialized successfully
00:16:28.262    VM: Amd CPU supported
00:18:56.068    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000002f
00:18:56.073    Disk 0 Vendor: ST500LM012_HN-M500MBB 2AR10002 Size: 476940MB BusType: 11
00:18:56.298    Disk 0 MBR read successfully
00:18:56.298    Disk 0 MBR scan
00:18:56.303    Disk 0 unknown MBR code
00:18:56.308    Disk 0 Partition 1 00     EE          GPT            476940 MB offset 1
00:18:56.348    Disk 0 scanning C:\WINDOWS\system32\drivers
00:19:06.445    Service scanning
00:19:09.240    Service BHDrvx64 C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\BASHDefs\20150408.001\BHDrvx64.sys **LOCKED** 5
00:19:11.190    Service ccSet_NIS C:\WINDOWS\system32\drivers\NISx64\1507000.00B\ccSetx64.sys **LOCKED** 5
00:19:12.314    Service eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys **LOCKED** 5
00:19:12.599    Service EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys **LOCKED** 5
00:19:14.225    Service IDSVia64 C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\IPSDefs\20150417.001\IDSvia64.sys **LOCKED** 5
00:19:16.615    Service NAVENG C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\VirusDefs\20150417.002\ENG64.SYS **LOCKED** 5
00:19:16.670    Service NAVEX15 C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\VirusDefs\20150417.002\EX64.SYS **LOCKED** 5
00:19:21.052    Service SRTSPX C:\WINDOWS\system32\drivers\NISx64\1507000.00B\SRTSPX64.SYS **LOCKED** 5
00:19:21.747    Service SymDS C:\WINDOWS\system32\drivers\NISx64\1507000.00B\SYMDS64.SYS **LOCKED** 5
00:19:21.832    Service SymELAM C:\WINDOWS\system32\drivers\NISx64\1507000.00B\SymELAM.sys **LOCKED** 5
00:19:21.887    Service SymEvent C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS **LOCKED** 5
00:19:21.937    Service SymIRON C:\WINDOWS\system32\drivers\NISx64\1507000.00B\Ironx64.SYS **LOCKED** 5
00:19:21.972    Service SymNetS C:\WINDOWS\System32\Drivers\NISx64\1507000.00B\SYMNETS.SYS **LOCKED** 5
00:19:26.268    Modules scanning
00:19:26.278    Disk 0 trace - called modules:
00:19:26.303    ntoskrnl.exe CLASSPNP.SYS disk.sys amdxata.sys storport.sys hal.dll amdsata.sys
00:19:26.308    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe0006eae95e0]
00:19:26.318    3 CLASSPNP.SYS[fffff8013fca9170] -> nt!IofCallDriver -> [0xffffe0006e193040]
00:19:26.328    5 amdxata.sys[fffff8013f13f6b4] -> nt!IofCallDriver -> \Device\0000002f[0xffffe0006e197060]
00:19:26.338    Disk 0 statistics 121035/0/0 @ 7.24 MB/s
00:19:26.343    Scan finished successfully
00:20:06.747    Disk 0 MBR has been saved successfully to "C:\Users\andrew\Desktop\MBR.dat"
00:20:06.755    The log file has been saved successfully to "C:\Users\andrew\Desktop\aswMBR.txt"

 

Post #2

:welcome:

 

Lets run this scanner and see whats going on, you need the 64Bit version, please download it to your desktop

 

 

Please download Farbar Recovery Scan Tool and save it to your DESKTOP
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 
How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system
A simple way to check your system: Start –> Computer (right click) –> Properties
 
[external image: FRST_zps5d956a1a.jpg]
 
 
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Please make sure All Users is checked
  • Just keep the defaults as in the picture checkmarked
  • Press Scan button.
  • It will produce a log called FRST.txt in the same directory the tool is run from.
  • Please copy and paste log back here.
  • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
    • Post #3

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-04-2015 01
    Ran by [removed] at 2015-04-19 10:06:01
    Running from C:\Users\[removed]\Desktop
    Boot Mode: Normal
    ==========================================================

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Norton Internet Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
    AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Norton Internet Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
    FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    AMD Catalyst Install Manager (HKLM\…\{403A4E7A-D239-04D8-6A3D-31DD203C018D}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
    AMD Quick Stream (HKLM\…\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.3.26.0 - AppEx Networks)
    Apple Application Support (32-bit) (HKLM-x32\…\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\…\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)
    Apple Mobile Device Support (HKLM\…\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Boost (HKLM-x32\…\Boost) (Version: 3.0.0.27 - Boost Shopping)
    Bubble Dock (HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Bubble Dock) (Version:  - Nosibay)
    BubbleSound (HKLM\…\BubbleSound) (Version: 1.0 - BubbleSound) <==== ATTENTION!
    Catalyst Control Center (HKLM-x32\…\WUCCCApp) (Version: 1.00.0000 - AMD)
    Consumer Input (HKLM-x32\…\Setup Support for Consumer Input) (Version: 1.0 - Software Service Inc.) <==== ATTENTION
    Crossbrowse (HKLM-x32\…\Crossbrowse) (Version: 39.4.2171.95 - The Crossbrowse Authors) <==== ATTENTION!
    Games Bot (HKLM-x32\…\5424C600-B68F-B141-B9D6-E7E5262C14DD) (Version: 155.0.0.1703 - MADFLY FILMS LTD)
    GamesDesktop 025.455 (HKLM-x32\…\gmsd_us_455_is1) (Version:  - GAMESDESKTOP) <==== ATTENTION
    Google Chrome (HKLM-x32\…\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
    Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
    Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.21.115 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
    HP Deskjet 2540 series Basic Device Software (HKLM\…\{7AF1A318-2914-41CC-9B24-041C2D4AAAD7}) (Version: 32.0.1180.44630 - Hewlett-Packard Co.)
    HP Deskjet 2540 series Help (HKLM-x32\…\{4539575D-C09D-4E71-B207-0F2D6BD74DA2}) (Version: 30.0.0 - Hewlett Packard)
    HP FWUpdateEDO2 (HKLM-x32\…\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
    HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.7702 - HP)
    HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
    HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
    iTunes (HKLM\…\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.)
    Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4701.1002 - Microsoft Corporation)
    Microsoft OneDrive (HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\…\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
    MixVideoPlayer (HKLM-x32\…\MixVideoPlayer) (Version: v1.0.0.13 - SoftForce LLC)
    NETGEAR Genie (HKLM-x32\…\NETGEAR Genie) (Version: 2.3.1.57 - NETGEAR Inc.)
    Norton Internet Security (HKLM-x32\…\NIS) (Version: 21.7.0.11 - Symantec Corporation)
    Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
    Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
    Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
    Product Improvement Study for HP Deskjet 2540 series (HKLM\…\{446CCB22-B632-4A1D-BF84-DA8DB0575F98}) (Version: 32.0.1180.44630 - Hewlett-Packard Co.)
    Qualcomm Atheros Bluetooth Suite (64) (HKLM\…\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.326 - Qualcomm Atheros Communications)
    Qualcomm Atheros Client Installation Program (HKLM-x32\…\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
    Quick Starter (HKLM\…\{EC36E2BC-86F7-44C9-84B2-93930F0FBDBF}) (Version: 1.0.2 - Samsung Electronics CO., LTD.)
    Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
    Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6702 - Realtek Semiconductor Corp.)
    Recovery (HKLM-x32\…\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 6.0.12.18 - Samsung Electronics CO., LTD.)
    RinoReader (HKLM-x32\…\RinoReader) (Version: 0.1 - RinoReader)
    S Agent (Version: 1.1.51 - Samsung Electronics CO., LTD.) Hidden
    S Service (HKLM-x32\…\{E8336EA1-40A2-48A1-80E8-B78F9EEAB23F}) (Version: 1.0 - Samsung Electronics CO., LTD.)
    Settings (HKLM-x32\…\{8CB5C357-12E5-41B1-A024-D57D4E6F32D9}) (Version: 2.0.1 - Samsung Electronics CO., LTD.)
    Spotify (HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Spotify) (Version: 1.0.3.101.gbfa97dfe - Spotify AB)
    SW Update (HKLM-x32\…\{1687FC01-135F-4ADE-B828-B461CC74BD8A}) (Version: 2.2.4 - Samsung Electronics CO., LTD.)
    Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 16.2.14.2 - Synaptics Incorporated)
    Web Bar 2.0.5582.15558 (HKLM\…\{0BCE8B0A-1E76-44E5-9909-3CF804D92E4D}_is1) (Version: 2.0.5582.15558 - Web Bar Media) <==== ATTENTION!
    WindApp (HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\WindApp) (Version:  - Store) <==== ATTENTION

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-1751677316-1340614493-3878152295-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\andrew\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation)

    ==================== Restore Points  =========================

    25-03-2015 14:57:53 Windows Modules Installer
    13-04-2015 19:24:40 Scheduled Checkpoint

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2013-08-22 05:25 - 2013-08-22 05:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {12FF7081-97BB-422F-9E9F-F2CAD5077601} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\WSCStub.exe [2015-03-06] (Symantec Corporation)
    Task: {1D4927E8-A5F4-4268-B935-59593AF5A998} - System32\Tasks\WebBarUpdateTask => C:\Program Files\WebBar\wbsvc.exe [2015-04-14] (Web Bar Media)
    Task: {1EEB80E1-B157-4972-89A9-EE59B16A4D58} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)
    Task: {33EEB0EC-99C1-4B5E-8005-953F7B376985} - System32\Tasks\Microsoft Office 15 Sync Maintenance for GOR187-andrew gor187 => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-03-21] (Microsoft Corporation)
    Task: {340F8891-ACE9-4A6D-84E4-9BEEAD3AD8F2} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)
    Task: {3584AE33-DEA2-4000-AF63-6A623DC8E164} - System32\Tasks\HPCustParticipation HP Deskjet 2540 series => C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPCustPartic.exe [2013-08-13] (Hewlett-Packard Co.)
    Task: {38139C0A-E82B-445C-8A72-D33AFE62D376} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2014-11-12] (SEC)
    Task: {437C7B97-0A13-4B0A-B6BA-D01E12596E11} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-03-21] (Microsoft Corporation)
    Task: {43EEA8ED-6A46-4999-8376-15737CE434DB} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1751677316-1340614493-3878152295-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
    Task: {460C0AA1-AABF-4047-A73D-D694338C88D1} - System32\Tasks\GB Runner => %LOCALAPPDATA%\5424C600-B68F-B141-B9D6-E7E5262C14DD\gbRunner.exe
    Task: {5F884515-FAA9-47FC-9EB5-8995B3EE93CC} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-17] (Microsoft Corporation)
    Task: {658370A7-D6BE-47F9-A494-79D24A9A090B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
    Task: {6B7D8568-0A2A-4CAB-85E6-02B4C21B37D0} - System32\Tasks\WindApp Update => C:\Users\andrew\AppData\Roaming\Store\WindApp\WindApp Update.exe [2015-03-20] (Nosibay) <==== ATTENTION
    Task: {6D5CE944-75BA-44F0-A4DB-A8995C68F77B} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2014-01-29] (Samsung Electronics CO., LTD.)
    Task: {7AF9AA23-DF94-4AE0-9847-E8618853984C} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2014-10-29] (Samsung Electronics CO., LTD.)
    Task: {83DB3328-EBA7-4448-848C-F4B1F9638747} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe [2015-04-17] () <==== ATTENTION
    Task: {990694EA-0C95-4AED-ACB9-225701CC7626} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {9B9844A8-312D-4404-8F3A-3A1082C089DD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-23] (Google Inc.)
    Task: {AD2C9E9F-345B-4BAD-9061-5127B24F2FC4} - System32\Tasks\Microsoft\Windows\Maintenance\GB Update => %LOCALAPPDATA%\5424C600-B68F-B141-B9D6-E7E5262C14DD\gbRunner.exe
    Task: {D750C067-6DFE-4CCB-A57E-109EE9DAFD10} - \avaavaxvyy No Task File <==== ATTENTION
    Task: {D7E558A8-191D-4328-A100-0D49E30EB4E4} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-10-16] (Synaptics Incorporated)
    Task: {E3DDFC57-082E-47F9-BAC2-B31529C90081} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
    Task: {ED60959B-ECE4-4B13-9790-8581A0C576BD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-23] (Google Inc.)
    Task: {F45A3BB6-EDA1-47A6-A5A0-50E91C03A3BF} - System32\Tasks\WebBarLaunchTask => C:\Program Files\WebBar\wbsvc.exe [2015-04-14] (Web Bar Media)
    Task: C:\WINDOWS\Tasks\Crossbrowse.job => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) ==============

    2014-07-04 22:33 - 2014-07-04 22:33 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
    2015-02-13 05:20 - 2015-02-13 05:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-02-13 05:20 - 2015-02-13 05:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2015-03-21 20:09 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
    2015-04-17 22:16 - 2015-04-17 22:16 - 00523264 _____ () c:\windows\mtqj.exe
    2015-04-17 22:11 - 2015-04-17 22:16 - 00531456 _____ () c:\windows\tqj.exe
    2014-01-29 12:20 - 2014-01-29 12:20 - 00084800 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
    2015-03-21 22:22 - 2015-03-21 22:22 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
    2015-04-17 22:19 - 2015-04-16 17:34 - 03304904 _____ () C:\Users\andrew\AppData\Local\gmsd_us_455\upgmsd_us_455.exe
    2015-04-17 22:10 - 2015-03-04 11:31 - 00808960 _____ () C:\Program Files\WebBar\2.0.5582.15558\ISightSDK_x64.dll
    2015-04-18 20:02 - 2015-04-18 20:02 - 00003072 _____ () C:\Users\andrew\AppData\Local\Temp\isdkHEWhpNS5\ISightHost.exe
    2015-04-18 20:02 - 2015-03-04 11:31 - 00808960 _____ () C:\Users\andrew\AppData\Local\Temp\isdkHEWhpNS5\ISightSDK.DLL
    2014-10-29 18:19 - 2014-10-29 18:19 - 00088624 _____ () C:\Program Files\Samsung\S Agent\ToastX64.dll
    2014-06-17 09:32 - 2014-06-17 09:32 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
    2014-06-17 09:29 - 2014-06-17 09:29 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
    2014-06-17 09:35 - 2014-06-17 09:35 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
    2015-04-17 01:15 - 2015-04-17 01:15 - 00065536 _____ () C:\Program Files (x86)\MixVideoPlayer\BrowserWeb.exe
    2015-04-15 02:19 - 2015-04-15 02:19 - 00011264 _____ () C:\Program Files (x86)\MixVideoPlayer\LTVNetSdk.dll
    2015-04-17 00:34 - 2015-04-17 00:34 - 00025600 _____ () C:\Program Files (x86)\MixVideoPlayer\Snowplow.Tracker.dll
    2015-04-17 22:19 - 2015-04-16 17:34 - 03983304 _____ () C:\Program Files (x86)\gmsd_us_455\gmsd_us_455.exe
    2014-07-04 22:33 - 2014-07-04 22:33 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
    2014-12-14 18:27 - 2014-12-14 18:27 - 00105216 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
    2015-04-06 05:57 - 2015-04-06 05:57 - 00396352 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\gbRunner.exe
    2014-01-29 12:20 - 2014-01-29 12:20 - 00027968 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll
    2014-01-29 12:20 - 2014-01-29 12:20 - 01141056 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll
    2014-01-29 12:20 - 2014-01-29 12:20 - 00109888 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll
    2014-01-29 12:20 - 2014-01-29 12:20 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll
    2014-01-29 12:20 - 2014-01-29 12:20 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
    2014-01-29 12:20 - 2014-01-29 12:20 - 00025920 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll
    2014-01-29 12:20 - 2014-01-29 12:20 - 00109888 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll
    2014-01-29 12:20 - 2014-01-29 12:20 - 00059712 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll
    2014-01-29 12:20 - 2014-01-29 12:20 - 00102720 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll
    2013-09-28 17:13 - 2013-09-28 17:13 - 00544817 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libgcc_s_dw2-1.dll
    2013-09-28 17:13 - 2013-09-28 17:13 - 00989805 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libstdc++-6.dll
    2013-09-28 17:14 - 2013-09-28 17:14 - 03369922 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuin51.dll
    2013-09-28 17:14 - 2013-09-28 17:14 - 01978690 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuuc51.dll
    2013-09-28 17:14 - 2013-09-28 17:14 - 22378434 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icudt51.dll
    2013-09-28 17:14 - 2013-09-28 17:14 - 01233408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\platforms\qwindows.dll
    2015-01-08 22:40 - 2015-01-08 22:40 - 00640000 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll
    2014-12-18 22:03 - 2014-12-18 22:03 - 01686016 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll
    2015-01-08 22:01 - 2015-01-08 22:01 - 00192512 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll
    2014-11-04 23:37 - 2014-11-04 23:37 - 00632832 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll
    2015-01-08 22:03 - 2015-01-08 22:03 - 06477824 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll
    2014-06-29 17:55 - 2014-06-29 17:55 - 00068608 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll
    2014-06-29 18:05 - 2014-06-29 18:05 - 01183232 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\qwt.dll
    2015-01-07 17:57 - 2015-01-07 17:57 - 02493952 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_MyMedia.dll
    2012-10-15 12:27 - 2012-10-15 12:27 - 00111616 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlc.dll
    2012-10-15 12:28 - 2012-10-15 12:28 - 02286592 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlccore.dll
    2014-12-04 21:32 - 2014-12-04 21:32 - 01056768 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll
    2014-09-11 00:39 - 2014-09-11 00:39 - 00144896 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll
    2015-01-08 22:03 - 2015-01-08 22:03 - 01195008 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll
    2015-01-13 21:45 - 2015-01-13 21:45 - 10388480 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll
    2015-01-14 19:04 - 2015-01-14 19:04 - 02545664 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll
    2014-12-17 23:49 - 2014-12-17 23:49 - 00177152 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll
    2014-12-04 21:35 - 2014-12-04 21:35 - 00890368 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll
    2014-11-05 00:00 - 2014-11-05 00:00 - 00435712 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll
    2013-09-28 17:13 - 2013-09-28 17:13 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qgif.dll
    2013-09-28 17:13 - 2013-09-28 17:13 - 00052224 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qico.dll
    2013-09-28 17:13 - 2013-09-28 17:13 - 00261120 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qjpeg.dll
    2013-09-28 17:13 - 2013-09-28 17:13 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qsvg.dll
    2014-06-29 17:55 - 2014-06-29 17:55 - 00081408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll
    2014-11-03 00:23 - 2014-11-03 00:23 - 00143360 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnoseDll.dll
    2014-06-18 18:22 - 2014-06-18 18:22 - 02177405 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\drivers\libntgr_api.dll
    2014-09-03 22:00 - 2014-09-03 22:00 - 00072192 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SVTUtils.dll
    2014-09-03 22:00 - 2014-09-03 22:00 - 00074240 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\NetcardApi.dll
    2014-09-03 22:00 - 2014-09-03 22:00 - 00136704 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\airprintdll.dll
    2012-10-15 12:28 - 2012-10-15 12:28 - 00219648 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\access\libdshow_plugin.dll
    2012-10-15 12:28 - 2012-10-15 12:28 - 00049664 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libaout_directx_plugin.dll
    2012-10-15 12:28 - 2012-10-15 12:28 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libwaveout_plugin.dll
    2012-10-15 12:28 - 2012-10-15 12:28 - 00070144 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\video_output\libdirectx_plugin.dll
    2013-09-28 17:13 - 2013-09-28 17:13 - 00040960 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\printsupport\windowsprintersupport.dll
    2014-11-04 23:59 - 2014-11-04 23:59 - 00642048 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_Update.dll
    2014-11-05 00:01 - 2014-11-05 00:01 - 00458752 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll
    2014-06-29 18:33 - 2014-06-29 18:33 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupApiPlugin.dll
    2014-09-03 22:00 - 2014-09-03 22:00 - 00066560 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupDll.dll
    2015-04-17 22:18 - 2015-03-04 08:31 - 01070592 _____ () C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libglesv2.dll
    2015-04-17 22:18 - 2015-03-04 08:31 - 00204800 _____ () C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libegl.dll
    2015-04-03 05:21 - 2015-04-03 05:21 - 00003584 _____ () C:\Users\andrew\AppData\Roaming\Nosibay\Bubble Dock\WindowsHook.dll
    2015-04-06 05:57 - 2015-04-06 05:57 - 00099392 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\ManXec.dll
    2015-04-06 05:57 - 2015-04-06 05:57 - 00078912 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\CmdProc.dll
    2015-04-06 05:58 - 2015-04-06 05:58 - 00122432 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\WblSupp.dll
    2015-04-06 05:58 - 2015-04-06 05:58 - 00045120 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\PrfIns.dll
    2015-04-06 05:58 - 2015-04-06 05:58 - 00078912 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\WbSes.dll
    2015-04-06 05:58 - 2015-04-06 05:58 - 00114240 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\WdcMan.dll
    2015-04-06 05:57 - 2015-04-06 05:57 - 00037952 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\InSes.dll
    2015-04-06 05:57 - 2015-04-06 05:57 - 00100416 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\CmnUtls.dll
    2015-04-19 00:24 - 2015-04-19 00:24 - 00011264 _____ () C:\Users\andrew\AppData\Local\Temp\nssEAA1.tmp\System.dll
    2015-04-19 00:24 - 2015-04-19 00:24 - 00013312 _____ () C:\Users\andrew\AppData\Local\Temp\nssEAA1.tmp\UAC.dll
    2015-04-19 00:24 - 2015-04-19 00:24 - 00053248 _____ () C:\Users\andrew\AppData\Local\Temp\nssEAA1.tmp\nsDialogs.dll
    2015-04-17 22:29 - 2015-03-26 06:13 - 01091584 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\libglesv2.dll
    2015-04-17 22:29 - 2015-03-26 06:13 - 00167936 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\libEGL.dll
    2015-04-17 22:29 - 2015-03-26 06:39 - 08569856 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\pdf.dll
    2015-04-17 22:30 - 2015-03-26 06:18 - 00324608 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\ppGoogleNaClPluginChrome.dll
    2015-04-17 22:29 - 2015-03-26 06:14 - 00880128 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\ffmpegsumo.dll
    2015-04-17 22:30 - 2014-09-22 20:07 - 14891848 _____ () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\PepperFlash\pepflashplayer.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\Users\andrew\OneDrive:ms-properties
    AlternateDataStreams: C:\Users\andrew\SkyDrive:ms-properties

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    ==================== EXE Association (whitelisted) ===============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\andrew\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\windows photo viewer wallpaper.jpg
    DNS Servers: 192.168.1.1

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    ==================== Accounts: =============================

    Administrator (S-1-5-21-1751677316-1340614493-3878152295-500 - Administrator - Disabled) => C:\Users\Administrator
    andrew (S-1-5-21-1751677316-1340614493-3878152295-1001 - Administrator - Enabled) => C:\Users\andrew
    Guest (S-1-5-21-1751677316-1340614493-3878152295-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-1751677316-1340614493-3878152295-1003 - Limited - Enabled)

    ==================== Faulty Device Manager Devices =============

    Name: USB2.0-CRW
    Description: USB2.0-CRW
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (04/18/2015 08:05:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   14 [removed].in-addr.arpa. PTR gor187.local.

    Error: (04/18/2015 08:05:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: mDNSCoreReceiveResponse: Received from 192.168.1.3:5353   16 [removed].in-addr.arpa. PTR gor187-2.local.

    Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 269437

    Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 269437

    Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (04/18/2015 07:37:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 267922

    Error: (04/18/2015 07:37:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 267922

    Error: (04/18/2015 07:37:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (04/18/2015 07:37:16 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 266406

    Error: (04/18/2015 07:37:16 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 266406

    System errors:
    =============
    Error: (04/19/2015 10:02:31 AM) (Source: DCOM) (EventID: 10016) (User: GOR187)
    Description: application-specificLocalActivation{4991D34B-80A1-4291-83B6-3328366B9097}{69AD4AEE-51BE-439B-A92C-86AE490E8B30}gor187andrewS-1-5-21-1751677316-1340614493-3878152295-1001LocalHost (Using LRPC)UnavailableUnavailable

    Error: (04/19/2015 10:00:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Symantec Real Time Storage Protection x64 service failed to start due to the following error:
    %%2

    Error: (04/19/2015 10:00:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Symantec Real Time Storage Protection x64 service failed to start due to the following error:
    %%2

    Error: (04/19/2015 09:54:13 AM) (Source: DCOM) (EventID: 10016) (User: GOR187)
    Description: application-specificLocalActivation{4991D34B-80A1-4291-83B6-3328366B9097}{69AD4AEE-51BE-439B-A92C-86AE490E8B30}gor187andrewS-1-5-21-1751677316-1340614493-3878152295-1001LocalHost (Using LRPC)UnavailableUnavailable

    Error: (04/19/2015 09:45:55 AM) (Source: DCOM) (EventID: 10016) (User: GOR187)
    Description: application-specificLocalActivation{4991D34B-80A1-4291-83B6-3328366B9097}{69AD4AEE-51BE-439B-A92C-86AE490E8B30}gor187andrewS-1-5-21-1751677316-1340614493-3878152295-1001LocalHost (Using LRPC)UnavailableUnavailable

    Error: (04/19/2015 09:38:14 AM) (Source: DCOM) (EventID: 10016) (User: GOR187)
    Description: application-specificLocalActivation{4991D34B-80A1-4291-83B6-3328366B9097}{69AD4AEE-51BE-439B-A92C-86AE490E8B30}gor187andrewS-1-5-21-1751677316-1340614493-3878152295-1001LocalHost (Using LRPC)UnavailableUnavailable

    Error: (04/19/2015 09:30:28 AM) (Source: DCOM) (EventID: 10016) (User: GOR187)
    Description: application-specificLocalActivation{4991D34B-80A1-4291-83B6-3328366B9097}{69AD4AEE-51BE-439B-A92C-86AE490E8B30}gor187andrewS-1-5-21-1751677316-1340614493-3878152295-1001LocalHost (Using LRPC)UnavailableUnavailable

    Error: (04/19/2015 09:22:11 AM) (Source: DCOM) (EventID: 10016) (User: GOR187)
    Description: application-specificLocalActivation{4991D34B-80A1-4291-83B6-3328366B9097}{69AD4AEE-51BE-439B-A92C-86AE490E8B30}gor187andrewS-1-5-21-1751677316-1340614493-3878152295-1001LocalHost (Using LRPC)UnavailableUnavailable

    Error: (04/19/2015 09:13:51 AM) (Source: DCOM) (EventID: 10016) (User: GOR187)
    Description: application-specificLocalActivation{4991D34B-80A1-4291-83B6-3328366B9097}{69AD4AEE-51BE-439B-A92C-86AE490E8B30}gor187andrewS-1-5-21-1751677316-1340614493-3878152295-1001LocalHost (Using LRPC)UnavailableUnavailable

    Error: (04/19/2015 09:05:36 AM) (Source: DCOM) (EventID: 10016) (User: GOR187)
    Description: application-specificLocalActivation{4991D34B-80A1-4291-83B6-3328366B9097}{69AD4AEE-51BE-439B-A92C-86AE490E8B30}gor187andrewS-1-5-21-1751677316-1340614493-3878152295-1001LocalHost (Using LRPC)UnavailableUnavailable

    Microsoft Office Sessions:
    =========================
    Error: (04/18/2015 08:05:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   14 [removed].in-addr.arpa. PTR gor187.local.

    Error: (04/18/2015 08:05:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: mDNSCoreReceiveResponse: Received from 192.168.1.3:5353   16 [removed].in-addr.arpa. PTR gor187-2.local.

    Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 269437

    Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 269437

    Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (04/18/2015 07:37:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 267922

    Error: (04/18/2015 07:37:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 267922

    Error: (04/18/2015 07:37:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (04/18/2015 07:37:16 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 266406

    Error: (04/18/2015 07:37:16 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 266406

    ==================== Memory info ===========================

    Processor: AMD A8-4500M APU with Radeon™ HD Graphics
    Percentage of memory in use: 63%
    Total physical RAM: 3547.09 MB
    Available physical RAM: 1305.24 MB
    Total Pagefile: 7131.09 MB
    Available Pagefile: 3703.76 MB
    Total Virtual: 131072 MB
    Available Virtual: 131071.8 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:442.19 GB) (Free:342.54 GB) NTFS
    Drive d: (Apr 15 2015) (CDROM) (Total:0.04 GB) (Free:0 GB) UDF

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 465.8 GB) (Disk ID: FB7FE604)

    Partition: GPT Partition Type.

    ==================== End Of Log ============================

     

     

     

     

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-04-2015 01
    Ran by [removed] (administrator) on GOR187 on 19-04-2015 10:04:28
    Running from C:\Users\[removed]\Desktop
    [removed] Platform: Windows 8.1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AMD) C:\Windows\System32\atiesrxx.exe
    (AMD) C:\Windows\System32\atieclxx.exe
    (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
    (Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
    (Microsoft Corporation) C:\Windows\System32\dasHost.exe
    () C:\Windows\mtqj.exe
    (NETGEAR) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\nis.exe
    (Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
    () C:\Windows\tqj.exe
    (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
    () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
    () C:\Users\andrew\AppData\Local\gmsd_us_455\upgmsd_us_455.exe
    (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
    (Web Bar Media) C:\Program Files\WebBar\2.0.5582.15558\wb.exe
    () C:\Users\andrew\AppData\Local\Temp\isdkHEWhpNS5\ISightHost.exe
    (Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\nis.exe
    (Qualcomm®Atheros®) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe
    (NETGEAR Inc.) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe
    (Crossbrowse) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
    (Nosibay) C:\Users\andrew\AppData\Roaming\Nosibay\Bubble Dock\LBubble Dock.exe
    (Boost Shopping) C:\Program Files (x86)\Boost\Boost.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    () C:\Program Files (x86)\MixVideoPlayer\BrowserWeb.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    (Crossbrowse) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
    () C:\Program Files (x86)\gmsd_us_455\gmsd_us_455.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Nosibay) C:\Users\andrew\AppData\Roaming\Nosibay\Bubble Dock\Bubble Dock.exe
    (Spotify Ltd) C:\Users\andrew\AppData\Roaming\Spotify\SpotifyWebHelper.exe
    (Microsoft Corporation) C:\Windows\splwow64.exe
    () C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
    () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\gbRunner.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Nosibay) C:\Users\andrew\AppData\Roaming\Store\WindApp\tmp\updates\AddonsUI.exe
    (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
    (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
    (The Chromium Authors) C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Navigate.exe
    (The Chromium Authors) C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Navigate.exe
    (The Chromium Authors) C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Navigate.exe
    (The Chromium Authors) C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Navigate.exe
    (The Chromium Authors) C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Navigate.exe
    (The Chromium Authors) C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Navigate.exe

    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191824 2012-08-10] (Realtek Semiconductor)
    HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
    HKLM\…\Run: [3D BubbleSound] => C:\Program Files\BubbleSound\3D BubbleSound.exe [14115328 2015-01-09] (zik.mu)
    HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-07-04] (Advanced Micro Devices, Inc.)
    HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
    HKLM-x32\…\Run: [] => [X]
    HKLM-x32\…\Run: [gmsd_us_455] => C:\Program Files (x86)\gmsd_us_455\gmsd_us_455.exe [3983304 2015-04-16] ()
    HKLM-x32\…\RunOnce: [upgmsd_us_455.exe] => C:\Users\andrew\AppData\Local\gmsd_us_455\upgmsd_us_455.exe [3304904 2015-04-16] ()
    HKLM\…\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [134784 2014-06-17] ( (Qualcomm®Atheros®))
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [Spotify Web Helper] => C:\Users\andrew\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-04-18] (Spotify Ltd)
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [NETGEARGenie] => C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [602880 2014-12-14] (NETGEAR Inc.)
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [GoogleChromeAutoLaunch_9F0D3DB1E16B7C7BD82A10A451991899] => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe [637440 2015-03-04] (Crossbrowse)
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [Bubble Dock] => C:\Users\andrew\AppData\Roaming\Nosibay\Bubble Dock\LBubble Dock.exe [666384 2015-04-03] (Nosibay)
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [WindApp] => "C:\Users\andrew\AppData\Roaming\Store\WindApp\WindApp.exe" /winstartup
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [Boost] => C:\Program Files (x86)\Boost\Boost.exe [406232 2014-11-18] (Boost Shopping)
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [Spotify] => C:\Users\andrew\AppData\Roaming\Spotify\Spotify.exe [7112248 2015-04-18] (Spotify Ltd)
    AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll File Not Found
    AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll" File Not Found
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WebBrowserMixVideoPlayer.lnk [2015-04-17]
    ShortcutTarget: WebBrowserMixVideoPlayer.lnk -> C:\Program Files (x86)\MixVideoPlayer\BrowserWeb.exe ()
    Startup: C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk [2015-04-17]
    ShortcutTarget: crossbrowse.lnk -> C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe (Crossbrowse)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trovi.com/?gd=&ctid;=CARRIER_ID&octid;=EB_ORIGINAL_CTID&ISID;=ISID_ID&SearchSource;=55&CUI;=SB_CUI&UM;=8&UP;=SP01E81270-6B50-441E-976F-A9A28AD0E2DE
    HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://samsung13.msn.com
    SearchScopes: HKU\S-1-5-21-1751677316-1340614493-3878152295-1001 -> DefaultScope {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
    SearchScopes: HKU\S-1-5-21-1751677316-1340614493-3878152295-1001 -> {19A1DE7B-74BD-4E0D-AFC2-D48CA564CD2B} URL =
    BHO: Boost -> {2299856A-6506-42E3-A34F-CD35A47C1B19} -> C:\Program Files (x86)\Boost\64Boost.dll [2015-02-13] (Boost)
    BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-21] (Microsoft Corporation)
    BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-02-28] (Google Inc.)
    BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-03-21] (Microsoft Corporation)
    BHO-x32: Boost -> {2299856A-6506-42E3-A34F-CD35A47C1B19} -> C:\Program Files (x86)\Boost\Boost.dll [2015-02-13] (Boost)
    BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
    BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL [2015-03-04] (Symantec Corporation)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-02-28] (Google Inc.)
    Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-02-28] (Google Inc.)
    Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-02-28] (Google Inc.)
    Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-03-21] (Microsoft Corporation)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

    FireFox:
    ========
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-03-21] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-23] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-23] (Google Inc.)
    FF HKLM-x32\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.5.0.19\coFFPlgn
    FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.5.0.19\coFFPlgn [2015-04-18]

    Chrome:
    =======
    CHR HKLM\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
    CHR HKLM\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\Exts\Chrome.crx [2015-03-21]
    CHR HKLM-x32\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
    CHR HKLM-x32\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\Exts\Chrome.crx [2015-03-21]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-07-04] (Advanced Micro Devices, Inc.) [File not signed]
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
    R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [322176 2014-06-17] (Windows (R) Win 7 DDK provider) [File not signed]
    S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)
    R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
    R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593152 2014-01-29] (Samsung Electronics CO., LTD.)
    R2 mtqj; c:\windows\mtqj.exe [523264 2015-04-17] () [File not signed]
    R2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2014-12-14] (NETGEAR)
    R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\NIS.exe [276336 2015-03-06] (Symantec Corporation)
    R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3000664 2015-01-06] (Samsung Electronics CO., LTD.)
    R2 tqj; c:\windows\tqj.exe [531456 2015-04-17] () [File not signed]
    S2 wbsvc; C:\Program Files\WebBar\wbsvc.exe [37144 2015-04-14] (Web Bar Media)
    S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)
    R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-06-17] (Atheros) [File not signed]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)
    R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
    R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
    R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\BASHDefs\20150408.001\BHDrvx64.sys [1639128 2015-04-08] (Symantec Corporation)
    R3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [223432 2014-06-17] (Qualcomm Atheros)
    R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-06-17] (Qualcomm Atheros)
    R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-11-21] (Microsoft Corporation)
    R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1507000.00B\ccSetx64.sys [162392 2014-02-20] (Symantec Corporation)
    R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2015-01-30] (Symantec Corporation)
    R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2015-01-30] (Symantec Corporation)
    R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\IPSDefs\20150417.001\IDSvia64.sys [671448 2015-04-17] (Symantec Corporation)
    S3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\VirusDefs\20150418.001\ENG64.SYS [129752 2015-01-30] (Symantec Corporation)
    S3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\VirusDefs\20150418.001\EX64.SYS [2137304 2015-01-30] (Symantec Corporation)
    R2 NPF; C:\WINDOWS\system32\drivers\npf.sys [35344 2015-04-17] (CACE Technologies, Inc.)
    R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-30] (Windows (R) Win 7 DDK provider)
    S1 SRTSP; C:\Windows\System32\Drivers\NISx64\1507000.00B\SRTSP64.SYS [876248 2014-08-25] (Symantec Corporation)
    R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1507000.00B\SRTSPX64.SYS [37592 2014-08-25] (Symantec Corporation)
    R0 SymDS; C:\Windows\System32\drivers\NISx64\1507000.00B\SYMDS64.SYS [493656 2014-07-22] (Symantec Corporation)
    R0 SymEFA; C:\Windows\System32\drivers\NISx64\1507000.00B\SYMEFA64.SYS [1148120 2014-07-22] (Symantec Corporation)
    S0 SymELAM; C:\Windows\System32\drivers\NISx64\1507000.00B\SymELAM.sys [23568 2014-07-22] (Symantec Corporation)
    R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-09-15] (Symantec Corporation)
    R1 SymIRON; C:\Windows\system32\drivers\NISx64\1507000.00B\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
    R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1507000.00B\SYMNETS.SYS [593112 2014-07-22] (Symantec Corporation)
    S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-04-19 10:04 - 2015-04-19 10:05 - 00018674 _____ () C:\Users\andrew\Desktop\FRST.txt
    2015-04-19 10:03 - 2015-04-19 10:04 - 00000000 ____D () C:\FRST
    2015-04-19 10:03 - 2015-04-19 10:03 - 02098176 _____ (Farbar) C:\Users\andrew\Desktop\FRST64.exe
    2015-04-19 10:01 - 2015-04-19 10:01 - 02098176 _____ (Farbar) C:\Users\andrew\Downloads\FRST64.exe
    2015-04-18 21:43 - 2015-04-18 21:43 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 228611.crdownload
    2015-04-18 21:42 - 2015-04-18 21:42 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 558319.crdownload
    2015-04-18 21:42 - 2015-04-18 21:42 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 557466.crdownload
    2015-04-18 21:41 - 2015-04-18 21:41 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 475381.crdownload
    2015-04-18 20:05 - 2015-04-18 20:05 - 00000000 ___RD () C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
    2015-04-18 19:58 - 2015-04-18 20:00 - 00988888 _____ () C:\WINDOWS\Minidump\041815-73671-01.dmp
    2015-04-18 19:58 - 2015-04-18 19:58 - 00000000 ____D () C:\WINDOWS\Minidump
    2015-04-18 00:31 - 2015-04-19 10:01 - 00000540 _____ () C:\Users\andrew\Desktop\strange programs accidentally installed - What the Tech.website
    2015-04-18 00:20 - 2015-04-18 00:20 - 00003257 _____ () C:\Users\andrew\Desktop\aswMBR.txt
    2015-04-18 00:20 - 2015-04-18 00:20 - 00000512 _____ () C:\Users\andrew\Desktop\MBR.dat
    2015-04-17 22:30 - 2015-04-17 22:30 - 00000000 ____D () C:\Users\andrew\AppData\Local\Boost
    2015-04-17 22:29 - 2015-04-17 23:20 - 00000000 ____D () C:\Program Files (x86)\Boost
    2015-04-17 22:29 - 2015-04-17 22:29 - 00000875 _____ () C:\Users\andrew\Desktop\3D BubbleSound.lnk
    2015-04-17 22:29 - 2015-04-17 22:29 - 00000000 ____D () C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BubbleSound 1.0
    2015-04-17 22:29 - 2015-04-17 22:29 - 00000000 ____D () C:\Program Files\BubbleSound
    2015-04-17 22:23 - 2015-04-17 22:23 - 00003712 _____ () C:\WINDOWS\System32\Tasks\WindApp Update
    2015-04-17 22:23 - 2015-04-17 22:23 - 00000078 _____ () C:\Users\andrew\AppData\Roaming\WindApp.installation.log
    2015-04-17 22:23 - 2015-04-17 22:23 - 00000000 ____D () C:\Users\andrew\AppData\Roaming\Store
    2015-04-17 22:22 - 2015-04-17 22:22 - 00000000 ____D () C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bubble Dock
    2015-04-17 22:21 - 2015-04-17 23:20 - 00000000 ____D () C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD
    2015-04-17 22:21 - 2015-04-17 22:24 - 00001284 _____ () C:\Users\andrew\AppData\Roaming\Bubble Dock.boostrap.log
    2015-04-17 22:21 - 2015-04-17 22:22 - 00005718 _____ () C:\Users\andrew\AppData\Roaming\Bubble Dock.installation.log
    2015-04-17 22:21 - 2015-04-17 22:21 - 00004612 _____ () C:\WINDOWS\System32\Tasks\GB Runner
    2015-04-17 22:21 - 2015-04-17 22:21 - 00000097 _____ () C:\Users\andrew\AppData\Roaming\WindApp.boostrap.log
    2015-04-17 22:21 - 2015-04-17 22:21 - 00000000 ____D () C:\Users\andrew\AppData\Roaming\Nosibay
    2015-04-17 22:21 - 2015-04-17 22:21 - 00000000 ____D () C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games Bot
    2015-04-17 22:20 - 2015-04-17 22:21 - 00000000 ___HD () C:\ProgramData\tqj
    2015-04-17 22:19 - 2015-04-19 08:05 - 00000000 ____D () C:\Users\andrew\AppData\Local\gmsd_us_455
    2015-04-17 22:19 - 2015-04-17 23:20 - 00000000 ____D () C:\Program Files (x86)\gmsd_us_455
    2015-04-17 22:18 - 2015-04-19 04:18 - 00001072 _____ () C:\WINDOWS\Tasks\Crossbrowse.job
    2015-04-17 22:18 - 2015-04-17 22:18 - 00004070 _____ () C:\WINDOWS\System32\Tasks\Crossbrowse
    2015-04-17 22:18 - 2015-04-17 22:18 - 00002418 _____ () C:\Users\Public\Desktop\Crossbrowse.lnk
    2015-04-17 22:18 - 2015-04-17 22:18 - 00000000 ____D () C:\Users\andrew\AppData\Local\Crossbrowse
    2015-04-17 22:18 - 2015-04-17 22:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
    2015-04-17 22:17 - 2015-04-17 22:18 - 00000000 ____D () C:\Users\andrew\AppData\Local\mixvideoplayer
    2015-04-17 22:17 - 2015-04-17 22:17 - 00000000 ____D () C:\Program Files (x86)\Crossbrowse
    2015-04-17 22:16 - 2015-04-18 00:12 - 00000000 ____D () C:\Users\andrew\AppData\Local\WebBar
    2015-04-17 22:16 - 2015-04-17 22:17 - 00745984 _____ () C:\WINDOWS\tqj.dat
    2015-04-17 22:16 - 2015-04-17 22:16 - 00523264 _____ () C:\WINDOWS\mtqj.exe
    2015-04-17 22:16 - 2015-04-17 22:16 - 00001977 _____ () C:\Users\andrew\Desktop\MixVideoPlayer.lnk
    2015-04-17 22:16 - 2015-04-17 22:16 - 00001977 _____ () C:\Users\Administrator\Desktop\MixVideoPlayer.lnk
    2015-04-17 22:16 - 2015-04-17 22:16 - 00000000 ____D () C:\Users\andrew\AppData\Local\BrowserWeb
    2015-04-17 22:16 - 2015-04-17 22:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MixVideoPlayer
    2015-04-17 22:16 - 2015-04-17 22:16 - 00000000 ____D () C:\ProgramData\InstallSightSDK
    2015-04-17 22:11 - 2015-04-17 22:16 - 00531456 _____ () C:\WINDOWS\tqj.exe
    2015-04-17 22:11 - 2015-04-17 22:12 - 00000000 ____D () C:\Program Files (x86)\Setup Support for Consumer Input
    2015-04-17 22:11 - 2015-04-17 22:11 - 00003784 _____ () C:\WINDOWS\System32\Tasks\WebBarUpdateTask
    2015-04-17 22:11 - 2015-04-17 22:11 - 00003260 _____ () C:\WINDOWS\System32\Tasks\WebBarLaunchTask
    2015-04-17 22:11 - 2015-04-17 22:11 - 00000000 ____D () C:\Users\andrew\AppData\Local\CrashRpt
    2015-04-17 22:10 - 2015-04-19 10:00 - 00000000 ____D () C:\Program Files (x86)\MixVideoPlayer
    2015-04-17 22:10 - 2015-04-17 22:10 - 00000000 ____D () C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RinoReader
    2015-04-17 22:10 - 2015-04-17 22:10 - 00000000 ____D () C:\Program Files\WebBar
    2015-04-17 22:10 - 2015-04-17 22:10 - 00000000 ____D () C:\Program Files (x86)\RinoReader
    2015-04-17 22:04 - 2015-04-17 22:45 - 00000000 ____D () C:\Users\andrew\AppData\Local\NETGEARGenie
    2015-04-17 22:04 - 2015-04-17 22:04 - 00369168 _____ (CACE Technologies, Inc.) C:\WINDOWS\system32\wpcap.dll
    2015-04-17 22:04 - 2015-04-17 22:04 - 00281104 _____ (CACE Technologies, Inc.) C:\WINDOWS\SysWOW64\wpcap.dll
    2015-04-17 22:04 - 2015-04-17 22:04 - 00106000 _____ (CACE Technologies, Inc.) C:\WINDOWS\system32\packet.dll
    2015-04-17 22:04 - 2015-04-17 22:04 - 00096784 _____ (CACE Technologies, Inc.) C:\WINDOWS\SysWOW64\packet.dll
    2015-04-17 22:04 - 2015-04-17 22:04 - 00035344 _____ (CACE Technologies, Inc.) C:\WINDOWS\system32\Drivers\npf.sys
    2015-04-17 22:04 - 2015-04-17 22:04 - 00002082 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR Genie.lnk
    2015-04-17 22:04 - 2015-04-17 22:04 - 00002070 _____ () C:\Users\Public\Desktop\NETGEAR Genie.lnk
    2015-04-17 22:03 - 2015-04-17 22:03 - 00000000 ____D () C:\Program Files (x86)\NETGEAR Genie
    2015-04-17 22:01 - 2015-04-17 22:01 - 39316824 _____ (NETGEAR Inc.) C:\Users\andrew\Downloads\NETGEARGenie-install.exe
    2015-04-11 01:13 - 2015-04-11 01:19 - 00000000 ____D () C:\Users\andrew\Documents\movies
    2015-04-11 01:11 - 2015-04-11 01:11 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
    2015-03-25 03:33 - 2015-03-10 18:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
    2015-03-25 03:33 - 2015-03-10 14:08 - 01107456 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
    2015-03-25 03:33 - 2015-03-10 14:08 - 00943104 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
    2015-03-25 03:33 - 2015-03-10 14:08 - 00760320 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
    2015-03-25 03:33 - 2015-03-10 14:08 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
    2015-03-25 03:33 - 2015-03-10 14:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
    2015-03-25 03:33 - 2015-03-10 14:08 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
    2015-03-22 19:33 - 2015-03-22 19:33 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security
    2015-03-22 18:16 - 2015-04-01 23:05 - 00004970 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for GOR187-andrew gor187
    2015-03-22 17:39 - 2015-03-22 17:39 - 00000000 __RHD () C:\MSOCache
    2015-03-22 00:26 - 2015-03-22 19:33 - 00003094 _____ () C:\WINDOWS\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1751677316-1340614493-3878152295-1001
    2015-03-22 00:26 - 2015-03-22 00:26 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
    2015-03-21 21:36 - 2015-03-21 21:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
    2015-03-21 20:47 - 2015-03-21 22:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
    2015-03-21 20:09 - 2015-03-21 20:11 - 00000000 ____D () C:\Program Files\Microsoft Office 15
    2015-03-21 19:01 - 2015-03-21 19:02 - 04318293 _____ () C:\Users\andrew\Downloads\Here is the police report ).zip

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-04-19 10:02 - 2014-11-21 00:44 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
    2015-04-19 10:00 - 2015-02-19 14:07 - 00000000 ____D () C:\Users\andrew\AppData\Local\Spotify
    2015-04-19 10:00 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\system32\sru
    2015-04-19 09:56 - 2015-02-23 10:45 - 00000920 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    2015-04-19 09:25 - 2015-02-10 19:08 - 01856023 _____ () C:\WINDOWS\WindowsUpdate.log
    2015-04-19 08:53 - 2015-02-10 20:05 - 00003922 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{FAD04B69-92B1-416D-BD45-ABB8EE38BB6A}
    2015-04-19 05:30 - 2015-02-19 13:57 - 00000000 ____D () C:\Users\andrew\AppData\Roaming\Spotify
    2015-04-18 20:16 - 2014-07-08 23:51 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1751677316-1340614493-3878152295-1001
    2015-04-18 20:07 - 2014-07-09 00:22 - 00000000 ____D () C:\ProgramData\WinClon
    2015-04-18 20:07 - 2012-07-26 00:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
    2015-04-18 20:05 - 2015-02-19 14:07 - 00001854 _____ () C:\Users\andrew\Desktop\Spotify.lnk
    2015-04-18 20:05 - 2015-02-19 14:07 - 00001840 _____ () C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
    2015-04-18 20:03 - 2015-02-23 10:45 - 00000916 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    2015-04-18 20:02 - 2015-02-10 19:54 - 00000000 ___RD () C:\Users\andrew\OneDrive
    2015-04-18 20:01 - 2015-02-10 19:20 - 00000000 ____D () C:\Users\andrew
    2015-04-18 20:00 - 2013-08-22 06:46 - 00331478 _____ () C:\WINDOWS\setupact.log
    2015-04-18 20:00 - 2013-08-22 06:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
    2015-04-18 19:58 - 2014-09-29 19:06 - 604408142 _____ () C:\WINDOWS\MEMORY.DMP
    2015-04-18 07:34 - 2015-03-09 16:53 - 00000000 ____D () C:\Users\andrew\AppData\Local\CrashDumps
    2015-04-18 03:59 - 2015-02-23 10:46 - 00002203 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2015-04-17 23:57 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
    2015-04-17 23:49 - 2014-07-08 23:44 - 00000000 ____D () C:\Users\andrew\AppData\Local\VirtualStore
    2015-04-17 23:45 - 2013-08-22 05:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
    2015-04-17 23:43 - 2014-11-21 00:34 - 00014430 _____ () C:\WINDOWS\PFRO.log
    2015-04-17 23:42 - 2013-08-22 05:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
    2015-04-17 22:39 - 2012-07-25 23:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
    2015-04-17 22:38 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
    2015-03-25 14:58 - 2015-02-03 05:20 - 00000000 ____D () C:\WINDOWS\system32\appraiser
    2015-03-25 14:58 - 2014-11-21 07:56 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
    2015-03-22 21:36 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\rescache
    2015-03-22 19:27 - 2014-09-23 17:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
    2015-03-22 19:27 - 2014-09-15 05:13 - 00002521 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
    2015-03-22 19:27 - 2014-07-09 00:32 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
    2015-03-22 19:27 - 2014-07-09 00:28 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64
    2015-03-22 19:22 - 2013-08-22 06:44 - 00481880 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
    2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ___RD () C:\WINDOWS\ToastData
    2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\WinStore
    2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ____D () C:\Program Files\Windows Defender
    2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
    2015-03-21 19:48 - 2013-08-09 20:40 - 00003424 ____H () C:\Users\andrew\Documents\~WRL1202.tmp

    ==================== Files in the root of some directories =======

    2015-04-17 22:21 - 2015-04-17 22:24 - 0001284 _____ () C:\Users\andrew\AppData\Roaming\Bubble Dock.boostrap.log
    2015-04-17 22:21 - 2015-04-17 22:22 - 0005718 _____ () C:\Users\andrew\AppData\Roaming\Bubble Dock.installation.log
    2015-04-17 22:21 - 2015-04-17 22:21 - 0000097 _____ () C:\Users\andrew\AppData\Roaming\WindApp.boostrap.log
    2015-04-17 22:23 - 2015-04-17 22:23 - 0000078 _____ () C:\Users\andrew\AppData\Roaming\WindApp.installation.log
    2015-02-23 10:42 - 2015-02-23 10:42 - 0000057 _____ () C:\ProgramData\Ament.ini
    2014-07-09 00:52 - 2013-02-21 15:59 - 2063240 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe
    2014-07-09 00:52 - 2013-01-12 22:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml

    Files to move or delete:
    ====================
    C:\ProgramData\MakeMarkerFile.exe

    Some content of TEMP:
    ====================
    C:\Users\andrew\AppData\Local\Temp\9485.exe
    C:\Users\andrew\AppData\Local\Temp\cw.exe

    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2015-04-19 06:38

    ==================== End Of Log ============================

    Post #4

    You have a lot going on, run these programs in the order listed and post the log from each

     

     
    -AdwCleaner-by Xplode
     
    Click on this link to download : ADWCleaner To your Desktop
    Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
    Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
     
     
    Do not click on any links in the top Advertisment.
     
    [external image: AdwCleaner4.201_zpsxrbk2llq.jpg]
     
    • Close all open programs and internet browsers.
    • Double click on AdwCleaner.exe to run the tool.
    • Click on Scan.
    • After the scan is complete click on "Clean"
    • Confirm each time with Ok.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the content of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
      •  
       
      ===============================================================================
       
       
      [external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.
      • Shut down your protection software now to avoid potential conflicts.
      • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
      • The tool will open and start scanning your system.
      • Please be patient as this can take a while to complete depending on your system's specifications.
      • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
      • Post the contents of JRT.txt into your next message.
        •  
         
         
        ===============================================================================
         
        Download Malwarebytes' Anti-Malware  to your desktop. <———
         
        • Windows XP : Double click on the icon to run it.
        • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
          •  
          [external image: MBAM2.1.4_zpsnwqgubkb.jpg]
           
          • On the Dashboard click on Update Now
          • Go to the Setting Tab
          • Under Setting go to Detection and Protection
          • Under PUP and PUM make sure both are set to show Treat Detections as Malware
          • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
          • Then on the Dashboard click on Scan
          • Make sure to select THREAT SCAN
          • Then click on Scan
          • When the scan is finished and the log pops up…select Copy to Clipboard
          • Please paste the log back into this thread for review
          • Exit Malwarebytes
            • Post #5

            # AdwCleaner v4.201 - Logfile created 19/04/2015 at 15:30:01
            # Updated 08/04/2015 by Xplode
            # Database : 2015-04-19.4 [Server]
            # Operating system : Windows 8.1  (x64)
            # Username : andrew - GOR187
            # Running from : C:\Users\andrew\Desktop\adwcleaner_4.201.exe
            # Option : Cleaning

            ***** [ Services ] *****

            [#] Service Deleted : wbsvc

            ***** [ Files / Folders ] *****

            Folder Deleted : C:\ProgramData\InstallSightSDK
            Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GAMESDESKTOP
            Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
            Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MixVideoPlayer
            Folder Deleted : C:\Program Files (x86)\Boost
            Folder Deleted : C:\Program Files (x86)\Crossbrowse
            Folder Deleted : C:\Program Files (x86)\MixVideoPlayer
            Folder Deleted : C:\Program Files (x86)\RinoReader
            Folder Deleted : C:\Program Files (x86)\gmsd_us_455
            Folder Deleted : C:\Program Files\WebBar
            Folder Deleted : C:\Program Files\BubbleSound
            Folder Deleted : C:\Users\andrew\AppData\Local\Boost
            Folder Deleted : C:\Users\andrew\AppData\Local\WebBar
            Folder Deleted : C:\Users\andrew\AppData\Local\Crossbrowse
            Folder Deleted : C:\Users\andrew\AppData\Local\MixVideoPlayer
            Folder Deleted : C:\Users\andrew\AppData\Local\BrowserWeb
            Folder Deleted : C:\Users\andrew\AppData\Local\gmsd_us_455
            Folder Deleted : C:\Users\andrew\AppData\Roaming\Nosibay
            Folder Deleted : C:\Users\andrew\AppData\Roaming\Store
            Folder Deleted : C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bubble Dock
            Folder Deleted : C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BubbleSound 1.0
            Folder Deleted : C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games Bot
            Folder Deleted : C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RinoReader
            File Deleted : C:\Users\Public\Desktop\crossbrowse.lnk
            File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WebBrowserMixVideoPlayer.lnk
            File Deleted : C:\Users\Administrator\Desktop\MixVideoPlayer.lnk
            File Deleted : C:\Users\andrew\AppData\Roaming\Bubble Dock.boostrap.log
            File Deleted : C:\Users\andrew\AppData\Roaming\Bubble Dock.installation.log
            File Deleted : C:\Users\andrew\AppData\Roaming\WindApp.boostrap.log
            File Deleted : C:\Users\andrew\AppData\Roaming\WindApp.installation.log
            File Deleted : C:\Users\andrew\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\crossbrowse.lnk
            File Deleted : C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk
            File Deleted : C:\Users\andrew\Desktop\3D BubbleSound.lnk
            File Deleted : C:\Users\andrew\Desktop\MixVideoPlayer.lnk

            ***** [ Scheduled tasks ] *****

            # AdwCleaner v4.201 - Logfile created 19/04/2015 at 16:15:16
            # Updated 08/04/2015 by Xplode
            # Database : 2015-04-19.4 [Server]
            # Operating system : Windows 8.1  (x64)
            # Username : andrew - GOR187
            # Running from : C:\Users\andrew\Desktop\adwcleaner_4.201.exe
            # Option : Cleaning

            ***** [ Services ] *****

            ***** [ Files / Folders ] *****

            ***** [ Scheduled tasks ] *****

            Task Deleted : Crossbrowse
            Task Deleted : GB Runner
            Task Deleted : WebBarLaunchTask
            Task Deleted : WebBarUpdateTask

            ***** [ Shortcuts ] *****

            ***** [ Registry ] *****

            Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Bubble Dock]
            Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [WindApp]
            Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
            Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
            Key Deleted : HKLM\SOFTWARE\CLASSES\Boost.BoostBho.1
            Key Deleted : HKLM\SOFTWARE\CLASSES\Boost.BoostBho
            Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Boost]
            Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\MixVideoPlayerUpdaterService
            Key Deleted : HKLM\SOFTWARE\Microsoft\Mediaplayer\Shiminclusionlist\crossbrowse.exe
            Key Deleted : HKLM\SOFTWARE\Classes\CRSBRWSHTML
            Key Deleted : HKLM\SOFTWARE\Clients\StartMenuInternet\Crossbrowse
            Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\crossbrowse.exe
            Key Deleted : HKLM\SOFTWARE\5424C600-B68F-B141-B9D6-E7E5262C14DD
            Key Deleted : HKLM\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}
            Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2299856A-6506-42E3-A34F-CD35A47C1B19}
            Key Deleted : HKLM\SOFTWARE\Classes\Interface\{88C20E16-1EB7-40CE-820C-6CFCB41B1D2F}
            Key Deleted : HKLM\SOFTWARE\Classes\Interface\{41634761-D0BA-4C1A-9AC2-04AEE9511370}
            Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E860F65C-6645-411C-A662-E12E25FD3A93}
            Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2299856A-6506-42E3-A34F-CD35A47C1B19}
            Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2299856A-6506-42E3-A34F-CD35A47C1B19}
            Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2299856A-6506-42E3-A34F-CD35A47C1B19}
            Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{2299856A-6506-42E3-A34F-CD35A47C1B19}
            Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{88C20E16-1EB7-40CE-820C-6CFCB41B1D2F}
            Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{41634761-D0BA-4C1A-9AC2-04AEE9511370}
            Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2299856A-6506-42E3-A34F-CD35A47C1B19}
            Key Deleted : HKCU\Software\Boost
            Key Deleted : HKCU\Software\Nosibay
            Key Deleted : HKCU\Software\Store
            Key Deleted : HKCU\Software\Tutorials
            Key Deleted : HKCU\Software\TutoTag
            Key Deleted : HKCU\Software\GAMESDESKTOP
            Key Deleted : HKCU\Software\CrossBrowser
            Key Deleted : HKCU\Software\CommunityCrawlingService
            Key Deleted : HKCU\Software\Crossbrowse
            Key Deleted : HKCU\Software\RinoReader
            Key Deleted : HKCU\Software\AppDataLow\Software\Boost
            Key Deleted : HKLM\SOFTWARE\Boost
            Key Deleted : HKLM\SOFTWARE\Tutorials
            Key Deleted : HKLM\SOFTWARE\GAMESDESKTOP
            Key Deleted : HKLM\SOFTWARE\MixVideoPlayer
            Key Deleted : HKLM\SOFTWARE\CommunityCrawlingService
            Key Deleted : HKLM\SOFTWARE\Games Bot
            Key Deleted : HKLM\SOFTWARE\Crossbrowse
            Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Bubble Dock
            Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\windapp
            Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Boost
            Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Setup Support for Consumer Input
            Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixVideoPlayer
            Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Crossbrowse
            Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RinoReader
            Key Deleted : [x64] HKLM\SOFTWARE\BubbleSound
            Key Deleted : [x64] HKLM\SOFTWARE\WebBar
            Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0BCE8B0A-1E76-44E5-9909-3CF804D92E4D}_is1
            Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BubbleSound
            Data Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll
            Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll
            Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

            ***** [ Web browsers ] *****

            -\\ Internet Explorer v11.0.9600.17416

            Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

            *************************

            AdwCleaner[R0].txt - [13706 bytes] - [19/04/2015 15:26:47]
            AdwCleaner[R1].txt - [5282 bytes] - [19/04/2015 15:49:40]
            AdwCleaner[S0].txt - [7814 bytes] - [19/04/2015 15:30:01]

            ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7873  bytes] ##########

             

            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            Junkware Removal Tool (JRT) by Thisisu
            Version: 6.5.8 (04.17.2015:1)
            OS: Windows 8.1 x64
            Ran by [removed] on Sun 04/19/2015 at 16:25:22.95
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

             

            ~~~ Services

             

            ~~~ Tasks

             

            ~~~ Registry Values

             

            ~~~ Registry Keys

             

            ~~~ Files

             

            ~~~ Folders

             

             

            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            Scan was completed on Sun 04/19/2015 at 16:28:42.15
            End of JRT log
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

             

            Malwarebytes Anti-Malware
            www.malwarebytes.org

            Scan Date: 4/19/2015
            Scan Time: 4:38:27 PM
            Logfile:
            Administrator: Yes

            Version: 2.01.4.1018
            Malware Database: v2015.04.19.05
            Rootkit Database: v2015.03.31.01
            License: Trial
            Malware Protection: Enabled
            Malicious Website Protection: Enabled
            Self-protection: Disabled

            OS: Windows 8.1
            CPU: x64
            File System: NTFS
            User: andrew

            Scan Type: Threat Scan
            Result: Completed
            Objects Scanned: 383176
            Time Elapsed: 21 min, 30 sec

            Memory: Enabled
            Startup: Enabled
            Filesystem: Enabled
            Archives: Enabled
            Rootkits: Disabled
            Heuristics: Enabled
            PUP: Enabled
            PUM: Enabled

            Processes: 2
            PUP.Optional.Core.A, C:\Windows\mtqj.exe, 4280, , [a6cb5f0f90fa77bf77bb24d1d23360a0]
            PUP.Optional.Core.A, C:\Windows\tqj.exe, 3832, , [2b46c0aeb5d5122413200de8a06520e0]

            Modules: 0
            (No malicious items detected)

            Registry Keys: 6
            PUP.Optional.Core.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\mtqj, , [a6cb5f0f90fa77bf77bb24d1d23360a0],
            PUP.Optional.Core.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\tqj, , [2b46c0aeb5d5122413200de8a06520e0],
            PUP.Optional.GamesBot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\5424C600-B68F-B141-B9D6-E7E5262C14DD, , [adc4006e37535ed8d8e3a78f56ac5ea2],
            PUP.Optional.RinoReader.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RinoReader.exe, , [ee83026c0783cd695146af113fc45ca4],
            PUP.Optional.RinoReader.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RinoReader.exe, , [b2bf98d6f298ae88e1b6dfe1fd062bd5],
            PUP.Optional.GamesDesktop.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\gmsd_us_455_is1, , [373a0a6491f9e94de1a67c575ca78b75],

            Registry Values: 1
            PUP.Optional.GamesDesktop.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|gmsd_us_455, "C:\Program Files (x86)\gmsd_us_455\gmsd_us_455.exe", , [9dd40a649ded67cf48428f44a85bd729]

            Registry Data: 0
            (No malicious items detected)

            Folders: 9
            PUP.Optional.WebBar.A, C:\Windows\System32\config\systemprofile\AppData\Local\WebBar, , [01706a045c2e8fa749c99d232bd829d7],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Dictionaries, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\PepperFlash, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Data, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.ConsumerInput.A, C:\Program Files (x86)\Setup Support for Consumer Input, , [b7bac4aa11790234a13aceecb152be42],

            Files: 109
            PUP.Optional.Core.A, C:\Windows\mtqj.exe, , [a6cb5f0f90fa77bf77bb24d1d23360a0],
            PUP.Optional.Core.A, C:\Windows\tqj.exe, , [2b46c0aeb5d5122413200de8a06520e0],
            PUP.Optional.Nosibay.A, C:\ProgramData\tqj\2E4C81559F814F5D8707E9FFE555F6E7\setup.exe, , [472ad49a800a46f0fb9ccf6dc046fe02],
            PUP.Optional.GamesBot.A, C:\ProgramData\tqj\5900C3A3CF2B4A0F88E75D3C42392435\setup.exe, , [1061fd713951bd799d1eaf8724de629e],
            PUP.Optional.Tuto4PC.A, C:\Users\andrew\AppData\Local\Temp\is-6T0UC.tmp\gentlemjmp_ieeuu.exe, , [3041432bb9d13afccbb844f8976f1ae6],
            PUP.Optional.Alerts.A, C:\Users\andrew\AppData\Local\Temp\c9d55bdc-9da0-4b1d-95fe-4bdab8a3b19f\setup.exe, , [85ec571733578fa7f80346f64bb740c0],
            PUP.Optional.Tuto4PC.A, C:\Users\andrew\AppData\Local\Temp\cbc72fda-5b22-4f63-a18d-f2058db6b290\games desktop.exe, , [cda4610dd6b475c1067d48f46b9b827e],
            PUP.Optional.MixVideoPlayer.A, C:\Users\andrew\AppData\Local\Temp\f207f811-46c1-427c-8b0d-27bdaa0a9347\mixvideoplayersetup.exe, , [2150214d137751e5d11f6906fe027d83],
            PUP.Optional.RinoReader.A, C:\Users\andrew\AppData\Local\Temp\f49fabe0-2a59-42dd-aa1e-ecce0d398c15\setup.exe, , [93de88e6137746f01a20fe75946c5fa1],
            PUP.Optional.WebBar.A, C:\Users\andrew\AppData\Local\Temp\5a09cedf-62ce-4971-98cd-256492958917\web_bar_setup.exe, , [f0817ef038522016807a7ebedb2714ec],
            PUP.Optional.GamesBot.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\uninstall.exe, , [adc4006e37535ed8d8e3a78f56ac5ea2],
            PUP.Optional.WebBar.A, C:\Windows\System32\config\systemprofile\AppData\Local\WebBar\wb.log, , [01706a045c2e8fa749c99d232bd829d7],
            PUP.Optional.GamesBot.A, C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\GB Update, , [145d610d6d1dec4a4d4ffac90cf713ed],
            PUP.Optional.Nosibay.A, C:\Windows\System32\Tasks\WindApp Update, , [422f036bb6d4f73f0d66f3f1778c50b0],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\resources.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\37.0.2062.124.manifest, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\chrome.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\chrome_100_percent.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\chrome_200_percent.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\chrome_child.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\chrome_elf.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\d3dcompiler_46.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\ffmpegsumo.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\icudtl.dat, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\libEGL.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\libexif.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\libGLESv2.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\metro_driver.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\nacl_irt_x86_32.nexe, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\nacl_irt_x86_64.nexe, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Navigate.exe, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\pdf.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\ppGoogleNaClPluginChrome.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\SecondaryTile.png, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\wow_helper.exe, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\Dictionaries\en-US-3-0.bdic, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\hi.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\am.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ar.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\bg.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\bn.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ca.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\cs.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\da.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\de.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\el.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\en-GB.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\en-US.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\es-419.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\es.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\et.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\fa.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\fi.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\fil.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\fr.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\gu.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\he.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\hr.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\hu.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\id.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\it.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ja.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\kn.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ko.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\lt.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\lv.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ml.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\mr.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ms.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\nb.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\nl.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\pl.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\pt-BR.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\pt-PT.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ro.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ru.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\sk.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\sl.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\sr.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\sv.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\sw.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\ta.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\te.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\th.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\tr.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\uk.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\vi.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\zh-CN.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\locales\zh-TW.pak, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\PepperFlash\manifest.json, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Navigate\PepperFlash\pepflashplayer.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Games Bot.exe.config, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\msvcp110.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\msvcr110.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\System.Data.SQLite.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Data\ExtJoul.dat, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Data\ExtLoSt.dat, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Data\ResPack6.bin, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\7z.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\CmdProc.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\CmlProc.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\CmnUtls.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\InSes.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\ManXec.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\NavSupp.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\PrfIns.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\WblSupp.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\WbSes.dll, , [82ef432b1f6be3536b9ce074e124817f],
            PUP.Optional.GigaClicks.A, C:\Users\andrew\AppData\Local\5424C600-B68F-B141-B9D6-E7E5262C14DD\Modules\WdcMan.dll, , [82ef432b1f6be3536b9ce074e124817f],

            Physical Sectors: 0
            (No malicious items detected)

            (end)

            Post #6

            Lots of garbage removed, but did you have Malwarebytes remove all it found, it usually says after each line that it was in quarantine, if not run Malwarebytes again and have it remove it all, all that stuff is bad and needs the boot

             

            After Malwarebytes comes back clean, open FRST64, make sure to checkmark Additions, run a new scan and post both the FRST64 log and the Additions log

            Post #7

            Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-04-2015 01
            Ran by [removed] (administrator) on GOR187 on 19-04-2015 19:06:30
            Running from C:\Users\[removed]\Desktop
            [removed] Platform: Windows 8.1 (X64) OS Language: English (United States)
            Internet Explorer Version 11 (Default browser: IE)
            Boot Mode: Normal
            Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

            ==================== Processes (Whitelisted) =================

            (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

            (AMD) C:\Windows\System32\atiesrxx.exe
            (AMD) C:\Windows\System32\atieclxx.exe
            (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
            (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
            (Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
            (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
            (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
            (Microsoft Corporation) C:\Windows\System32\dasHost.exe
            (Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
            (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
            (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
            (NETGEAR) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe
            (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\nis.exe
            (Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
            (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
            () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
            (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
            (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\nis.exe
            (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
            (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
            (Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
            (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
            (Qualcomm®Atheros®) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
            (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
            (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
            () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
            (AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe
            (Spotify Ltd) C:\Users\andrew\AppData\Roaming\Spotify\SpotifyWebHelper.exe
            (NETGEAR Inc.) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe
            (Spotify Ltd) C:\Users\andrew\AppData\Roaming\Spotify\Spotify.exe
            (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
            (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
            (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
            () C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
            (Spotify Ltd) C:\Users\andrew\AppData\Roaming\Spotify\SpotifyCrashService.exe
            (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
            (Microsoft Corporation) C:\Windows\splwow64.exe
            (Spotify Ltd) C:\Users\andrew\AppData\Roaming\Spotify\Spotify.exe
            (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
            (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
            (Spotify Ltd) C:\Users\andrew\AppData\Roaming\Spotify\Spotify.exe
            (Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
            (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

            ==================== Registry (Whitelisted) ==================

            (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

            HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191824 2012-08-10] (Realtek Semiconductor)
            HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
            HKLM\…\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"
            HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-07-04] (Advanced Micro Devices, Inc.)
            HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
            HKLM-x32\…\Run: [] => [X]
            HKLM\…\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [134784 2014-06-17] ( (Qualcomm®Atheros®))
            HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
            HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [Spotify Web Helper] => C:\Users\andrew\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-04-18] (Spotify Ltd)
            HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [NETGEARGenie] => C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [602880 2014-12-14] (NETGEAR Inc.)
            HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [GoogleChromeAutoLaunch_9F0D3DB1E16B7C7BD82A10A451991899] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" –no-startup-window
            HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Run: [Spotify] => C:\Users\andrew\AppData\Roaming\Spotify\Spotify.exe [7112248 2015-04-18] (Spotify Ltd)

            ==================== Internet (Whitelisted) ====================

            (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

            HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://samsung13.msn.com
            SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
            SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
            SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
            SearchScopes: HKU\S-1-5-21-1751677316-1340614493-3878152295-1001 -> {19A1DE7B-74BD-4E0D-AFC2-D48CA564CD2B} URL =
            BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-21] (Microsoft Corporation)
            BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
            BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-02-28] (Google Inc.)
            BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-03-21] (Microsoft Corporation)
            BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
            BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL [2015-03-04] (Symantec Corporation)
            BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-02-28] (Google Inc.)
            Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
            Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-02-28] (Google Inc.)
            Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
            Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-02-28] (Google Inc.)
            Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-03-21] (Microsoft Corporation)
            Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

            FireFox:
            ========
            FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
            FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-03-21] (Microsoft Corporation)
            FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-23] (Google Inc.)
            FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-23] (Google Inc.)
            FF HKLM-x32\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.5.0.19\coFFPlgn
            FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.5.0.19\coFFPlgn [2015-04-19]

            Chrome:
            =======
            CHR HKLM\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
            CHR HKLM\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\Exts\Chrome.crx [2015-03-21]
            CHR HKLM-x32\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
            CHR HKLM-x32\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\Exts\Chrome.crx [2015-03-21]

            ==================== Services (Whitelisted) =================

            (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

            R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-07-04] (Advanced Micro Devices, Inc.) [File not signed]
            R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
            R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [322176 2014-06-17] (Windows (R) Win 7 DDK provider) [File not signed]
            S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)
            R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
            R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593152 2014-01-29] (Samsung Electronics CO., LTD.)
            R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
            R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
            R2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2014-12-14] (NETGEAR)
            R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\NIS.exe [276336 2015-03-06] (Symantec Corporation)
            R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3000664 2015-01-06] (Samsung Electronics CO., LTD.)
            S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
            S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)
            R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-06-17] (Atheros) [File not signed]

            ==================== Drivers (Whitelisted) ====================

            (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

            R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)
            R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
            R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
            R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\BASHDefs\20150408.001\BHDrvx64.sys [1639128 2015-04-08] (Symantec Corporation)
            R3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [223432 2014-06-17] (Qualcomm Atheros)
            R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-06-17] (Qualcomm Atheros)
            R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-11-21] (Microsoft Corporation)
            R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1507000.00B\ccSetx64.sys [162392 2014-02-20] (Symantec Corporation)
            R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2015-01-30] (Symantec Corporation)
            R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2015-01-30] (Symantec Corporation)
            R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\IPSDefs\20150417.001\IDSvia64.sys [671448 2015-04-17] (Symantec Corporation)
            R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
            R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-19] (Malwarebytes Corporation)
            R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)
            R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\VirusDefs\20150419.002\ENG64.SYS [129752 2015-01-30] (Symantec Corporation)
            R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.5.0.19\Definitions\VirusDefs\20150419.002\EX64.SYS [2137304 2015-01-30] (Symantec Corporation)
            R2 NPF; C:\WINDOWS\system32\drivers\npf.sys [35344 2015-04-17] (CACE Technologies, Inc.)
            R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-30] (Windows (R) Win 7 DDK provider)
            R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1507000.00B\SRTSP64.SYS [876248 2014-08-25] (Symantec Corporation)
            R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1507000.00B\SRTSPX64.SYS [37592 2014-08-25] (Symantec Corporation)
            R0 SymDS; C:\Windows\System32\drivers\NISx64\1507000.00B\SYMDS64.SYS [493656 2014-07-22] (Symantec Corporation)
            R0 SymEFA; C:\Windows\System32\drivers\NISx64\1507000.00B\SYMEFA64.SYS [1148120 2014-07-22] (Symantec Corporation)
            S0 SymELAM; C:\Windows\System32\drivers\NISx64\1507000.00B\SymELAM.sys [23568 2014-07-22] (Symantec Corporation)
            R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-09-15] (Symantec Corporation)
            R1 SymIRON; C:\Windows\system32\drivers\NISx64\1507000.00B\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
            R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1507000.00B\SYMNETS.SYS [593112 2014-07-22] (Symantec Corporation)
            S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)

            ==================== NetSvcs (Whitelisted) ===================

            (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

            ==================== One Month Created Files and Folders ========

            (If an entry is included in the fixlist, the file\folder will be moved.)

            2015-04-19 18:59 - 2015-04-19 18:59 - 00000000 ___RD () C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
            2015-04-19 16:36 - 2015-04-19 18:58 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
            2015-04-19 16:36 - 2015-04-19 16:36 - 00001118 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
            2015-04-19 16:36 - 2015-04-19 16:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
            2015-04-19 16:36 - 2015-04-19 16:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
            2015-04-19 16:36 - 2015-04-19 16:36 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
            2015-04-19 16:36 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
            2015-04-19 16:36 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
            2015-04-19 16:36 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
            2015-04-19 16:34 - 2015-04-19 16:34 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\andrew\Desktop\mbam-setup-2.1.4.1018.exe
            2015-04-19 16:28 - 2015-04-19 16:28 - 00000598 _____ () C:\Users\andrew\Desktop\JRT.txt
            2015-04-19 16:25 - 2015-04-19 16:25 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-GOR187-Windows-8.1-(64-bit).dat
            2015-04-19 16:25 - 2015-04-19 16:25 - 00000000 ____D () C:\RegBackup
            2015-04-19 16:23 - 2015-04-19 16:23 - 02686254 _____ (Thisisu) C:\Users\andrew\Desktop\JRT.exe
            2015-04-19 15:26 - 2015-04-19 16:15 - 00000000 ____D () C:\AdwCleaner
            2015-04-19 15:20 - 2015-04-19 15:20 - 02217984 _____ () C:\Users\andrew\Desktop\adwcleaner_4.201.exe
            2015-04-19 10:06 - 2015-04-19 10:07 - 00034266 _____ () C:\Users\andrew\Desktop\Addition.txt
            2015-04-19 10:04 - 2015-04-19 19:06 - 00016067 _____ () C:\Users\andrew\Desktop\FRST.txt
            2015-04-19 10:03 - 2015-04-19 19:06 - 00000000 ____D () C:\FRST
            2015-04-19 10:03 - 2015-04-19 10:03 - 02098176 _____ (Farbar) C:\Users\andrew\Desktop\FRST64.exe
            2015-04-19 10:01 - 2015-04-19 10:01 - 02098176 _____ (Farbar) C:\Users\andrew\Downloads\FRST64.exe
            2015-04-18 21:43 - 2015-04-18 21:43 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 228611.crdownload
            2015-04-18 21:42 - 2015-04-18 21:42 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 558319.crdownload
            2015-04-18 21:42 - 2015-04-18 21:42 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 557466.crdownload
            2015-04-18 21:41 - 2015-04-18 21:41 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 475381.crdownload
            2015-04-18 19:58 - 2015-04-18 20:00 - 00988888 _____ () C:\WINDOWS\Minidump\041815-73671-01.dmp
            2015-04-18 19:58 - 2015-04-18 19:58 - 00000000 ____D () C:\WINDOWS\Minidump
            2015-04-18 00:31 - 2015-04-19 16:22 - 00000540 _____ () C:\Users\andrew\Desktop\strange programs accidentally installed - What the Tech.website
            2015-04-18 00:20 - 2015-04-18 00:20 - 00003257 _____ () C:\Users\andrew\Desktop\aswMBR.txt
            2015-04-18 00:20 - 2015-04-18 00:20 - 00000512 _____ () C:\Users\andrew\Desktop\MBR.dat
            2015-04-17 22:20 - 2015-04-17 22:21 - 00000000 ___HD () C:\ProgramData\tqj
            2015-04-17 22:16 - 2015-04-17 22:17 - 00745984 _____ () C:\WINDOWS\tqj.dat
            2015-04-17 22:11 - 2015-04-17 22:11 - 00000000 ____D () C:\Users\andrew\AppData\Local\CrashRpt
            2015-04-17 22:04 - 2015-04-17 22:45 - 00000000 ____D () C:\Users\andrew\AppData\Local\NETGEARGenie
            2015-04-17 22:04 - 2015-04-17 22:04 - 00369168 _____ (CACE Technologies, Inc.) C:\WINDOWS\system32\wpcap.dll
            2015-04-17 22:04 - 2015-04-17 22:04 - 00281104 _____ (CACE Technologies, Inc.) C:\WINDOWS\SysWOW64\wpcap.dll
            2015-04-17 22:04 - 2015-04-17 22:04 - 00106000 _____ (CACE Technologies, Inc.) C:\WINDOWS\system32\packet.dll
            2015-04-17 22:04 - 2015-04-17 22:04 - 00096784 _____ (CACE Technologies, Inc.) C:\WINDOWS\SysWOW64\packet.dll
            2015-04-17 22:04 - 2015-04-17 22:04 - 00035344 _____ (CACE Technologies, Inc.) C:\WINDOWS\system32\Drivers\npf.sys
            2015-04-17 22:04 - 2015-04-17 22:04 - 00002082 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR Genie.lnk
            2015-04-17 22:04 - 2015-04-17 22:04 - 00002070 _____ () C:\Users\Public\Desktop\NETGEAR Genie.lnk
            2015-04-17 22:03 - 2015-04-17 22:03 - 00000000 ____D () C:\Program Files (x86)\NETGEAR Genie
            2015-04-17 22:01 - 2015-04-17 22:01 - 39316824 _____ (NETGEAR Inc.) C:\Users\andrew\Downloads\NETGEARGenie-install.exe
            2015-04-11 01:13 - 2015-04-11 01:19 - 00000000 ____D () C:\Users\andrew\Documents\movies
            2015-04-11 01:11 - 2015-04-11 01:11 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
            2015-03-25 03:33 - 2015-03-10 18:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
            2015-03-25 03:33 - 2015-03-10 14:08 - 01107456 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
            2015-03-25 03:33 - 2015-03-10 14:08 - 00943104 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
            2015-03-25 03:33 - 2015-03-10 14:08 - 00760320 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
            2015-03-25 03:33 - 2015-03-10 14:08 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
            2015-03-25 03:33 - 2015-03-10 14:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
            2015-03-25 03:33 - 2015-03-10 14:08 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
            2015-03-22 19:33 - 2015-03-22 19:33 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security
            2015-03-22 18:16 - 2015-04-01 23:05 - 00004970 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for GOR187-andrew gor187
            2015-03-22 17:39 - 2015-03-22 17:39 - 00000000 __RHD () C:\MSOCache
            2015-03-22 00:26 - 2015-03-22 19:33 - 00003094 _____ () C:\WINDOWS\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1751677316-1340614493-3878152295-1001
            2015-03-22 00:26 - 2015-03-22 00:26 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
            2015-03-21 21:36 - 2015-03-21 21:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
            2015-03-21 20:47 - 2015-03-21 22:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
            2015-03-21 20:09 - 2015-03-21 20:11 - 00000000 ____D () C:\Program Files\Microsoft Office 15
            2015-03-21 19:01 - 2015-03-21 19:02 - 04318293 _____ () C:\Users\andrew\Downloads\Here is the police report ).zip

            ==================== One Month Modified Files and Folders =======

            (If an entry is included in the fixlist, the file\folder will be moved.)

            2015-04-19 19:04 - 2015-02-19 13:57 - 00000000 ____D () C:\Users\andrew\AppData\Roaming\Spotify
            2015-04-19 19:02 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\system32\sru
            2015-04-19 19:01 - 2014-07-09 00:22 - 00000000 ____D () C:\ProgramData\WinClon
            2015-04-19 19:00 - 2015-02-10 19:08 - 02087354 _____ () C:\WINDOWS\WindowsUpdate.log
            2015-04-19 18:59 - 2015-02-19 14:07 - 00000000 ____D () C:\Users\andrew\AppData\Local\Spotify
            2015-04-19 18:58 - 2015-02-23 10:45 - 00000916 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
            2015-04-19 18:58 - 2015-02-10 19:54 - 00000000 ___RD () C:\Users\andrew\OneDrive
            2015-04-19 18:56 - 2015-02-23 10:45 - 00000920 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
            2015-04-19 18:55 - 2014-11-21 00:34 - 00051804 _____ () C:\WINDOWS\PFRO.log
            2015-04-19 18:55 - 2013-08-22 06:46 - 00331786 _____ () C:\WINDOWS\setupact.log
            2015-04-19 18:55 - 2013-08-22 06:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
            2015-04-19 18:55 - 2012-07-26 00:12 - 00000000 ____D () C:\WINDOWS\TAPI
            2015-04-19 17:00 - 2014-07-08 23:51 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1751677316-1340614493-3878152295-1001
            2015-04-19 16:24 - 2014-11-21 00:44 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
            2015-04-19 16:15 - 2015-02-10 19:20 - 00000000 ____D () C:\Users\andrew
            2015-04-19 10:12 - 2012-07-26 00:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
            2015-04-19 10:11 - 2013-08-22 05:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
            2015-04-19 08:53 - 2015-02-10 20:05 - 00003922 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{FAD04B69-92B1-416D-BD45-ABB8EE38BB6A}
            2015-04-18 20:05 - 2015-02-19 14:07 - 00001854 _____ () C:\Users\andrew\Desktop\Spotify.lnk
            2015-04-18 20:05 - 2015-02-19 14:07 - 00001840 _____ () C:\Users\andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
            2015-04-18 19:58 - 2014-09-29 19:06 - 604408142 _____ () C:\WINDOWS\MEMORY.DMP
            2015-04-18 07:34 - 2015-03-09 16:53 - 00000000 ____D () C:\Users\andrew\AppData\Local\CrashDumps
            2015-04-18 03:59 - 2015-02-23 10:46 - 00002203 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
            2015-04-17 23:57 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
            2015-04-17 23:49 - 2014-07-08 23:44 - 00000000 ____D () C:\Users\andrew\AppData\Local\VirtualStore
            2015-04-17 23:45 - 2013-08-22 05:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
            2015-04-17 22:39 - 2012-07-25 23:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
            2015-04-17 22:38 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
            2015-03-25 14:58 - 2015-02-03 05:20 - 00000000 ____D () C:\WINDOWS\system32\appraiser
            2015-03-25 14:58 - 2014-11-21 07:56 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
            2015-03-22 21:36 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\rescache
            2015-03-22 19:27 - 2014-09-23 17:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
            2015-03-22 19:27 - 2014-09-15 05:13 - 00002521 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
            2015-03-22 19:27 - 2014-07-09 00:32 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
            2015-03-22 19:27 - 2014-07-09 00:28 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64
            2015-03-22 19:22 - 2013-08-22 06:44 - 00481880 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
            2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ___RD () C:\WINDOWS\ToastData
            2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
            2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
            2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
            2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\WinStore
            2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ____D () C:\Program Files\Windows Defender
            2015-03-22 19:16 - 2013-08-22 07:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
            2015-03-21 19:48 - 2013-08-09 20:40 - 00003424 ____H () C:\Users\andrew\Documents\~WRL1202.tmp

            ==================== Files in the root of some directories =======

            2015-02-23 10:42 - 2015-02-23 10:42 - 0000057 _____ () C:\ProgramData\Ament.ini
            2014-07-09 00:52 - 2013-02-21 15:59 - 2063240 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe
            2014-07-09 00:52 - 2013-01-12 22:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml

            Files to move or delete:
            ====================
            C:\ProgramData\MakeMarkerFile.exe

            Some content of TEMP:
            ====================
            C:\Users\andrew\AppData\Local\Temp\9485.exe
            C:\Users\andrew\AppData\Local\Temp\cw.exe
            C:\Users\andrew\AppData\Local\Temp\Quarantine.exe
            C:\Users\andrew\AppData\Local\Temp\sqlite3.dll

            ==================== Bamital & volsnap Check =================

            (There is no automatic fix for files that do not pass verification.)

            C:\Windows\System32\winlogon.exe => File is digitally signed
            C:\Windows\System32\wininit.exe => File is digitally signed
            C:\Windows\explorer.exe => File is digitally signed
            C:\Windows\SysWOW64\explorer.exe => File is digitally signed
            C:\Windows\System32\svchost.exe => File is digitally signed
            C:\Windows\SysWOW64\svchost.exe => File is digitally signed
            C:\Windows\System32\services.exe => File is digitally signed
            C:\Windows\System32\User32.dll => File is digitally signed
            C:\Windows\SysWOW64\User32.dll => File is digitally signed
            C:\Windows\System32\userinit.exe => File is digitally signed
            C:\Windows\SysWOW64\userinit.exe => File is digitally signed
            C:\Windows\System32\rpcss.dll => File is digitally signed
            C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

            LastRegBack: 2015-04-19 17:01

            ==================== End Of Log ============================

             

            Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-04-2015 01
            Ran by [removed] at 2015-04-19 19:07:34
            Running from C:\Users\[removed]\Desktop
            Boot Mode: Normal
            ==========================================================

            ==================== Security Center ========================

            (If an entry is included in the fixlist, it will be removed.)

            AV: Norton Internet Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
            AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
            AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
            AS: Norton Internet Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
            FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

            ==================== Installed Programs ======================

            (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

            AMD Catalyst Install Manager (HKLM\…\{403A4E7A-D239-04D8-6A3D-31DD203C018D}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
            AMD Quick Stream (HKLM\…\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.3.26.0 - AppEx Networks)
            Apple Application Support (32-bit) (HKLM-x32\…\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
            Apple Application Support (64-bit) (HKLM\…\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)
            Apple Mobile Device Support (HKLM\…\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
            Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
            Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
            Catalyst Control Center (HKLM-x32\…\WUCCCApp) (Version: 1.00.0000 - AMD)
            Google Chrome (HKLM-x32\…\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
            Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
            Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
            Google Update Helper (x32 Version: 1.3.21.115 - Google Inc.) Hidden
            Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
            HP Deskjet 2540 series Basic Device Software (HKLM\…\{7AF1A318-2914-41CC-9B24-041C2D4AAAD7}) (Version: 32.0.1180.44630 - Hewlett-Packard Co.)
            HP Deskjet 2540 series Help (HKLM-x32\…\{4539575D-C09D-4E71-B207-0F2D6BD74DA2}) (Version: 30.0.0 - Hewlett Packard)
            HP FWUpdateEDO2 (HKLM-x32\…\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
            HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.7702 - HP)
            HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
            HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
            iTunes (HKLM\…\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.)
            Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
            Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4701.1002 - Microsoft Corporation)
            Microsoft OneDrive (HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation)
            Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
            Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
            Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
            Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
            Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\…\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
            Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
            NETGEAR Genie (HKLM-x32\…\NETGEAR Genie) (Version: 2.3.1.57 - NETGEAR Inc.)
            Norton Internet Security (HKLM-x32\…\NIS) (Version: 21.7.0.11 - Symantec Corporation)
            Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
            Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
            Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
            Product Improvement Study for HP Deskjet 2540 series (HKLM\…\{446CCB22-B632-4A1D-BF84-DA8DB0575F98}) (Version: 32.0.1180.44630 - Hewlett-Packard Co.)
            Qualcomm Atheros Bluetooth Suite (64) (HKLM\…\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.326 - Qualcomm Atheros Communications)
            Qualcomm Atheros Client Installation Program (HKLM-x32\…\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
            Quick Starter (HKLM\…\{EC36E2BC-86F7-44C9-84B2-93930F0FBDBF}) (Version: 1.0.2 - Samsung Electronics CO., LTD.)
            Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
            Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6702 - Realtek Semiconductor Corp.)
            Recovery (HKLM-x32\…\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 6.0.12.18 - Samsung Electronics CO., LTD.)
            S Agent (Version: 1.1.51 - Samsung Electronics CO., LTD.) Hidden
            S Service (HKLM-x32\…\{E8336EA1-40A2-48A1-80E8-B78F9EEAB23F}) (Version: 1.0 - Samsung Electronics CO., LTD.)
            Settings (HKLM-x32\…\{8CB5C357-12E5-41B1-A024-D57D4E6F32D9}) (Version: 2.0.1 - Samsung Electronics CO., LTD.)
            Spotify (HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\…\Spotify) (Version: 1.0.3.101.gbfa97dfe - Spotify AB)
            SW Update (HKLM-x32\…\{1687FC01-135F-4ADE-B828-B461CC74BD8A}) (Version: 2.2.4 - Samsung Electronics CO., LTD.)
            Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 16.2.14.2 - Synaptics Incorporated)

            ==================== Custom CLSID (selected items): ==========================

            (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

            CustomCLSID: HKU\S-1-5-21-1751677316-1340614493-3878152295-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\andrew\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation)

            ==================== Restore Points  =========================

            25-03-2015 14:57:53 Windows Modules Installer
            13-04-2015 19:24:40 Scheduled Checkpoint

            ==================== Hosts content: ==========================

            (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

            2013-08-22 05:25 - 2013-08-22 05:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

            ==================== Scheduled Tasks (whitelisted) =============

            (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

            Task: {12FF7081-97BB-422F-9E9F-F2CAD5077601} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\WSCStub.exe [2015-03-06] (Symantec Corporation)
            Task: {1EEB80E1-B157-4972-89A9-EE59B16A4D58} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)
            Task: {33EEB0EC-99C1-4B5E-8005-953F7B376985} - System32\Tasks\Microsoft Office 15 Sync Maintenance for GOR187-andrew gor187 => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-03-21] (Microsoft Corporation)
            Task: {340F8891-ACE9-4A6D-84E4-9BEEAD3AD8F2} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)
            Task: {3584AE33-DEA2-4000-AF63-6A623DC8E164} - System32\Tasks\HPCustParticipation HP Deskjet 2540 series => C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPCustPartic.exe [2013-08-13] (Hewlett-Packard Co.)
            Task: {38139C0A-E82B-445C-8A72-D33AFE62D376} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2014-11-12] (SEC)
            Task: {437C7B97-0A13-4B0A-B6BA-D01E12596E11} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-03-21] (Microsoft Corporation)
            Task: {43EEA8ED-6A46-4999-8376-15737CE434DB} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1751677316-1340614493-3878152295-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
            Task: {658370A7-D6BE-47F9-A494-79D24A9A090B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
            Task: {6B7D8568-0A2A-4CAB-85E6-02B4C21B37D0} - \WindApp Update No Task File <==== ATTENTION
            Task: {6D5CE944-75BA-44F0-A4DB-A8995C68F77B} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2014-01-29] (Samsung Electronics CO., LTD.)
            Task: {7AF9AA23-DF94-4AE0-9847-E8618853984C} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2014-10-29] (Samsung Electronics CO., LTD.)
            Task: {990694EA-0C95-4AED-ACB9-225701CC7626} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
            Task: {9B9844A8-312D-4404-8F3A-3A1082C089DD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-23] (Google Inc.)
            Task: {AD2C9E9F-345B-4BAD-9061-5127B24F2FC4} - \Microsoft\Windows\Maintenance\GB Update No Task File <==== ATTENTION
            Task: {B94E8B16-BA83-43DD-94EA-0D5035FDB874} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-17] (Microsoft Corporation)
            Task: {D750C067-6DFE-4CCB-A57E-109EE9DAFD10} - \avaavaxvyy No Task File <==== ATTENTION
            Task: {D7E558A8-191D-4328-A100-0D49E30EB4E4} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-10-16] (Synaptics Incorporated)
            Task: {E3DDFC57-082E-47F9-BAC2-B31529C90081} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
            Task: {ED60959B-ECE4-4B13-9790-8581A0C576BD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-23] (Google Inc.)
            Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

            ==================== Loaded Modules (whitelisted) ==============

            2014-07-04 22:33 - 2014-07-04 22:33 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
            2015-02-13 05:20 - 2015-02-13 05:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
            2015-02-13 05:20 - 2015-02-13 05:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
            2015-03-21 20:09 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00084800 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
            2015-03-21 22:22 - 2015-03-21 22:22 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
            2014-06-17 09:32 - 2014-06-17 09:32 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
            2014-06-17 09:29 - 2014-06-17 09:29 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
            2014-06-17 09:35 - 2014-06-17 09:35 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
            2014-12-14 18:27 - 2014-12-14 18:27 - 00105216 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
            2014-07-04 22:33 - 2014-07-04 22:33 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
            2014-10-29 18:19 - 2014-10-29 18:19 - 00088624 _____ () C:\Program Files\Samsung\S Agent\ToastX64.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00027968 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 01141056 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00109888 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00025920 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00109888 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00059712 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll
            2014-01-29 12:20 - 2014-01-29 12:20 - 00102720 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll
            2013-09-28 17:13 - 2013-09-28 17:13 - 00544817 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libgcc_s_dw2-1.dll
            2013-09-28 17:13 - 2013-09-28 17:13 - 00989805 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libstdc++-6.dll
            2013-09-28 17:14 - 2013-09-28 17:14 - 03369922 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuin51.dll
            2013-09-28 17:14 - 2013-09-28 17:14 - 01978690 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuuc51.dll
            2013-09-28 17:14 - 2013-09-28 17:14 - 22378434 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icudt51.dll
            2013-09-28 17:14 - 2013-09-28 17:14 - 01233408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\platforms\qwindows.dll
            2015-01-08 22:40 - 2015-01-08 22:40 - 00640000 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll
            2014-12-18 22:03 - 2014-12-18 22:03 - 01686016 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll
            2015-01-08 22:01 - 2015-01-08 22:01 - 00192512 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll
            2014-11-04 23:37 - 2014-11-04 23:37 - 00632832 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll
            2015-01-08 22:03 - 2015-01-08 22:03 - 06477824 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll
            2014-06-29 17:55 - 2014-06-29 17:55 - 00068608 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll
            2014-06-29 18:05 - 2014-06-29 18:05 - 01183232 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\qwt.dll
            2015-01-07 17:57 - 2015-01-07 17:57 - 02493952 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_MyMedia.dll
            2012-10-15 12:27 - 2012-10-15 12:27 - 00111616 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlc.dll
            2012-10-15 12:28 - 2012-10-15 12:28 - 02286592 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlccore.dll
            2014-12-04 21:32 - 2014-12-04 21:32 - 01056768 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll
            2014-09-11 00:39 - 2014-09-11 00:39 - 00144896 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll
            2015-01-08 22:03 - 2015-01-08 22:03 - 01195008 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll
            2015-01-13 21:45 - 2015-01-13 21:45 - 10388480 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll
            2015-01-14 19:04 - 2015-01-14 19:04 - 02545664 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll
            2014-12-17 23:49 - 2014-12-17 23:49 - 00177152 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll
            2014-12-04 21:35 - 2014-12-04 21:35 - 00890368 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll
            2014-11-05 00:00 - 2014-11-05 00:00 - 00435712 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll
            2013-09-28 17:13 - 2013-09-28 17:13 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qgif.dll
            2013-09-28 17:13 - 2013-09-28 17:13 - 00052224 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qico.dll
            2013-09-28 17:13 - 2013-09-28 17:13 - 00261120 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qjpeg.dll
            2013-09-28 17:13 - 2013-09-28 17:13 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qsvg.dll
            2014-06-29 17:55 - 2014-06-29 17:55 - 00081408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll
            2014-11-03 00:23 - 2014-11-03 00:23 - 00143360 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnoseDll.dll
            2014-06-18 18:22 - 2014-06-18 18:22 - 02177405 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\drivers\libntgr_api.dll
            2014-09-03 22:00 - 2014-09-03 22:00 - 00072192 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SVTUtils.dll
            2014-09-03 22:00 - 2014-09-03 22:00 - 00074240 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\NetcardApi.dll
            2014-09-03 22:00 - 2014-09-03 22:00 - 00136704 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\airprintdll.dll
            2012-10-15 12:28 - 2012-10-15 12:28 - 00219648 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\access\libdshow_plugin.dll
            2012-10-15 12:28 - 2012-10-15 12:28 - 00049664 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libaout_directx_plugin.dll
            2012-10-15 12:28 - 2012-10-15 12:28 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libwaveout_plugin.dll
            2012-10-15 12:28 - 2012-10-15 12:28 - 00070144 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\video_output\libdirectx_plugin.dll
            2013-09-28 17:13 - 2013-09-28 17:13 - 00040960 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\printsupport\windowsprintersupport.dll
            2014-11-04 23:59 - 2014-11-04 23:59 - 00642048 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_Update.dll
            2014-11-05 00:01 - 2014-11-05 00:01 - 00458752 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll
            2014-06-29 18:33 - 2014-06-29 18:33 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupApiPlugin.dll
            2014-09-03 22:00 - 2014-09-03 22:00 - 00066560 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupDll.dll
            2015-03-22 19:25 - 2015-04-18 20:05 - 40506936 _____ () C:\Users\andrew\AppData\Roaming\Spotify\libcef.dll
            2015-03-22 19:25 - 2015-04-18 20:05 - 01365560 _____ () C:\Users\andrew\AppData\Roaming\Spotify\libglesv2.dll
            2015-03-22 19:25 - 2015-04-18 20:05 - 00219192 _____ () C:\Users\andrew\AppData\Roaming\Spotify\libegl.dll
            2015-03-22 19:25 - 2015-03-22 19:25 - 09305656 _____ () C:\Users\andrew\AppData\Roaming\Spotify\pdf.dll
            2015-03-22 19:25 - 2015-04-18 20:05 - 00990776 _____ () C:\Users\andrew\AppData\Roaming\Spotify\ffmpegsumo.dll

            ==================== Alternate Data Streams (whitelisted) =========

            (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

            AlternateDataStreams: C:\Users\andrew\OneDrive:ms-properties
            AlternateDataStreams: C:\Users\andrew\SkyDrive:ms-properties

            ==================== Safe Mode (whitelisted) ===================

            (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

            ==================== EXE Association (whitelisted) ===============

            (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

            ==================== Other Areas ============================

            (Currently there is no automatic fix for this section.)

            HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\andrew\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\windows photo viewer wallpaper.jpg
            DNS Servers: 192.168.1.1

            ==================== MSCONFIG/TASK MANAGER disabled items ==

            (Currently there is no automatic fix for this section.)

            ==================== Accounts: =============================

            Administrator (S-1-5-21-1751677316-1340614493-3878152295-500 - Administrator - Disabled) => C:\Users\Administrator
            andrew (S-1-5-21-1751677316-1340614493-3878152295-1001 - Administrator - Enabled) => C:\Users\andrew
            Guest (S-1-5-21-1751677316-1340614493-3878152295-501 - Limited - Disabled)
            HomeGroupUser$ (S-1-5-21-1751677316-1340614493-3878152295-1003 - Limited - Enabled)

            ==================== Faulty Device Manager Devices =============

            Name: USB2.0-CRW
            Description: USB2.0-CRW
            Class Guid:
            Manufacturer:
            Service:
            Problem: : The drivers for this device are not installed. (Code 28)
            Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

            ==================== Event log errors: =========================

            Application errors:
            ==================
            Error: (04/19/2015 06:58:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   14 [removed].in-addr.arpa. PTR gor187.local.

            Error: (04/19/2015 06:58:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Received from 192.168.1.3:5353   16 [removed].in-addr.arpa. PTR gor187-2.local.

            Error: (04/19/2015 04:22:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   14 [removed].in-addr.arpa. PTR gor187.local.

            Error: (04/19/2015 04:22:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Received from 192.168.1.3:5353   16 [removed].in-addr.arpa. PTR gor187-2.local.

            Error: (04/18/2015 08:05:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   14 [removed].in-addr.arpa. PTR gor187.local.

            Error: (04/18/2015 08:05:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Received from 192.168.1.3:5353   16 [removed].in-addr.arpa. PTR gor187-2.local.

            Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: Task Scheduling Error: m->NextScheduledSPRetry 269437

            Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: Task Scheduling Error: m->NextScheduledEvent 269437

            Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: Task Scheduling Error: Continuously busy for more than a second

            Error: (04/18/2015 07:37:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: Task Scheduling Error: m->NextScheduledSPRetry 267922

            System errors:
            =============
            Error: (04/19/2015 04:26:03 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
            Description: The Windows Modules Installer service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.

            Error: (04/19/2015 04:26:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
            Description: The iPod Service service terminated unexpectedly.  It has done this 1 time(s).

            Error: (04/19/2015 04:26:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
            Description: The Windows Media Player Network Sharing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.

            Error: (04/19/2015 04:26:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
            Description: The ZAtheros Bt and Wlan Coex Agent service terminated unexpectedly.  It has done this 1 time(s).

            Error: (04/19/2015 04:26:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
            Description: The tqj service terminated unexpectedly.  It has done this 1 time(s).

            Error: (04/19/2015 04:26:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
            Description: The SW Update Service service terminated unexpectedly.  It has done this 1 time(s).

            Error: (04/19/2015 04:26:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
            Description: The NETGEARGenieDaemon service terminated unexpectedly.  It has done this 1 time(s).

            Error: (04/19/2015 04:25:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
            Description: The mtqj service terminated unexpectedly.  It has done this 1 time(s).

            Error: (04/19/2015 04:25:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
            Description: The Easy Launcher service terminated unexpectedly.  It has done this 1 time(s).

            Error: (04/19/2015 04:25:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
            Description: The Microsoft Office ClickToRun Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.

            Microsoft Office Sessions:
            =========================
            Error: (04/19/2015 06:58:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   14 [removed].in-addr.arpa. PTR gor187.local.

            Error: (04/19/2015 06:58:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Received from 192.168.1.3:5353   16 [removed].in-addr.arpa. PTR gor187-2.local.

            Error: (04/19/2015 04:22:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   14 [removed].in-addr.arpa. PTR gor187.local.

            Error: (04/19/2015 04:22:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Received from 192.168.1.3:5353   16 [removed].in-addr.arpa. PTR gor187-2.local.

            Error: (04/18/2015 08:05:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   14 [removed].in-addr.arpa. PTR gor187.local.

            Error: (04/18/2015 08:05:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: mDNSCoreReceiveResponse: Received from 192.168.1.3:5353   16 [removed].in-addr.arpa. PTR gor187-2.local.

            Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: Task Scheduling Error: m->NextScheduledSPRetry 269437

            Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: Task Scheduling Error: m->NextScheduledEvent 269437

            Error: (04/18/2015 07:37:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: Task Scheduling Error: Continuously busy for more than a second

            Error: (04/18/2015 07:37:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
            Description: Task Scheduling Error: m->NextScheduledSPRetry 267922

            ==================== Memory info ===========================

            Processor: AMD A8-4500M APU with Radeon™ HD Graphics
            Percentage of memory in use: 46%
            Total physical RAM: 3547.09 MB
            Available physical RAM: 1914.54 MB
            Total Pagefile: 7131.09 MB
            Available Pagefile: 5144.92 MB
            Total Virtual: 131072 MB
            Available Virtual: 131071.84 MB

            ==================== Drives ================================

            Drive c: () (Fixed) (Total:442.19 GB) (Free:342.1 GB) NTFS

            ==================== MBR & Partition Table ==================

            ========================================================
            Disk: 0 (Size: 465.8 GB) (Disk ID: FB7FE604)

            Partition: GPT Partition Type.

            ==================== End Of Log ============================

            Post #8

            Good  Morning

             

            I am attaching a FIXLIST file, you need to download it to your desktop where you now have FRST64 or the fix wont work, use your mouse to drag FIXLIST right next to FRST64, either above or below it but not right on top of it, after its downloaded open up FRST64 and click on FIX (Not Scan) it wont take long, after your computer reboots you will find a FIXLOG file on your desktop, post it please and let me know how your system is behaving now

            Attachments:

            Post #9

            Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-04-2015
            Ran by [removed] at 2015-04-20 12:16:31 Run:1
            Running from C:\Users\[removed]\Desktop
            [removed] Boot Mode: Normal
            ==============================================

            Content of fixlist:
            *****************
            Start
            CreateRestorePoint:
            CloseProcesses:
            HKLM\…\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"
            SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
            SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
            SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
            SearchScopes: HKU\S-1-5-21-1751677316-1340614493-3878152295-1001 -> {19A1DE7B-74BD-4E0D-AFC2-D48CA564CD2B} URL =
            2015-04-18 21:43 - 2015-04-18 21:43 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 228611.crdownload
            2015-04-18 21:42 - 2015-04-18 21:42 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 558319.crdownload
            2015-04-18 21:42 - 2015-04-18 21:42 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 557466.crdownload
            2015-04-18 21:41 - 2015-04-18 21:41 - 00550808 _____ (BetOnSoft N.V.) C:\Users\andrew\Downloads\Unconfirmed 475381.crdownload
            Task: {6B7D8568-0A2A-4CAB-85E6-02B4C21B37D0} - \WindApp Update No Task File <==== ATTENTION
            Task: {AD2C9E9F-345B-4BAD-9061-5127B24F2FC4} - \Microsoft\Windows\Maintenance\GB Update No Task File <==== ATTENTION
            Task: {D750C067-6DFE-4CCB-A57E-109EE9DAFD10} - \avaavaxvyy No Task File <==== ATTENTION
            CMD: ipconfig /flushdns
            Hosts:
            EmptyTemp:
            End

             

             

             

             

            *****************

            Restore point was successfully created.
            Processes closed successfully.
            HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\3D BubbleSound => value deleted successfully.
            HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
            HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
            HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
            "HKU\S-1-5-21-1751677316-1340614493-3878152295-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{19A1DE7B-74BD-4E0D-AFC2-D48CA564CD2B}" => Key deleted successfully.
            HKCR\CLSID\{19A1DE7B-74BD-4E0D-AFC2-D48CA564CD2B} => Key not found.
            C:\Users\andrew\Downloads\Unconfirmed 228611.crdownload => Moved successfully.
            C:\Users\andrew\Downloads\Unconfirmed 558319.crdownload => Moved successfully.
            C:\Users\andrew\Downloads\Unconfirmed 557466.crdownload => Moved successfully.
            C:\Users\andrew\Downloads\Unconfirmed 475381.crdownload => Moved successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6B7D8568-0A2A-4CAB-85E6-02B4C21B37D0}" => Key deleted successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6B7D8568-0A2A-4CAB-85E6-02B4C21B37D0}" => Key deleted successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WindApp Update" => Key deleted successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AD2C9E9F-345B-4BAD-9061-5127B24F2FC4}" => Key deleted successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AD2C9E9F-345B-4BAD-9061-5127B24F2FC4}" => Key deleted successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Maintenance\GB Update" => Key deleted successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D750C067-6DFE-4CCB-A57E-109EE9DAFD10}" => Key deleted successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D750C067-6DFE-4CCB-A57E-109EE9DAFD10}" => Key deleted successfully.
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avaavaxvyy" => Key deleted successfully.

            =========  ipconfig /flushdns =========

            Windows IP Configuration

            Successfully flushed the DNS Resolver Cache.

            ========= End of CMD: =========

            C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
            Hosts was reset successfully.
            EmptyTemp: => Removed 300.5 MB temporary data.

            The system needed a reboot.

            ==== End of Fixlog 12:17:43 ====

             

             

            the system is running really good now. thank you so much for time and help

            Post #10

            Great

             

            Double click on AdwCleaner.exe to run the tool again.
            • Click on the Uninstall button.
            • Click Yes when asked are you sure you want to uninstall.
            • Both AdwCleaner.exe, its folder and all logs will be removed.
              •  
               
              ==========================================================
               
               
              Please download DelFix and save the file to your Desktop.
               
              [external image: DelFix_zps139e2ea1.jpg]
               
              • Windows XP Double Click DelFix.exe to run the program. 
              • Windows Vista > Win 7 > Win 8 Right Click on DelFix.exe and select RUN AS ADMINISTRATOR 
              • Checkmark " Remove Disinfection Tools"
              • Click the Run button
                •  
                This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually
                 
                 
                 
                ==========================================================
                 
                 
                 
                  How did I get infected in the first place ?    
                  Read these links and find out how to prevent getting infected again.
                • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
                • WhattheTech
                • Grinler BleepingComputer 
                • GeeksTo Go
                • Dslreports
                  •  
                   
                  Safe Surfn
                  Ken

                  Ask AI

                  AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

                  Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI