Spyware / Malware / Virus Removal

Yahoo, pop-ups, and underlines--Oh My! [Solved]

13 min read

Looking for the outcome? Ask AI

ken545

Post #16April 25, 2015, 10:40 AM UTC

Your not letting Malwarebytes remove that item, its the same one showing up over and over again

Go ahead and run the new FRST scan , besure to checkmark Additions and post both new logs

Clstlg

Post #17April 25, 2015, 6:56 PM UTC

Your not letting Malwarebytes remove that item, its the same one showing up over and over again

I clicked everything you told me to?

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2015
Ran by [removed] (administrator) on GOODWINPC on 25-04-2015 11:51:31
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 8 (X64) OS Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(iWin Inc.) C:\Program Files (x86)\iWin Games\iWinTrusted.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(NETGEAR Inc.) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe
() C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR_HIDList.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Farbar) C:\Users\Goodwin\Downloads\FRST64(1).exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2013-10-21] (Hewlett-Packard )
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-10-21] (IDT, Inc.)
HKLM-x32\…\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [BATINDICATOR] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR.exe [2068992 2011-12-14] (Hewlett-Packard)
HKLM-x32\…\Run: [BATINDICATORHL] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR_HIDList.exe [557056 2010-07-23] (Hewlett-Packard)
HKLM-x32\…\Run: [OSDTool] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\CNYHKEY.exe [2101248 2012-06-13] (Hewlett-Packard)
HKLM-x32\…\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)
HKLM-x32\…\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [387832 2013-11-01] (IVT Corporation)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [2889408 2015-04-13] (Valve Corporation)
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [NETGEARGenie] => C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [602880 2014-11-06] (NETGEAR Inc.)
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [PCKeeper2] => "C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe" /autorun
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [AVG-Secure-Search-Update_0215tb] => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe [2794520 2015-02-25] ()
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7806232 2015-03-25] (SUPERAntiSpyware)
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\MountPoints2: {fd88e5da-e8e8-11e3-be9d-689423bdcec6} - "J:\AutoRun.exe"
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\PhotoScreensaver.scr [593408 2012-07-25] (Microsoft Corporation)
Startup: C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 2540 series.lnk [2015-01-23]
ShortcutTarget: Monitor Ink Alerts - HP Deskjet 2540 series.lnk -> C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerReg Scheduler.exe [2013-07-03] ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
SearchScopes: HKLM -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {64800F42-8D73-4AA4-A732-5402AE691582} URL = http://search.yahoo.com/search?p={searchTerms}&fr;=tightropetb&type;=11083
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\IEToolbar64.dll No File
Toolbar: HKLM-x32 - FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\ietoolbar.dll No File
Toolbar: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\IEToolbar64.dll No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\windows\SysWow64\skype4com.dll [2013-11-01] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default
FF DefaultSearchEngine: Yahoo:
FF DefaultSearchEngine.US: Google
FF SelectedSearchEngine: Yahoo:
FF Homepage: hxxp://services.freshy.com/general/newhometab.php?hometab=home&partner;=11083&guid;={596259CD-BACA-4776-9B42-4E8021D67F4E}&i;=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\windows\system32\npDeployJava1.dll [2013-09-29] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-11] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2013-12-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2013-12-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @nsroblox.roblox.com/launcher -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @nsroblox.roblox.com/launcher64 -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Goodwin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-07-20] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF SearchPlugin: C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\searchplugins\yahoo-1.xml [2015-04-19]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\Extensions\[removed] [2015-04-22]
FF Extension: CrushArcade - C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\Extensions\{cf8452e1-0ddb-44d2-95eb-4cb8e7a35707}.xpi [2015-04-21]
FF Extension: Adblock Plus - C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-22]

Chrome:
=======
CHR Profile: C:\Users\Goodwin\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1706744 2013-11-01] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [145656 2013-11-01] (IVT Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35232 2012-08-29] (Hewlett-Packard)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2014-11-06] (NETGEAR)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [333824 2013-10-21] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16024 2015-01-31] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-03] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
U4 BthAvrcpTg; No ImagePath
U4 BthHFEnum; No ImagePath
U4 bthhfhid; No ImagePath
R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [54064 2013-04-26] (Ralink Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)
R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [49584 2013-03-25] (Ralink Corporation)
S3 CpqDfw; C:\Windows\System32\drivers\CpqDfw.sys [27456 2012-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R2 NPF; C:\windows\system32\drivers\npf.sys [35344 2014-11-20] (CACE Technologies, Inc.)
R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [1204424 2013-12-02] (Ralink Technology, Corp.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
S3 cqcpu; system32\drivers\cqcpu.sys [X]
S3 TCFilter; system32\drivers\tcfilter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-25 11:50 - 2015-04-25 11:50 - 02099712 _____ (Farbar) C:\Users\Goodwin\Downloads\FRST64(1).exe
2015-04-24 18:25 - 2015-04-25 11:31 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-24 18:24 - 2015-04-24 18:24 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-04-24 18:24 - 2015-04-24 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-24 18:24 - 2015-04-24 18:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-24 18:24 - 2015-04-24 18:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-04-24 18:24 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-24 18:24 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-24 18:24 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-24 18:21 - 2015-04-24 18:24 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Goodwin\Downloads\mbam-setup-2.1.6.1022(1).exe
2015-04-24 18:20 - 2015-04-24 18:24 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Goodwin\Downloads\mbam-setup-2.1.6.1022.exe
2015-04-24 18:16 - 2015-04-24 18:16 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Goodwin\Downloads\mbam-clean-2.1.1.1001.exe
2015-04-24 17:22 - 2015-04-24 17:22 - 00004426 _____ () C:\Users\Goodwin\Desktop\malware.txt
2015-04-24 16:50 - 2015-04-24 16:50 - 00003356 _____ () C:\Users\Goodwin\Desktop\JRT.txt
2015-04-24 16:47 - 2015-04-24 19:04 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1001
2015-04-24 16:46 - 2015-04-24 16:46 - 00000207 _____ () C:\windows\tweaking.com-regbackup-GOODWINPC-Windows-8-(64-bit).dat
2015-04-24 16:46 - 2015-04-24 16:46 - 00000000 ____D () C:\RegBackup
2015-04-24 16:45 - 2015-04-24 16:45 - 02685461 _____ (Thisisu) C:\Users\Goodwin\Downloads\JRT.exe
2015-04-24 16:37 - 2015-04-24 16:40 - 00000000 ____D () C:\AdwCleaner
2015-04-24 16:36 - 2015-04-24 16:36 - 02224640 _____ () C:\Users\Goodwin\Downloads\adwcleaner_4.202.exe
2015-04-24 16:04 - 2015-04-24 16:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-24 15:56 - 2015-04-24 15:56 - 00039323 _____ () C:\Users\Goodwin\Downloads\Addition.txt
2015-04-24 15:55 - 2015-04-25 11:51 - 00020290 _____ () C:\Users\Goodwin\Downloads\FRST.txt
2015-04-24 15:55 - 2015-04-25 11:51 - 00000000 ____D () C:\FRST
2015-04-24 15:54 - 2015-04-24 15:54 - 02099712 _____ (Farbar) C:\Users\Goodwin\Downloads\FRST64.exe
2015-04-23 16:13 - 2015-04-23 16:13 - 00003884 _____ () C:\Users\Goodwin\Desktop\aswMBR.txt
2015-04-23 16:13 - 2015-04-23 16:13 - 00000512 _____ () C:\Users\Goodwin\Desktop\MBR.dat
2015-04-23 15:01 - 2015-04-23 15:02 - 05198336 _____ (AVAST Software) C:\Users\Goodwin\Downloads\aswMBR.exe
2015-04-23 09:28 - 2015-04-23 09:28 - 00000000 ____D () C:\SUPERDelete
2015-04-23 09:26 - 2015-04-25 11:17 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-04-23 09:26 - 2015-04-23 09:26 - 00001810 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2015-04-23 09:26 - 2015-04-23 09:26 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\SUPERAntiSpyware.com
2015-04-23 09:26 - 2015-04-23 09:26 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2015-04-23 09:26 - 2015-04-23 09:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-04-23 09:19 - 2015-04-23 09:20 - 21718656 _____ (SUPERAntiSpyware) C:\Users\Goodwin\Downloads\SUPERAntiSpyware.exe
2015-04-23 07:02 - 2015-04-23 07:02 - 00000000 _____ () C:\autoexec.bat
2015-04-23 06:58 - 2015-04-23 06:59 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Goodwin\Downloads\SpyHunter-Installer.exe
2015-04-18 15:33 - 2015-04-18 15:33 - 00012872 _____ () C:\Users\Goodwin\Desktop\Gabrielle's summer reading 2015.odt
2015-04-18 15:27 - 2015-04-18 15:27 - 00015060 _____ () C:\Users\Goodwin\Desktop\Grey's Summer Reading 2015.odt
2015-04-18 15:21 - 2015-04-18 15:32 - 00013696 _____ () C:\Users\Goodwin\Desktop\Moo's Summer Reading 2015.odt
2015-04-18 15:11 - 2015-04-18 15:11 - 00016814 _____ () C:\Users\Goodwin\Desktop\Summer Classic Movies.ods
2015-04-17 15:15 - 2015-04-17 15:15 - 00497216 _____ () C:\windows\system32\FNTCACHE.DAT
2015-04-14 23:49 - 2015-04-14 23:49 - 00019310 _____ () C:\Users\Goodwin\Desktop\Superivision Report form for Deon Goodwin 4-12-2015.odt
2015-04-14 22:56 - 2015-04-14 22:56 - 00000000 ____D () C:\ProgramData\Radio
2015-04-14 17:11 - 2015-04-14 22:56 - 00000000 ____D () C:\ProgramData\T122078ED
2015-04-14 17:06 - 2015-04-14 23:43 - 00000000 ____D () C:\ProgramData\BJjoVxLmenb
2015-04-14 13:09 - 2015-03-17 00:00 - 06971712 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-04-14 13:09 - 2015-03-16 23:52 - 01822696 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-04-14 13:09 - 2015-02-24 00:58 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
2015-04-14 13:08 - 2015-03-16 21:45 - 01409496 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-04-14 13:01 - 2015-03-09 22:27 - 19292672 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-14 13:01 - 2015-03-04 00:29 - 00361280 _____ (Microsoft Corporation) C:\windows\system32\Drivers\clfs.sys
2015-04-14 13:01 - 2015-03-03 23:39 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\clfsw32.dll
2015-04-14 13:01 - 2015-03-03 21:52 - 00057856 _____ (Microsoft Corporation) C:\windows\SysWOW64\clfsw32.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 02237952 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 01409024 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 00600576 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 15409152 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00949760 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 14373376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 02864640 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 01763328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 01181696 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00737280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-14 13:00 - 2015-03-09 20:48 - 13767680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-12 12:51 - 2015-04-12 12:51 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\java
2015-04-11 01:01 - 2015-04-12 12:50 - 00000000 ____D () C:\Program Files (x86)\Minecraft
2015-04-11 01:01 - 2015-04-11 01:01 - 02314240 _____ () C:\Users\Goodwin\Downloads\MinecraftInstaller.msi
2015-04-11 01:01 - 2015-04-11 01:01 - 00000923 _____ () C:\Users\Public\Desktop\Minecraft.lnk
2015-04-11 01:01 - 2015-04-11 01:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2015-04-07 16:54 - 2015-04-14 12:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-25 11:52 - 2013-08-02 07:36 - 00000920 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-25 11:27 - 2013-06-28 01:07 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-25 11:24 - 2013-06-15 21:39 - 00003938 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{88775236-30DB-4E0B-9B77-3E30665BA9EC}
2015-04-25 11:22 - 2012-07-26 00:28 - 00876558 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-25 11:21 - 2013-06-22 23:00 - 00000000 ____D () C:\ProgramData\MFAData
2015-04-25 11:18 - 2014-03-21 17:31 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\CrashDumps
2015-04-25 11:17 - 2014-04-04 23:45 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-04-25 11:17 - 2013-08-02 07:36 - 00000916 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-25 11:16 - 2014-02-10 19:53 - 00000272 _____ () C:\windows\SysWOW64\LOCALSERVICE.INI
2015-04-25 11:16 - 2013-11-20 11:44 - 00001060 _____ () C:\windows\SysWOW64\bscs.ini
2015-04-25 11:15 - 2014-11-28 10:56 - 00000000 ____D () C:\windows\Minidump
2015-04-25 11:15 - 2014-02-10 19:53 - 00000043 _____ () C:\windows\SysWOW64\LOCALDEVICE.INI
2015-04-25 11:15 - 2013-05-08 14:18 - 00171851 ____N () C:\windows\Minidump\042515-47174-01.dmp
2015-04-25 11:15 - 2012-08-01 19:02 - 01332558 _____ () C:\windows\PFRO.log
2015-04-25 11:15 - 2012-07-26 00:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-24 22:00 - 2012-07-26 01:12 - 00000000 ____D () C:\windows\system32\sru
2015-04-24 18:53 - 2012-07-25 22:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2015-04-24 18:17 - 2012-07-25 22:26 - 00786432 ___SH () C:\windows\system32\config\BBI
2015-04-24 16:43 - 2013-11-29 20:59 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\NETGEARGenie
2015-04-24 16:42 - 2014-03-24 19:01 - 00000360 _____ () C:\windows\Tasks\HPCeeScheduleForGoodwin.job
2015-04-24 16:42 - 2013-06-27 23:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-24 15:55 - 2015-02-25 20:02 - 00002738 _____ () C:\windows\System32\Tasks\0215tb_RML
2015-04-24 15:55 - 2015-02-25 20:02 - 00000374 _____ () C:\windows\Tasks\0215tb_RML.job
2015-04-24 00:46 - 2014-03-24 19:01 - 00003178 _____ () C:\windows\System32\Tasks\HPCeeScheduleForGoodwin
2015-04-24 00:46 - 2013-06-15 21:37 - 00000000 ____D () C:\Users\Goodwin
2015-04-22 19:10 - 2013-07-13 15:20 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\.minecraft
2015-04-21 00:29 - 2014-12-25 17:02 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\Talisman
2015-04-20 18:17 - 2013-06-27 22:58 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2015-04-20 16:41 - 2015-03-11 20:38 - 00017262 _____ () C:\Users\Goodwin\Desktop\LEWIS AND CLARK 2015 cast.odt
2015-04-19 20:39 - 2013-06-16 22:39 - 00000000 ___RD () C:\Users\Goodwin\Desktop\Gabrielle's stuff
2015-04-19 13:13 - 2013-05-08 14:18 - 00126739 ____N () C:\windows\Minidump\041915-27924-01.dmp
2015-04-18 21:25 - 2013-05-08 14:18 - 00138643 ____N () C:\windows\Minidump\041815-42791-01.dmp
2015-04-18 19:05 - 2013-06-15 21:37 - 02025126 _____ () C:\windows\WindowsUpdate.log
2015-04-18 07:20 - 2014-01-11 17:58 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2015-04-18 07:15 - 2012-07-26 00:21 - 01400384 _____ () C:\windows\setupact.log
2015-04-17 22:10 - 2012-07-26 01:12 - 00000000 ____D () C:\windows\rescache
2015-04-16 01:42 - 2012-07-26 00:59 - 00000000 ____D () C:\windows\CbsTemp
2015-04-14 23:43 - 2014-05-08 09:51 - 00000000 ____D () C:\ProgramData\AVG2014
2015-04-14 23:42 - 2014-05-08 09:42 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\Avg2014
2015-04-14 14:00 - 2013-08-14 20:42 - 00000000 ____D () C:\windows\system32\MRT
2015-04-14 13:53 - 2013-06-29 12:39 - 128913832 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-04-14 13:27 - 2013-06-28 01:07 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-04-13 15:07 - 2014-10-18 14:09 - 00791520 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-04-13 15:07 - 2014-10-18 14:09 - 00177632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-26 14:40 - 2013-07-03 09:38 - 00000000 ____D () C:\Users\Goodwin\Desktop\Grey's Stuff

==================== Files in the root of some directories =======

2014-05-09 17:30 - 2014-06-02 16:58 - 0000000 _____ () C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2013-12-06 19:02 - 2013-12-06 19:02 - 0005120 _____ () C:\Users\Goodwin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-04 01:22 - 2014-11-04 01:22 - 0000017 _____ () C:\Users\Goodwin\AppData\Local\resmon.resmoncfg
2014-02-20 16:35 - 2014-02-20 16:35 - 0000057 _____ () C:\ProgramData\Ament.ini
2013-06-15 21:38 - 2013-06-15 21:38 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

Some content of TEMP:
====================
C:\Users\Goodwin\AppData\Local\Temp\2D62_avg_free_stb_all_2013_2899.exe
C:\Users\Goodwin\AppData\Local\Temp\air771F.exe
C:\Users\Goodwin\AppData\Local\Temp\CertificatesDLL.dll
C:\Users\Goodwin\AppData\Local\Temp\comver.dll
C:\Users\Goodwin\AppData\Local\Temp\dgrn.exe
C:\Users\Goodwin\AppData\Local\Temp\Extract.exe
C:\Users\Goodwin\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Goodwin\AppData\Local\Temp\HPInstaller.exe
C:\Users\Goodwin\AppData\Local\Temp\HPPSdr.exe
C:\Users\Goodwin\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe
C:\Users\Goodwin\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Goodwin\AppData\Local\Temp\oi_{E6E2A0D8-0171-49E1-88F1-3C386E4B7FC4}.exe
C:\Users\Goodwin\AppData\Local\Temp\Quarantine.exe
C:\Users\Goodwin\AppData\Local\Temp\Resource.exe
C:\Users\Goodwin\AppData\Local\Temp\sp58915.exe
C:\Users\Goodwin\AppData\Local\Temp\SP59485.exe
C:\Users\Goodwin\AppData\Local\Temp\SP62736.exe
C:\Users\Goodwin\AppData\Local\Temp\SP62764.exe
C:\Users\Goodwin\AppData\Local\Temp\SP63146.exe
C:\Users\Goodwin\AppData\Local\Temp\sp64126.exe
C:\Users\Goodwin\AppData\Local\Temp\SP65050.exe
C:\Users\Goodwin\AppData\Local\Temp\SP65052.exe
C:\Users\Goodwin\AppData\Local\Temp\sqlite3.dll
C:\Users\Goodwin\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Goodwin\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Goodwin\AppData\Local\Temp\WiseUpdX.exe
C:\Users\Goodwin\AppData\Local\Temp\_isB02.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-22 03:00

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-04-2015
Ran by [removed] at 2015-04-25 11:52:16
Running from C:\Users\[removed]\Downloads
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2247873678-407546785-3609120540-500 - Administrator - Disabled)
Gabrielle (S-1-5-21-2247873678-407546785-3609120540-1002 - Limited - Enabled) => C:\Users\Gabrielle
Goodwin (S-1-5-21-2247873678-407546785-3609120540-1001 - Administrator - Enabled) => C:\Users\Goodwin
Grey (S-1-5-21-2247873678-407546785-3609120540-1003 - Limited - Enabled) => C:\Users\Grey
Guest (S-1-5-21-2247873678-407546785-3609120540-501 - Limited - Disabled)
Miichael (S-1-5-21-2247873678-407546785-3609120540-1004 - Limited - Enabled) => C:\Users\Miichael

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\…\{BFDEF3C4-C349-AE43-4D36-8814E4A9DC87}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AVG 2014 (HKLM\…\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4311 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
AVG Web TuneUp (HKLM-x32\…\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)
BioWare Premium Module: Neverwinter Nights(TM) Kingmaker (HKLM-x32\…\Neverwinter Nights(TM) Kingmaker) (Version: - BioWare Corp.)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Civilization V Deluxe Edition (HKLM-x32\…\{8BCC07D2-4841-4450-81AA-A074C0969C44}_is1) (Version: 1.0.0.0 - Catalog Games by Donald Dark)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
CrimeWatch (HKLM-x32\…\CrimeWatch) (Version: 3.0.51 - Great Apps)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
davehope.co.uk Product Key Finder (HKLM-x32\…\Product Key Finder_is1) (Version: - davehope.co.uk)
Fallen Enchantress: Legendary Heroes (HKLM-x32\…\Steam App 228260) (Version: - Stardock Entertainment)
GameSpy Arcade (HKLM-x32\…\GameSpy Arcade) (Version: - )
Google Drive (HKLM-x32\…\{56D4499E-AC3E-4B8D-91C9-C700C148C44B}) (Version: 1.13.5782.599 - Google, Inc.)
Google Earth (HKLM-x32\…\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hoyle Board Games 2005 (HKLM-x32\…\{FB1CCBED-FA66-4D30-BFD7-EF20AD0A81FE}) (Version: 1.0.0.0 - Sierra Entertainment, Inc.)
Hoyle Puzzle Games 2005 (HKLM-x32\…\{A3EAB67E-9B37-4B74-AFE6-D418D5F6F3D4}) (Version: 1.0.0.0 - Sierra Entertainment, Inc.)
HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\HPConnectedMusic) (Version: 1.1 (build 71) hp - Meridian Audio Ltd)
HP Connected Remote (HKLM-x32\…\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1206 - Hewlett-Packard)
HP Deskjet 2540 series Basic Device Software (HKLM\…\{6A79CD11-0C1C-4E24-A8C6-46A02F680346}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Deskjet 2540 series Help (HKLM-x32\…\{4539575D-C09D-4E71-B207-0F2D6BD74DA2}) (Version: 30.0.0 - Hewlett Packard)
HP Keyboard (HKLM-x32\…\{B40D7926-AE5F-41EA-8AC6-56C0E2F00E9D}) (Version: 1.5.0.7 - Hewlett-Packard)
HP MyRoom (HKLM-x32\…\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Quick Start (HKLM-x32\…\{574F0207-8E98-46CD-8F79-318348C98C46}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Registration Service (HKLM\…\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6482.0 - IDT)
IMVU Avatar Chat Software (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\IMVU Avatar chat client software BETA) (Version: - )
iWin Games (HKLM-x32\…\iWinArcade) (Version: 2.91 - )
Java 7 Update 51 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Kerbal Space Program Demo (HKLM-x32\…\Steam App 231410) (Version: - Squad)
KeyFinder Thing (HKLM-x32\…\KeyFinder Thing_is1) (Version: 3.1.6.0 - KeyFinder Thing)
Magical Diary Demo 1.05 (HKLM-x32\…\Magical Diary - Horse Hall - Demo_is1) (Version: - Hanako Games)
Mahjong Quest 2 (remove only) (HKLM-x32\…\Mahjong Quest 2) (Version: - )
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\SkyDriveSetup.exe) (Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\…\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\…\{95140000-0137-0409-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Minecraft (HKLM-x32\…\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mini Nutcracker 2.0 (HKLM-x32\…\Mini Nutcracker_is1) (Version: - )
Mozilla Firefox 37.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 37.0.2 (x86 en-US)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 en-US) (HKLM-x32\…\Mozilla Thunderbird 31.6.0 (x86 en-US)) (Version: 31.6.0 - Mozilla)
NETGEAR Genie (HKLM-x32\…\NETGEAR Genie) (Version: 2.3.1.46 - NETGEAR Inc.)
Neverwinter Nights (HKLM-x32\…\{C1583439-B034-4881-819C-D52A0587662B}) (Version: - )
NoLimits 2 Roller Coaster Simulation Demo (HKLM-x32\…\Steam App 319260) (Version: - Ole Lange)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
OpenAL (HKLM-x32\…\OpenAL) (Version: - )
OpenOffice 4.0.0 (HKLM-x32\…\{55E61709-D7D4-43C0-B45D-BFAF5C09A02D}) (Version: 4.00.9702 - Apache Software Foundation)
Product Improvement Study for HP Deskjet 2540 series (HKLM\…\{DF34643B-A745-430C-B27B-A48F853C81E4}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
QuickShare (HKLM-x32\…\{232F1B14-7126-491F-AC8C-6123BA58FDE2}) (Version: 1.135.60.12323 - Linkury Inc.) <==== ATTENTION
Ralink Bluetooth Stack (HKLM\…\{C079427A-BB28-5168-3DB1-DC6608D226D4}) (Version: 11.0.748.2 - Mediatek)
Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\…\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.37.0 - Mediatek)
RE: Alistair++ 1 (HKLM-x32\…\RE: Alistair++) (Version: 1 - sakevisual)
Recover Keys (HKLM-x32\…\Recover Keys_is1) (Version: 7.0.3.87 - Recover Keys)
Recovery Manager (x32 Version: 5.5.0.5530 - CyberLink Corp.) Hidden
RemooveAdsTube (HKLM-x32\…\{B2F90C69-01B1-A3BD-92BF-12482B317A19}) (Version: - RemoveAdsTube) <==== ATTENTION
Rhapsody (HKLM-x32\…\Rhapsody) (Version: - )
ROBLOX Player (HKLM-x32\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
ROBLOX Player for Goodwin (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
ROBLOX Studio for Goodwin (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version: - ROBLOX Corporation)
Sanctum with Game Auto-Reconnect 1.70 (HKLM-x32\…\Sanctum with Game Auto-Reconnect 1.70) (Version: - )
Sanctum18 (HKLM-x32\…\Sanctum18) (Version: - )
Sid Meier's Civilization V (HKLM-x32\…\Steam App 8930) (Version: - 2K Games, Inc.)
Space Empires V (HKLM-x32\…\Steam App 1690) (Version: - Malfador Machinations)
Stardock Central (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Stardock Central) (Version: - Stardock Corporation)
Steam (HKLM-x32\…\Steam) (Version: - Valve Corporation)
SUPERAntiSpyware (HKLM\…\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1186 - SUPERAntiSpyware.com)
Talisman: Digital Edition (HKLM-x32\…\Steam App 247000) (Version: - Nomad Games Limited)
Talisman: Prologue (HKLM-x32\…\Steam App 258200) (Version: - Nomad Games)
TeleTech WB ISA (HKLM-x32\…\TeleTech ISA) (Version: 1.0.3 - TeleTech)
Unity Web Player (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\UnityWebPlayer) (Version: - Unity Technologies ApS)
Visual Studio 2010 x64 Redistributables (HKLM\…\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Warlords IV (HKLM-x32\…\{7B31DF8A-8B77-497F-8180-E710A01635F1}) (Version: W4PCA0.8 - )
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\…\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Wizard101 (HKLM-x32\…\{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}) (Version: 1.0.0 - KingsIsle Entertainment, Inc.)
World Dance (HKLM-x32\…\{C83C2005-B030-11D5-8CE8-0003470BB21B}) (Version: 1.00.0000 - iSeeSoft, LLC)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{50455C37-81A6-4986-86CC-A5175EDBE3A8}\InprocServer32 -> C:\Program Files (x86)\TNT2\2.0.0.1976\IEToolbar64.dll No File
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\RobloxProxy64.dll (ROBLOX Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

09-04-2015 06:21:01 Scheduled Checkpoint
11-04-2015 01:01:26 Installed Minecraft
14-04-2015 13:47:03 Windows Update
17-04-2015 15:12:14 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-25 22:26 - 2012-07-25 22:26 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00B7DEA8-ECBC-4E8F-BE06-4DF0B01FFE7E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {0F940933-53AA-4DD4-96A3-D20C5CEF3701} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-02] (Google Inc.)
Task: {18AE6B43-6BBB-4C61-A78F-7031EF8320F3} - System32\Tasks\HPCeeScheduleForGoodwin => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {1EC67692-D030-4F2A-8862-4524D73443FE} - System32\Tasks\{D3D8769E-0C05-4832-8F78-4BEE75247A8B} => pcalua.exe -a I:\autorun.exe -d I:\
Task: {20A9950D-EE94-4831-86D9-6AF5FF448F26} - \Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1002 No Task File <==== ATTENTION
Task: {2346F637-175A-43B4-8D22-FFC94C952433} - System32\Tasks\HP AR Program Upload - 87c2b8b94a234ec1b1f2df9570ef26898a7e79ef6bf947298632f7a38de543f0 => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {34AD8598-3124-41FF-98FD-19572B8E227D} - System32\Tasks\HP AR Program Upload - 2c9e641036574d038458ec7eda3f44b340af2e07a949462385c4b4a33f2fba9e => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {363F7E37-9355-4908-9823-E1F70EC833F9} - System32\Tasks\{69CB7144-9591-4F36-A9AC-3FFB3521CCFE} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {36C125E2-F728-46D5-93B2-FBFC268E9FC6} - System32\Tasks\0215tb_RML => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe [2015-02-25] ()
Task: {5C1BEA64-AAEF-463C-A8C9-6E3C8B66005F} - System32\Tasks\HPCustParticipation HP Deskjet 2540 series => C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.)
Task: {7239477C-31B1-4599-97B0-CB3D129B5393} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {73CE9EFF-C7CA-46E4-BB10-11DC0FD70670} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {76F4FA71-A3B9-4521-94DB-4B5E61F5EEF9} - System32\Tasks\{48D6A4D4-FA1F-4FC8-B848-1AE9DB6E8076} => pcalua.exe -a I:\setup.exe -d I:\
Task: {8DD9F642-6BA9-4ED3-B0DB-CB76EF25607A} - System32\Tasks\HP AR Program Upload - 5cbdb67a0cdc4b40967efcd569863e1f83b5cb5fe05c4715b233b819873d2b0f => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {9451914C-CD39-4786-B767-7B34B5CE0FFF} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-04-14] (Microsoft Corporation)
Task: {9D8714B9-5D3A-42B5-9294-B20268508356} - System32\Tasks\{F6A31C4C-AC87-4C93-B143-02929BFDA4C6} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {AD2886B7-F49E-46BD-BB2C-D3E0330ED9FF} - System32\Tasks\{B2ABEF8F-C628-491B-8733-300970C339E9} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {C2E170F4-488E-4A96-BF14-5DE45542AF5C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {C7EF3903-8E0C-420B-A73E-A597DFF78A66} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN3B72BGPZ => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-30] (Hewlett-Packard)
Task: {CA1A5AE0-6527-4DCE-8ED2-646FC94F28D5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-02] (Google Inc.)
Task: {D1C1A1A8-1D4F-4674-9918-27940067E0DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {E0702165-A9BA-48BF-A27D-55036390E31C} - \Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1004 No Task File <==== ATTENTION
Task: {E59944E8-D99D-454D-AD63-D3FCF731790D} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {EC89A5D9-EEC5-456D-883A-3A93D38EA4D8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-30] (Hewlett-Packard)
Task: {F6B6D6ED-2BC9-4496-AFBB-302AA8DC53D6} - \Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1003 No Task File <==== ATTENTION
Task: {FC17416F-ED36-4D20-99D8-F1D382C2F649} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: C:\windows\Tasks\0215tb_RML.job => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForGoodwin.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) ==============

2015-03-03 09:32 - 2015-03-03 09:32 - 00620056 _____ () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
2014-03-19 15:13 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00016632 _____ () C:\windows\system32\BsHelpCSps.dll
2015-03-17 16:33 - 2015-01-27 08:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00062200 _____ () C:\windows\system32\BlueSoleilCSps.dll
2015-02-25 18:16 - 2015-02-25 18:16 - 02794520 _____ () C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe
2014-11-06 08:28 - 2014-11-06 08:28 - 00105216 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
2012-08-29 11:02 - 2012-08-29 11:02 - 00120224 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPItunesModule.dll
2012-08-29 11:02 - 2012-08-29 11:02 - 00048544 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPItunesProxy.dll
2012-08-29 11:02 - 2012-08-29 11:02 - 00180224 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\zxing.dll
2012-07-04 22:37 - 2012-07-04 22:37 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-05-04 17:42 - 2012-05-04 17:42 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00029432 _____ () C:\windows\SYSTEM32\BsTrace.dll
2013-05-24 11:22 - 2013-05-24 11:22 - 00334648 _____ () C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\Driver\USB\tl_filter.dll
2011-07-05 11:53 - 2011-07-05 11:53 - 00012800 _____ () C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\Driver\AMP\IVTAMPRL.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00016632 _____ () C:\windows\SYSTEM32\BsHelpCSps.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00062200 _____ () C:\windows\SYSTEM32\BlueSoleilCSps.dll
2014-04-04 23:49 - 2015-03-09 23:37 - 00775680 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-02-07 19:47 - 2014-12-01 17:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll
2014-06-13 10:40 - 2015-04-13 16:44 - 02371776 _____ () C:\Program Files (x86)\Steam\video.dll
2015-02-07 19:47 - 2014-12-01 17:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-02-07 19:47 - 2014-12-01 17:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-04-04 23:49 - 2015-04-13 16:44 - 00702656 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-09-28 18:13 - 2013-09-28 18:13 - 00544817 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libgcc_s_dw2-1.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00989805 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libstdc++-6.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 03369922 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuin51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 01978690 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuuc51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 22378434 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icudt51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 01233408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\platforms\qwindows.dll
2014-11-17 02:46 - 2014-11-17 02:46 - 00639488 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll
2014-11-10 02:55 - 2014-11-10 02:55 - 01686016 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll
2014-11-05 00:36 - 2014-11-05 00:36 - 00192512 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll
2014-11-05 00:37 - 2014-11-05 00:37 - 00632832 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll
2014-11-14 03:53 - 2014-11-14 03:53 - 06499840 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll
2014-06-29 18:55 - 2014-06-29 18:55 - 00068608 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll
2014-06-29 19:05 - 2014-06-29 19:05 - 01183232 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\qwt.dll
2014-11-07 02:13 - 2014-11-07 02:13 - 02475520 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_MyMedia.dll
2012-10-15 13:27 - 2012-10-15 13:27 - 00111616 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlc.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 02286592 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlccore.dll
2014-11-17 00:00 - 2014-11-17 00:00 - 01056768 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll
2014-09-11 01:39 - 2014-09-11 01:39 - 00144896 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll
2014-11-05 00:51 - 2014-11-05 00:51 - 01191424 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll
2014-11-16 23:21 - 2014-11-16 23:21 - 10374656 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll
2014-11-16 23:18 - 2014-11-16 23:18 - 02496512 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll
2014-11-06 02:39 - 2014-11-06 02:39 - 00200192 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll
2014-11-05 00:58 - 2014-11-05 00:58 - 00889344 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll
2014-11-05 01:00 - 2014-11-05 01:00 - 00435712 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qgif.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00052224 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qico.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00261120 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qjpeg.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qsvg.dll
2014-06-29 18:55 - 2014-06-29 18:55 - 00081408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll
2014-11-03 01:23 - 2014-11-03 01:23 - 00143360 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnoseDll.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00072192 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SVTUtils.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00074240 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\NetcardApi.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00136704 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\airprintdll.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00219648 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\access\libdshow_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00049664 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libaout_directx_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libwaveout_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00070144 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\video_output\libdirectx_plugin.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00040960 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\printsupport\windowsprintersupport.dll
2014-11-05 00:59 - 2014-11-05 00:59 - 00642048 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_Update.dll
2014-11-05 01:01 - 2014-11-05 01:01 - 00458752 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll
2014-06-29 19:33 - 2014-06-29 19:33 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupApiPlugin.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00066560 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupDll.dll
2014-04-04 23:49 - 2015-02-24 18:58 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CBSWFP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\svcinf => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\rhapsody.com -> hxxps://rhap-app-4-0.rhapsody.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Goodwin\Pictures\Fall 2014\IMG_2116.JPG
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\StartupApproved\StartupFolder: => "Send to OneNote.lnk"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (04/25/2015 11:52:20 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:52:05 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:51:50 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:51:35 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:51:20 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:51:05 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:50:50 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:50:35 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:50:20 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/25/2015 11:50:05 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

System errors:
=============
Error: (04/25/2015 11:18:33 AM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/25/2015 11:15:51 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000000a (0xfffffa801ee24178, 0x0000000000000002, 0x0000000000000001, 0xfffff800b52bbb6f)C:\windows\Minidump\042515-47174-01.dmp042515-47174-01

Error: (04/25/2015 11:15:50 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 10:18:15 PM on ‎4/‎24/‎2015 was unexpected.

Error: (04/25/2015 11:15:02 AM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 16) (User: NT AUTHORITY)
Description: 32212254733957120

Error: (04/24/2015 06:20:44 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/24/2015 04:47:15 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The HP Support Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (04/24/2015 04:47:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The BsHelpCS service terminated unexpectedly. It has done this 1 time(s).

Error: (04/24/2015 04:47:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NETGEARGenieDaemon service terminated unexpectedly. It has done this 1 time(s).

Error: (04/24/2015 04:47:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The iWinTrusted service terminated unexpectedly. It has done this 1 time(s).

Error: (04/24/2015 04:47:13 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Microsoft Office ClickToRun Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Microsoft Office Sessions:
=========================
Error: (04/25/2015 11:52:35 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:52:20 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:52:05 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:51:50 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:51:35 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:51:20 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:51:05 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:50:50 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:50:35 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/25/2015 11:50:20 AM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

==================== Memory info ===========================

Processor: AMD A10-5700 APU with Radeon™ HD Graphics
Percentage of memory in use: 40%
Total physical RAM: 7575.3 MB
Available physical RAM: 4493.62 MB
Total Pagefile: 7975.3 MB
Available Pagefile: 5448.4 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1850.69 GB) (Free:1704.48 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:10.85 GB) (Free:1.32 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: EDF89B76)

Partition: GPT Partition Type.

==================== End Of Log ============================

ken545

Post #18April 25, 2015, 11:25 PM UTC

Running from C:\Users\[removed]\Downloads<—- Your running FRST64 from your downloads folder, our tools and scanners work more efficiently when run from the Desktop in lieu of being buried in some folder, so go to your Downloads folder and look for FRST64, right click on it and select CUT, then come back to your Desktop and right click on a blank space and select PASTE, then we will have FRST64 exactly where we want it to be.

I am attaching a FIXLIST file, you need to download it to your desktop where you now have FRST64 or the fix wont work, use your mouse to drag FIXLIST right next to FRST64, either above or below it but not right on top of it, after its downloaded open up FRST64 and click on FIX (Not Scan) it wont take long, after your computer reboots you will find a FIXLOG file on your desktop, post it please and let me know how your system is behaving now

Attachments:

📎Fixlist.txt

Clstlg

Post #19April 26, 2015, 8:52 PM UTC

The tool froze the first time, but I was able to get it working again.

I am able to change the homepage now, but we are still experiencing pop ups and blue underlinks. Firefox is also experience some lagging.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-04-2015
Ran by [removed] at 2015-04-26 13:36:12 Run:2
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CreateRestorePoint:
CloseProcesses:
(iWin Inc.) C:\Program Files (x86)\iWin Games\iWinTrusted.exe
C:\Program Files (x86)\iWin Games
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [PCKeeper2] => "C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe" /autorun
C:\Program Files\Kromtech
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKLM - FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\IEToolbar64.dll No File
Toolbar: HKLM-x32 - FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\ietoolbar.dll No File
Toolbar: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\IEToolbar64.dll No File
FF Homepage: hxxp://services.freshy.com/general/newhometab.php?hometab=home&partner=11083&guid={596259CD-BACA-4776-9B42-4E8021D67F4E}&i=
Task: {20A9950D-EE94-4831-86D9-6AF5FF448F26} - \Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1002 No Task File <==== ATTENTION
Task: {E0702165-A9BA-48BF-A27D-55036390E31C} - \Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1004 No Task File <==== ATTENTION
Task: {F6B6D6ED-2BC9-4496-AFBB-302AA8DC53D6} - \Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1003 No Task File <==== ATTENTION
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:
End

*****************

Restore point was successfully created.
Processes closed successfully.
C:\Program Files (x86)\iWin Games\iWinTrusted.exe => No running process found
"C:\Program Files (x86)\iWin Games" => File/Directory not found.
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Software\Microsoft\Windows\CurrentVersion\Run\\PCKeeper2 => Value not found.
"C:\Program Files\Kromtech" => File/Directory not found.
"C:\windows\system32\GroupPolicy\Machine" => File/Directory not found.
HKLM\SOFTWARE\Policies\Google => Key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{50455C37-81A6-4986-86CC-A5175EDBE3A8} => Value not found.
HKCR\CLSID\{50455C37-81A6-4986-86CC-A5175EDBE3A8} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{50455C37-81A6-4986-86CC-A5175EDBE3A8} => Value not found.
HKCR\Wow6432Node\CLSID\{50455C37-81A6-4986-86CC-A5175EDBE3A8} => Key not found.
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{50455C37-81A6-4986-86CC-A5175EDBE3A8} => Value not found.
HKCR\CLSID\{50455C37-81A6-4986-86CC-A5175EDBE3A8} => Key not found.
Firefox homepage deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{20A9950D-EE94-4831-86D9-6AF5FF448F26} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1002 => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E0702165-A9BA-48BF-A27D-55036390E31C} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1004 => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F6B6D6ED-2BC9-4496-AFBB-302AA8DC53D6} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1003 => Key not found.

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 5.3 GB temporary data.

The system needed a reboot.

==== End of Fixlog 13:38:55 ====

ken545

Post #20April 26, 2015, 9:42 PM UTC

Lets try setting Firefox back to its default state

Open Firefox

Click on Help > Troubleshooting Information > Reset Firefox to its default state

Clstlg

Post #21April 26, 2015, 9:54 PM UTC

OK…that took care of the major pop-ups and the blue underlinks! Still a bit of a lag when changing websites, but that could be due to everything being cleared in the reset?

ken545

Post #22April 26, 2015, 9:57 PM UTC

Open and close FF a few times, reboot your computer few times, sometimes by doing this the problems go away

ken545

Post #23April 26, 2015, 9:58 PM UTC

Also, open FRST, checkmark Additions , run a new scan and post both new logs

Clstlg

Post #24April 26, 2015, 10:09 PM UTC

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-04-2015
Ran by [removed] (administrator) on GOODWINPC on 26-04-2015 15:06:22
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 8 (X64) OS Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(NETGEAR Inc.) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe
() C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR_HIDList.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2013-10-21] (Hewlett-Packard )
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-10-21] (IDT, Inc.)
HKLM-x32\…\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [BATINDICATOR] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR.exe [2068992 2011-12-14] (Hewlett-Packard)
HKLM-x32\…\Run: [BATINDICATORHL] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR_HIDList.exe [557056 2010-07-23] (Hewlett-Packard)
HKLM-x32\…\Run: [OSDTool] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\CNYHKEY.exe [2101248 2012-06-13] (Hewlett-Packard)
HKLM-x32\…\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)
HKLM-x32\…\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [387832 2013-11-01] (IVT Corporation)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [2889408 2015-04-13] (Valve Corporation)
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [NETGEARGenie] => C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [602880 2014-11-06] (NETGEAR Inc.)
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [AVG-Secure-Search-Update_0215tb] => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe [2794520 2015-02-25] ()
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\MountPoints2: {fd88e5da-e8e8-11e3-be9d-689423bdcec6} - "J:\AutoRun.exe"
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\PhotoScreensaver.scr [593408 2012-07-25] (Microsoft Corporation)
Startup: C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - .lnk [2015-01-23]
ShortcutTarget: Monitor Ink Alerts - .lnk -> C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 2540 series.lnk [2015-04-26]
ShortcutTarget: Monitor Ink Alerts - HP Deskjet 2540 series.lnk -> C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerReg Scheduler.exe [2013-07-03] ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
SearchScopes: HKLM -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {64800F42-8D73-4AA4-A732-5402AE691582} URL = http://search.yahoo.com/search?p={searchTerms}&fr;=tightropetb&type;=11083
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\windows\SysWow64\skype4com.dll [2013-11-01] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\6os3z2n3.default-1430084938950
FF Homepage: https://www.lds.org/?lang=eng
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\windows\system32\npDeployJava1.dll [2013-09-29] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-11] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-26] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-26] (Google Inc.)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @nsroblox.roblox.com/launcher -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @nsroblox.roblox.com/launcher64 -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Goodwin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-07-20] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)

Chrome:
=======
CHR Profile: C:\Users\Goodwin\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1706744 2013-11-01] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [145656 2013-11-01] (IVT Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
S2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35232 2012-08-29] (Hewlett-Packard)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2014-11-06] (NETGEAR)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [333824 2013-10-21] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16024 2015-01-31] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-03] ()
S2 iWinTrusted; C:\Program Files (x86)\iWin Games\iWinTrusted.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
U4 BthAvrcpTg; No ImagePath
U4 BthHFEnum; No ImagePath
U4 bthhfhid; No ImagePath
R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [54064 2013-04-26] (Ralink Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)
R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [49584 2013-03-25] (Ralink Corporation)
S3 CpqDfw; C:\Windows\System32\drivers\CpqDfw.sys [27456 2012-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-26] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R2 NPF; C:\windows\system32\drivers\npf.sys [35344 2014-11-20] (CACE Technologies, Inc.)
R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [1204424 2013-12-02] (Ralink Technology, Corp.)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
S3 cqcpu; system32\drivers\cqcpu.sys [X]
S3 TCFilter; system32\drivers\tcfilter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-26 15:06 - 2015-04-26 15:06 - 00017507 _____ () C:\Users\Goodwin\Desktop\FRST.txt
2015-04-26 14:49 - 2015-04-26 14:49 - 00000000 ____D () C:\Users\Goodwin\Desktop\Old Firefox Data
2015-04-26 13:27 - 2015-04-26 13:27 - 00000000 ____D () C:\Users\Goodwin\Desktop\FRST-OlderVersion
2015-04-26 13:26 - 2015-04-26 13:27 - 02101248 _____ (Farbar) C:\Users\Goodwin\Desktop\FRST64.exe
2015-04-24 18:25 - 2015-04-26 15:05 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-24 18:24 - 2015-04-24 18:24 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-04-24 18:24 - 2015-04-24 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-24 18:24 - 2015-04-24 18:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-24 18:24 - 2015-04-24 18:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-04-24 18:24 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-24 18:24 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-24 18:24 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-24 18:21 - 2015-04-24 18:24 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Goodwin\Downloads\mbam-setup-2.1.6.1022(1).exe
2015-04-24 18:20 - 2015-04-24 18:24 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Goodwin\Downloads\mbam-setup-2.1.6.1022.exe
2015-04-24 18:16 - 2015-04-24 18:16 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Goodwin\Downloads\mbam-clean-2.1.1.1001.exe
2015-04-24 17:22 - 2015-04-24 17:22 - 00004426 _____ () C:\Users\Goodwin\Desktop\malware.txt
2015-04-24 16:50 - 2015-04-24 16:50 - 00003356 _____ () C:\Users\Goodwin\Desktop\JRT.txt
2015-04-24 16:47 - 2015-04-24 19:04 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1001
2015-04-24 16:46 - 2015-04-24 16:46 - 00000207 _____ () C:\windows\tweaking.com-regbackup-GOODWINPC-Windows-8-(64-bit).dat
2015-04-24 16:46 - 2015-04-24 16:46 - 00000000 ____D () C:\RegBackup
2015-04-24 16:45 - 2015-04-24 16:45 - 02685461 _____ (Thisisu) C:\Users\Goodwin\Downloads\JRT.exe
2015-04-24 16:37 - 2015-04-24 16:40 - 00000000 ____D () C:\AdwCleaner
2015-04-24 16:36 - 2015-04-24 16:36 - 02224640 _____ () C:\Users\Goodwin\Downloads\adwcleaner_4.202.exe
2015-04-24 16:04 - 2015-04-24 16:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-24 15:56 - 2015-04-25 11:52 - 00037442 _____ () C:\Users\Goodwin\Downloads\Addition.txt
2015-04-24 15:55 - 2015-04-26 15:06 - 00000000 ____D () C:\FRST
2015-04-24 15:55 - 2015-04-25 11:52 - 00036273 _____ () C:\Users\Goodwin\Downloads\FRST.txt
2015-04-24 15:54 - 2015-04-24 15:54 - 02099712 _____ (Farbar) C:\Users\Goodwin\Downloads\FRST64.exe
2015-04-23 16:13 - 2015-04-23 16:13 - 00003884 _____ () C:\Users\Goodwin\Desktop\aswMBR.txt
2015-04-23 16:13 - 2015-04-23 16:13 - 00000512 _____ () C:\Users\Goodwin\Desktop\MBR.dat
2015-04-23 15:01 - 2015-04-23 15:02 - 05198336 _____ (AVAST Software) C:\Users\Goodwin\Downloads\aswMBR.exe
2015-04-23 09:28 - 2015-04-23 09:28 - 00000000 ____D () C:\SUPERDelete
2015-04-23 09:19 - 2015-04-23 09:20 - 21718656 _____ (SUPERAntiSpyware) C:\Users\Goodwin\Downloads\SUPERAntiSpyware.exe
2015-04-23 07:02 - 2015-04-23 07:02 - 00000000 _____ () C:\autoexec.bat
2015-04-23 06:58 - 2015-04-23 06:59 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Goodwin\Downloads\SpyHunter-Installer.exe
2015-04-18 15:33 - 2015-04-18 15:33 - 00012872 _____ () C:\Users\Goodwin\Desktop\Gabrielle's summer reading 2015.odt
2015-04-18 15:27 - 2015-04-18 15:27 - 00015060 _____ () C:\Users\Goodwin\Desktop\Grey's Summer Reading 2015.odt
2015-04-18 15:21 - 2015-04-18 15:32 - 00013696 _____ () C:\Users\Goodwin\Desktop\Moo's Summer Reading 2015.odt
2015-04-18 15:11 - 2015-04-18 15:11 - 00016814 _____ () C:\Users\Goodwin\Desktop\Summer Classic Movies.ods
2015-04-17 15:15 - 2015-04-17 15:15 - 00497216 _____ () C:\windows\system32\FNTCACHE.DAT
2015-04-14 23:49 - 2015-04-14 23:49 - 00019310 _____ () C:\Users\Goodwin\Desktop\Superivision Report form for Deon Goodwin 4-12-2015.odt
2015-04-14 22:56 - 2015-04-14 22:56 - 00000000 ____D () C:\ProgramData\Radio
2015-04-14 17:11 - 2015-04-14 22:56 - 00000000 ____D () C:\ProgramData\T122078ED
2015-04-14 17:06 - 2015-04-14 23:43 - 00000000 ____D () C:\ProgramData\BJjoVxLmenb
2015-04-14 13:09 - 2015-03-17 00:00 - 06971712 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-04-14 13:09 - 2015-03-16 23:52 - 01822696 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-04-14 13:09 - 2015-02-24 00:58 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
2015-04-14 13:08 - 2015-03-16 21:45 - 01409496 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-04-14 13:01 - 2015-03-09 22:27 - 19292672 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-14 13:01 - 2015-03-04 00:29 - 00361280 _____ (Microsoft Corporation) C:\windows\system32\Drivers\clfs.sys
2015-04-14 13:01 - 2015-03-03 23:39 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\clfsw32.dll
2015-04-14 13:01 - 2015-03-03 21:52 - 00057856 _____ (Microsoft Corporation) C:\windows\SysWOW64\clfsw32.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 02237952 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 01409024 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 00600576 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 15409152 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00949760 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 14373376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 02864640 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 01763328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 01181696 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00737280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-14 13:00 - 2015-03-09 20:48 - 13767680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-12 12:51 - 2015-04-12 12:51 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\java
2015-04-11 01:01 - 2015-04-12 12:50 - 00000000 ____D () C:\Program Files (x86)\Minecraft
2015-04-11 01:01 - 2015-04-11 01:01 - 02314240 _____ () C:\Users\Goodwin\Downloads\MinecraftInstaller.msi
2015-04-11 01:01 - 2015-04-11 01:01 - 00000923 _____ () C:\Users\Public\Desktop\Minecraft.lnk
2015-04-11 01:01 - 2015-04-11 01:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2015-04-07 16:54 - 2015-04-14 12:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-26 15:06 - 2014-04-04 23:45 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-04-26 15:06 - 2014-03-21 17:31 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\CrashDumps
2015-04-26 15:05 - 2014-02-10 19:53 - 00000272 _____ () C:\windows\SysWOW64\LOCALSERVICE.INI
2015-04-26 15:05 - 2014-02-10 19:53 - 00000043 _____ () C:\windows\SysWOW64\LOCALDEVICE.INI
2015-04-26 15:05 - 2013-11-20 11:44 - 00001060 _____ () C:\windows\SysWOW64\bscs.ini
2015-04-26 15:05 - 2013-08-02 07:36 - 00000922 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-26 15:05 - 2012-07-26 00:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-26 14:51 - 2013-06-15 21:39 - 00003938 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{88775236-30DB-4E0B-9B77-3E30665BA9EC}
2015-04-26 14:49 - 2013-08-02 07:36 - 00000926 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-26 14:27 - 2013-06-28 01:07 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-26 14:00 - 2012-07-26 01:12 - 00000000 ____D () C:\windows\system32\sru
2015-04-26 13:53 - 2013-08-09 13:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-04-26 13:48 - 2012-07-26 00:28 - 00876558 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-26 13:44 - 2013-08-02 07:36 - 00003898 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-04-26 13:44 - 2013-08-02 07:36 - 00003662 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-04-26 13:42 - 2013-11-29 20:59 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\NETGEARGenie
2015-04-26 13:41 - 2014-01-30 15:49 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2015-04-26 13:41 - 2012-08-01 19:02 - 01334386 _____ () C:\windows\PFRO.log
2015-04-26 13:40 - 2012-07-25 22:26 - 00786432 ___SH () C:\windows\system32\config\BBI
2015-04-26 13:27 - 2012-07-26 01:12 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2015-04-26 13:27 - 2012-07-26 01:12 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2015-04-26 11:09 - 2013-06-22 23:00 - 00000000 ____D () C:\ProgramData\MFAData
2015-04-26 11:03 - 2014-11-28 10:56 - 00000000 ____D () C:\windows\Minidump
2015-04-26 11:03 - 2013-05-08 14:18 - 00233363 ____N () C:\windows\Minidump\042615-36254-01.dmp
2015-04-25 21:26 - 2014-12-25 17:02 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\Talisman
2015-04-25 21:17 - 2015-02-25 20:02 - 00000374 _____ () C:\windows\Tasks\0215tb_RML.job
2015-04-25 21:16 - 2013-05-08 14:18 - 00124883 ____N () C:\windows\Minidump\042515-36410-01.dmp
2015-04-25 11:15 - 2013-05-08 14:18 - 00171851 ____N () C:\windows\Minidump\042515-47174-01.dmp
2015-04-24 18:53 - 2012-07-25 22:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2015-04-24 16:42 - 2014-03-24 19:01 - 00000360 _____ () C:\windows\Tasks\HPCeeScheduleForGoodwin.job
2015-04-24 16:42 - 2013-06-27 23:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-24 15:55 - 2015-02-25 20:02 - 00002738 _____ () C:\windows\System32\Tasks\0215tb_RML
2015-04-24 00:46 - 2014-03-24 19:01 - 00003178 _____ () C:\windows\System32\Tasks\HPCeeScheduleForGoodwin
2015-04-24 00:46 - 2013-06-15 21:37 - 00000000 ____D () C:\Users\Goodwin
2015-04-22 19:10 - 2013-07-13 15:20 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\.minecraft
2015-04-20 18:17 - 2013-06-27 22:58 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2015-04-20 16:41 - 2015-03-11 20:38 - 00017262 _____ () C:\Users\Goodwin\Desktop\LEWIS AND CLARK 2015 cast.odt
2015-04-19 20:39 - 2013-06-16 22:39 - 00000000 ___RD () C:\Users\Goodwin\Desktop\Gabrielle's stuff
2015-04-19 13:13 - 2013-05-08 14:18 - 00126739 ____N () C:\windows\Minidump\041915-27924-01.dmp
2015-04-18 21:25 - 2013-05-08 14:18 - 00138643 ____N () C:\windows\Minidump\041815-42791-01.dmp
2015-04-18 19:05 - 2013-06-15 21:37 - 02025126 _____ () C:\windows\WindowsUpdate.log
2015-04-18 07:20 - 2014-01-11 17:58 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2015-04-18 07:15 - 2012-07-26 00:21 - 01400384 _____ () C:\windows\setupact.log
2015-04-17 22:10 - 2012-07-26 01:12 - 00000000 ____D () C:\windows\rescache
2015-04-16 01:42 - 2012-07-26 00:59 - 00000000 ____D () C:\windows\CbsTemp
2015-04-14 23:43 - 2014-05-08 09:51 - 00000000 ____D () C:\ProgramData\AVG2014
2015-04-14 23:42 - 2014-05-08 09:42 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\Avg2014
2015-04-14 14:00 - 2013-08-14 20:42 - 00000000 ____D () C:\windows\system32\MRT
2015-04-14 13:53 - 2013-06-29 12:39 - 128913832 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-04-14 13:27 - 2013-06-28 01:07 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-04-13 15:07 - 2014-10-18 14:09 - 00791520 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-04-13 15:07 - 2014-10-18 14:09 - 00177632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2014-05-09 17:30 - 2014-06-02 16:58 - 0000000 _____ () C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2013-12-06 19:02 - 2013-12-06 19:02 - 0005120 _____ () C:\Users\Goodwin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-04 01:22 - 2014-11-04 01:22 - 0000017 _____ () C:\Users\Goodwin\AppData\Local\resmon.resmoncfg
2014-02-20 16:35 - 2014-02-20 16:35 - 0000057 _____ () C:\ProgramData\Ament.ini
2013-06-15 21:38 - 2013-06-15 21:38 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-22 03:00

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-04-2015
Ran by [removed] at 2015-04-26 15:07:34
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2247873678-407546785-3609120540-500 - Administrator - Disabled)
Gabrielle (S-1-5-21-2247873678-407546785-3609120540-1002 - Limited - Enabled) => C:\Users\Gabrielle
Goodwin (S-1-5-21-2247873678-407546785-3609120540-1001 - Administrator - Enabled) => C:\Users\Goodwin
Grey (S-1-5-21-2247873678-407546785-3609120540-1003 - Limited - Enabled) => C:\Users\Grey
Guest (S-1-5-21-2247873678-407546785-3609120540-501 - Limited - Disabled)
Miichael (S-1-5-21-2247873678-407546785-3609120540-1004 - Limited - Enabled) => C:\Users\Miichael

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2014 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\…\{BFDEF3C4-C349-AE43-4D36-8814E4A9DC87}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AVG 2014 (HKLM\…\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4311 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
AVG Web TuneUp (HKLM-x32\…\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)
BioWare Premium Module: Neverwinter Nights(TM) Kingmaker (HKLM-x32\…\Neverwinter Nights(TM) Kingmaker) (Version: - BioWare Corp.)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Civilization V Deluxe Edition (HKLM-x32\…\{8BCC07D2-4841-4450-81AA-A074C0969C44}_is1) (Version: 1.0.0.0 - Catalog Games by Donald Dark)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
CrimeWatch (HKLM-x32\…\CrimeWatch) (Version: 3.0.51 - Great Apps)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
davehope.co.uk Product Key Finder (HKLM-x32\…\Product Key Finder_is1) (Version: - davehope.co.uk)
Fallen Enchantress: Legendary Heroes (HKLM-x32\…\Steam App 228260) (Version: - Stardock Entertainment)
GameSpy Arcade (HKLM-x32\…\GameSpy Arcade) (Version: - )
Google Drive (HKLM-x32\…\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Earth (HKLM-x32\…\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hoyle Board Games 2005 (HKLM-x32\…\{FB1CCBED-FA66-4D30-BFD7-EF20AD0A81FE}) (Version: 1.0.0.0 - Sierra Entertainment, Inc.)
Hoyle Puzzle Games 2005 (HKLM-x32\…\{A3EAB67E-9B37-4B74-AFE6-D418D5F6F3D4}) (Version: 1.0.0.0 - Sierra Entertainment, Inc.)
HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\HPConnectedMusic) (Version: 1.1 (build 71) hp - Meridian Audio Ltd)
HP Connected Remote (HKLM-x32\…\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1206 - Hewlett-Packard)
HP Deskjet 2540 series Basic Device Software (HKLM\…\{6A79CD11-0C1C-4E24-A8C6-46A02F680346}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Deskjet 2540 series Help (HKLM-x32\…\{4539575D-C09D-4E71-B207-0F2D6BD74DA2}) (Version: 30.0.0 - Hewlett Packard)
HP Keyboard (HKLM-x32\…\{B40D7926-AE5F-41EA-8AC6-56C0E2F00E9D}) (Version: 1.5.0.7 - Hewlett-Packard)
HP MyRoom (HKLM-x32\…\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Quick Start (HKLM-x32\…\{574F0207-8E98-46CD-8F79-318348C98C46}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Registration Service (HKLM\…\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6482.0 - IDT)
IMVU Avatar Chat Software (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\IMVU Avatar chat client software BETA) (Version: - )
iWin Games (HKLM-x32\…\iWinArcade) (Version: 2.91 - )
Java 7 Update 51 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Kerbal Space Program Demo (HKLM-x32\…\Steam App 231410) (Version: - Squad)
KeyFinder Thing (HKLM-x32\…\KeyFinder Thing_is1) (Version: 3.1.6.0 - KeyFinder Thing)
Magical Diary Demo 1.05 (HKLM-x32\…\Magical Diary - Horse Hall - Demo_is1) (Version: - Hanako Games)
Mahjong Quest 2 (remove only) (HKLM-x32\…\Mahjong Quest 2) (Version: - )
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\SkyDriveSetup.exe) (Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\…\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\…\{95140000-0137-0409-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Minecraft (HKLM-x32\…\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mini Nutcracker 2.0 (HKLM-x32\…\Mini Nutcracker_is1) (Version: - )
Mozilla Firefox 37.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 37.0.2 (x86 en-US)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 en-US) (HKLM-x32\…\Mozilla Thunderbird 31.6.0 (x86 en-US)) (Version: 31.6.0 - Mozilla)
NETGEAR Genie (HKLM-x32\…\NETGEAR Genie) (Version: 2.3.1.46 - NETGEAR Inc.)
Neverwinter Nights (HKLM-x32\…\{C1583439-B034-4881-819C-D52A0587662B}) (Version: - )
NoLimits 2 Roller Coaster Simulation Demo (HKLM-x32\…\Steam App 319260) (Version: - Ole Lange)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
OpenAL (HKLM-x32\…\OpenAL) (Version: - )
OpenOffice 4.0.0 (HKLM-x32\…\{55E61709-D7D4-43C0-B45D-BFAF5C09A02D}) (Version: 4.00.9702 - Apache Software Foundation)
Product Improvement Study for HP Deskjet 2540 series (HKLM\…\{DF34643B-A745-430C-B27B-A48F853C81E4}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
QuickShare (HKLM-x32\…\{232F1B14-7126-491F-AC8C-6123BA58FDE2}) (Version: 1.135.60.12323 - Linkury Inc.) <==== ATTENTION
Ralink Bluetooth Stack (HKLM\…\{C079427A-BB28-5168-3DB1-DC6608D226D4}) (Version: 11.0.748.2 - Mediatek)
Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\…\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.37.0 - Mediatek)
RE: Alistair++ 1 (HKLM-x32\…\RE: Alistair++) (Version: 1 - sakevisual)
Recover Keys (HKLM-x32\…\Recover Keys_is1) (Version: 7.0.3.87 - Recover Keys)
Recovery Manager (x32 Version: 5.5.0.5530 - CyberLink Corp.) Hidden
RemooveAdsTube (HKLM-x32\…\{B2F90C69-01B1-A3BD-92BF-12482B317A19}) (Version: - RemoveAdsTube) <==== ATTENTION
Rhapsody (HKLM-x32\…\Rhapsody) (Version: - )
ROBLOX Player (HKLM-x32\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
ROBLOX Player for Goodwin (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
ROBLOX Studio for Goodwin (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version: - ROBLOX Corporation)
Sanctum with Game Auto-Reconnect 1.70 (HKLM-x32\…\Sanctum with Game Auto-Reconnect 1.70) (Version: - )
Sanctum18 (HKLM-x32\…\Sanctum18) (Version: - )
Sid Meier's Civilization V (HKLM-x32\…\Steam App 8930) (Version: - 2K Games, Inc.)
Space Empires V (HKLM-x32\…\Steam App 1690) (Version: - Malfador Machinations)
Stardock Central (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Stardock Central) (Version: - Stardock Corporation)
Steam (HKLM-x32\…\Steam) (Version: - Valve Corporation)
Talisman: Digital Edition (HKLM-x32\…\Steam App 247000) (Version: - Nomad Games Limited)
Talisman: Prologue (HKLM-x32\…\Steam App 258200) (Version: - Nomad Games)
TeleTech WB ISA (HKLM-x32\…\TeleTech ISA) (Version: 1.0.3 - TeleTech)
Unity Web Player (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\UnityWebPlayer) (Version: - Unity Technologies ApS)
Visual Studio 2010 x64 Redistributables (HKLM\…\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Warlords IV (HKLM-x32\…\{7B31DF8A-8B77-497F-8180-E710A01635F1}) (Version: W4PCA0.8 - )
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\…\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Wizard101 (HKLM-x32\…\{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}) (Version: 1.0.0 - KingsIsle Entertainment, Inc.)
World Dance (HKLM-x32\…\{C83C2005-B030-11D5-8CE8-0003470BB21B}) (Version: 1.00.0000 - iSeeSoft, LLC)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\RobloxProxy64.dll (ROBLOX Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

11-04-2015 01:01:26 Installed Minecraft
14-04-2015 13:47:03 Windows Update
17-04-2015 15:12:14 Windows Update
25-04-2015 12:34:09 Scheduled Checkpoint
26-04-2015 13:27:13 Restore Point Created by FRST
26-04-2015 13:36:13 Restore Point Created by FRST

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-25 22:26 - 2015-04-26 13:36 - 00000035 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00B7DEA8-ECBC-4E8F-BE06-4DF0B01FFE7E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {0F940933-53AA-4DD4-96A3-D20C5CEF3701} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-02] (Google Inc.)
Task: {18AE6B43-6BBB-4C61-A78F-7031EF8320F3} - System32\Tasks\HPCeeScheduleForGoodwin => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {1EC67692-D030-4F2A-8862-4524D73443FE} - System32\Tasks\{D3D8769E-0C05-4832-8F78-4BEE75247A8B} => pcalua.exe -a I:\autorun.exe -d I:\
Task: {2346F637-175A-43B4-8D22-FFC94C952433} - System32\Tasks\HP AR Program Upload - 87c2b8b94a234ec1b1f2df9570ef26898a7e79ef6bf947298632f7a38de543f0 => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {34AD8598-3124-41FF-98FD-19572B8E227D} - System32\Tasks\HP AR Program Upload - 2c9e641036574d038458ec7eda3f44b340af2e07a949462385c4b4a33f2fba9e => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {363F7E37-9355-4908-9823-E1F70EC833F9} - System32\Tasks\{69CB7144-9591-4F36-A9AC-3FFB3521CCFE} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {36C125E2-F728-46D5-93B2-FBFC268E9FC6} - System32\Tasks\0215tb_RML => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe [2015-02-25] ()
Task: {5C1BEA64-AAEF-463C-A8C9-6E3C8B66005F} - System32\Tasks\HPCustParticipation HP Deskjet 2540 series => C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.)
Task: {7239477C-31B1-4599-97B0-CB3D129B5393} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {73CE9EFF-C7CA-46E4-BB10-11DC0FD70670} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {76F4FA71-A3B9-4521-94DB-4B5E61F5EEF9} - System32\Tasks\{48D6A4D4-FA1F-4FC8-B848-1AE9DB6E8076} => pcalua.exe -a I:\setup.exe -d I:\
Task: {8DD9F642-6BA9-4ED3-B0DB-CB76EF25607A} - System32\Tasks\HP AR Program Upload - 5cbdb67a0cdc4b40967efcd569863e1f83b5cb5fe05c4715b233b819873d2b0f => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {9D8714B9-5D3A-42B5-9294-B20268508356} - System32\Tasks\{F6A31C4C-AC87-4C93-B143-02929BFDA4C6} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {AD2886B7-F49E-46BD-BB2C-D3E0330ED9FF} - System32\Tasks\{B2ABEF8F-C628-491B-8733-300970C339E9} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {C2E170F4-488E-4A96-BF14-5DE45542AF5C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {C7EF3903-8E0C-420B-A73E-A597DFF78A66} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN3B72BGPZ => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-30] (Hewlett-Packard)
Task: {CA1A5AE0-6527-4DCE-8ED2-646FC94F28D5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-02] (Google Inc.)
Task: {D1C1A1A8-1D4F-4674-9918-27940067E0DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {E59944E8-D99D-454D-AD63-D3FCF731790D} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {EC89A5D9-EEC5-456D-883A-3A93D38EA4D8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-30] (Hewlett-Packard)
Task: {FC17416F-ED36-4D20-99D8-F1D382C2F649} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {FF6A0675-4E1D-4AB5-A3AF-FEC254124C7A} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-04-14] (Microsoft Corporation)
Task: C:\windows\Tasks\0215tb_RML.job => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForGoodwin.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) ==============

2015-03-03 09:32 - 2015-03-03 09:32 - 00620056 _____ () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
2014-03-19 15:13 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00016632 _____ () C:\windows\system32\BsHelpCSps.dll
2015-03-17 16:33 - 2015-01-27 08:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-02-25 18:16 - 2015-02-25 18:16 - 02794520 _____ () C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe
2014-11-06 08:28 - 2014-11-06 08:28 - 00105216 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
2013-11-01 16:48 - 2013-11-01 16:48 - 00029432 _____ () C:\windows\SYSTEM32\BsTrace.dll
2013-05-24 11:22 - 2013-05-24 11:22 - 00334648 _____ () C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\Driver\USB\tl_filter.dll
2011-07-05 11:53 - 2011-07-05 11:53 - 00012800 _____ () C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\Driver\AMP\IVTAMPRL.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00016632 _____ () C:\windows\SYSTEM32\BsHelpCSps.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00544817 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libgcc_s_dw2-1.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00989805 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libstdc++-6.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 03369922 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuin51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 01978690 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuuc51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 22378434 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icudt51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 01233408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\platforms\qwindows.dll
2014-11-17 02:46 - 2014-11-17 02:46 - 00639488 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll
2014-11-10 02:55 - 2014-11-10 02:55 - 01686016 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll
2014-11-05 00:36 - 2014-11-05 00:36 - 00192512 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll
2014-11-05 00:37 - 2014-11-05 00:37 - 00632832 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll
2014-11-14 03:53 - 2014-11-14 03:53 - 06499840 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll
2014-06-29 18:55 - 2014-06-29 18:55 - 00068608 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll
2014-06-29 19:05 - 2014-06-29 19:05 - 01183232 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\qwt.dll
2014-11-07 02:13 - 2014-11-07 02:13 - 02475520 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_MyMedia.dll
2012-10-15 13:27 - 2012-10-15 13:27 - 00111616 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlc.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 02286592 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlccore.dll
2014-11-17 00:00 - 2014-11-17 00:00 - 01056768 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll
2014-09-11 01:39 - 2014-09-11 01:39 - 00144896 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll
2014-11-05 00:51 - 2014-11-05 00:51 - 01191424 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll
2014-11-16 23:21 - 2014-11-16 23:21 - 10374656 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll
2014-11-16 23:18 - 2014-11-16 23:18 - 02496512 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll
2014-11-06 02:39 - 2014-11-06 02:39 - 00200192 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll
2014-11-05 00:58 - 2014-11-05 00:58 - 00889344 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll
2014-11-05 01:00 - 2014-11-05 01:00 - 00435712 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qgif.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00052224 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qico.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00261120 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qjpeg.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qsvg.dll
2014-06-29 18:55 - 2014-06-29 18:55 - 00081408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll
2014-11-03 01:23 - 2014-11-03 01:23 - 00143360 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnoseDll.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00072192 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SVTUtils.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00074240 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\NetcardApi.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00136704 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\airprintdll.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00219648 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\access\libdshow_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00049664 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libaout_directx_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libwaveout_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00070144 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\video_output\libdirectx_plugin.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00040960 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\printsupport\windowsprintersupport.dll
2014-11-05 00:59 - 2014-11-05 00:59 - 00642048 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_Update.dll
2014-11-05 01:01 - 2014-11-05 01:01 - 00458752 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll
2014-06-29 19:33 - 2014-06-29 19:33 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupApiPlugin.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00066560 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupDll.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CBSWFP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\svcinf => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\rhapsody.com -> hxxps://rhap-app-4-0.rhapsody.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Goodwin\Pictures\Fall 2014\IMG_2116.JPG
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\StartupApproved\StartupFolder: => "Send to OneNote.lnk"

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [Wininit-Shutdown-In-Rule-TCP-RPC] => (Allow) %systemroot%\system32\wininit.exe
FirewallRules: [Wininit-Shutdown-In-Rule-TCP-RPC-EPMapper] => (Allow) %systemroot%\system32\wininit.exe
FirewallRules: [ProximityUxHost-Sharing-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\proximityuxhost.exe
FirewallRules: [ProximityUxHost-Sharing-Out-TCP-NoScope] => (Allow) %SystemRoot%\system32\proximityuxhost.exe
FirewallRules: [NETDIS-DAS-In-UDP-Active] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [NETDIS-DAS-In-UDP] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [PlayTo-In-UDP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-UDP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-UDP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [TPMVSCMGR-Server-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-Out-TCP-NoScope] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-In-TCP] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-Out-TCP] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [{05695812-C221-4306-B1E3-F4D9527AE627}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{13E9AD47-CCCF-449C-AB67-846BEB1FBA27}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{EF69194A-7D6B-4B8F-880D-664C7F1E1451}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{4CA5FEDE-1DEB-495B-B07A-5647371402AD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{28526C92-1BA2-4B1D-AB6C-8AF5A8828E8A}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{FBF19D81-458C-4EAC-AEF7-7993B086F40B}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{7674D093-AF3D-46EC-B221-51492A5618E6}] => (Allow) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
FirewallRules: [{9707C6B1-673A-4358-8405-1EB238DE636E}] => (Allow) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
FirewallRules: [{FE971F4A-D487-4A8A-BD3F-2638FB5D2E38}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{ACB8A44E-4324-4809-B01F-AC1C606376EA}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{F19B755C-38C5-4079-A953-38D26F6FE07D}] => (Allow) C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{A25549F0-96EC-45B4-A590-1AD495975476}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{13572E51-C8A2-4523-998D-B114AF3BE7ED}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{D2FC8A8C-F309-40BF-B1C2-E9076E45DFAF}] => (Allow) C:\Program Files (x86)\Rhapsody\rhapsody.exe
FirewallRules: [{8F5A3D23-63FD-44C8-90E6-9867D1DDFFBF}] => (Allow) C:\Program Files (x86)\Rhapsody\rhapsody.exe
FirewallRules: [{469F6F38-FC8C-4416-96EF-6DA0BC74E712}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{E69F1964-40CB-4E7C-8FEE-FCDDCD60437A}] => (Allow) C:\Program Files (x86)\iWin Games\iWinGames.exe
FirewallRules: [{DC1DEB77-97F2-428D-9AE9-AAF935864070}] => (Allow) C:\Program Files (x86)\iWin Games\iWinGames.exe
FirewallRules: [{424CE373-0B54-4D85-8F29-FD76FCC0F8E5}] => (Allow) C:\Program Files (x86)\iWin Games\WebUpdater.exe
FirewallRules: [{963D6C07-A7D6-4BF6-922F-ECF0D853056E}] => (Allow) C:\Program Files (x86)\iWin Games\WebUpdater.exe
FirewallRules: [TCP Query User{1442F442-DFC7-45F6-8AFA-D75FA118C6B4}C:\program files (x86)\java\jre7\bin\java.exe] => (Block) C:\program files (x86)\java\jre7\bin\java.exe
FirewallRules: [UDP Query User{22EE7126-5D5B-4D7C-950C-72D4B156AF99}C:\program files (x86)\java\jre7\bin\java.exe] => (Block) C:\program files (x86)\java\jre7\bin\java.exe
FirewallRules: [{0FCC4463-94D0-412F-8AE0-97C96C60911E}] => (Allow) C:\Windows\System32\dmwu.exe
FirewallRules: [{63E25B38-7143-4A6F-B5BE-258FEB74F953}] => (Allow) C:\Windows\System32\dmwu.exe
FirewallRules: [{0694AC3A-2766-4C3F-899F-E56842875EF3}] => (Allow) C:\Windows\SysWOW64\ARFC\wrtc.exe
FirewallRules: [{92016463-A1B4-467C-BD7C-21B1E8BDA3DE}] => (Allow) C:\Windows\SysWOW64\ARFC\wrtc.exe
FirewallRules: [TCP Query User{398837B2-74C2-4F5A-986E-CB192A0D224C}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{9BF95850-BAFC-4887-AE06-77D38D32D196}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [TCP Query User{B1484ADD-B8EF-4BE0-88FA-0294E41AE2D6}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{2DB682B6-0816-4F90-B461-7E2927295CCF}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{C5B58895-144E-4F28-926F-C6C7A6284DCB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FE Legendary Heroes\LegendaryHeroes.exe
FirewallRules: [{F95FF210-1582-47DF-B3AD-473DD5D8F819}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FE Legendary Heroes\LegendaryHeroes.exe
FirewallRules: [TCP Query User{B6A24E09-D7EB-4BBE-82F2-BAF9B00DE553}C:\program files\java\jre7\bin\javaw.exe] => (Block) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{260357B4-D045-4404-9BA2-CFC0735FBD6A}C:\program files\java\jre7\bin\javaw.exe] => (Block) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [TCP Query User{7369D6A1-94C3-4DA1-A179-1294C258C3A2}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [UDP Query User{EC81A083-2B2E-4F28-8E17-A4EA27EC2F68}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [{5C219451-7A77-4E9E-9648-454A7C24446C}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{B7321D76-5496-4F00-A834-A67328A376DC}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
FirewallRules: [{BAA8DE38-82A9-445D-88B5-5AB30E6FCCEC}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
FirewallRules: [{F3EB8FC1-9464-4C58-8101-679918FCD0F5}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe
FirewallRules: [{99808AC6-6B1F-4312-8D3A-9777E5B4BC02}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe
FirewallRules: [{808E8E57-6B82-4DD8-AD86-874ED7BA7A25}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
FirewallRules: [{BF77AAF6-8A9B-4DA7-80F9-95CEDB4DCC51}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
FirewallRules: [TCP Query User{FEEEC1A5-C8FD-46B5-A468-16BD4715BC9D}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exe
FirewallRules: [UDP Query User{11B995F8-920C-4B15-82A3-FF1D2A0625D6}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exe
FirewallRules: [{BEA82213-CDD1-4855-A2DE-5D9241184DCB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{B8E26DA6-50EA-454C-8DC4-1F823314E943}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{C6386F13-5372-421A-8CBE-BF82E808CC8A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{5270A54A-3E3F-418B-BA53-9B971EFF0632}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{BCBE3D0B-BA34-4885-ADF7-0F0BEC2C6CDE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{F529E9C0-4B59-40AC-85C7-F5021DF37FFC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{3E183497-7B48-467F-AD62-4C22CCDAE433}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FE Legendary Heroes\LegendaryHeroes.exe
FirewallRules: [{873B8233-223D-4C01-954C-3163490FB898}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FE Legendary Heroes\LegendaryHeroes.exe
FirewallRules: [{DC3D536D-D00D-4C58-9424-4C17D6607D37}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FE Legendary Heroes\LegendaryHeroes.exe
FirewallRules: [{B90FCC71-D85F-4D49-8C11-02CE38E7CD6D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FE Legendary Heroes\LegendaryHeroes.exe
FirewallRules: [{A3CBE670-4C0D-4CFB-8D93-27B49A5635A3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\SpaceEmpiresV\SE5\SE5.exe
FirewallRules: [{9512AC96-C8B5-48CB-9A1E-83D0CB6D1022}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\SpaceEmpiresV\SE5\SE5.exe
FirewallRules: [TCP Query User{536D62B2-2604-449F-B240-DCDDA1E74DB1}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{6066C045-0443-4310-B4AF-24A8897EBA0E}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{A953EF48-F7C3-4046-AF91-EF233022AF25}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS7355\HPDiagnosticCoreUI.exe
FirewallRules: [{9ABF18C2-5FBC-4ADF-82B5-1C81B0C3B110}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS7355\HPDiagnosticCoreUI.exe
FirewallRules: [{0F164C73-1BA0-497E-85ED-A41739C9315E}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS180A\HPDiagnosticCoreUI.exe
FirewallRules: [{09993829-66E6-4ABE-A6B6-1F6059BF6D02}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS180A\HPDiagnosticCoreUI.exe
FirewallRules: [TCP Query User{1EBE3BA4-CCF3-4DA0-8CB9-CB7AF67970AA}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [UDP Query User{00180360-0520-4252-BAEE-2A20E094CD57}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [{60BAC163-F5C5-433D-BD9A-00E919ACF367}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS3455\HPDiagnosticCoreUI.exe
FirewallRules: [{62924957-A5A8-44DF-BC6B-16AD47DD2BA7}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS3455\HPDiagnosticCoreUI.exe
FirewallRules: [{8E00D0F1-2749-477F-A6E3-340CBAFD9C7A}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS5511\HPDiagnosticCoreUI.exe
FirewallRules: [{AC7EFE0C-1724-4474-887F-3981615D7083}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS5511\HPDiagnosticCoreUI.exe
FirewallRules: [{38E8ED6C-4129-42C3-ADF0-CCD25584D8BA}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe
FirewallRules: [{2938F228-A3CB-4A81-8C6A-5D0FDF2DA151}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe
FirewallRules: [{60123DEC-79E2-44BE-8CF9-D0C29341BFC2}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{7889CC8D-0EC2-4A6A-A057-D8050DE6C764}] => (Allow) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
FirewallRules: [{DDC6D682-1A0A-495B-B912-1D34CCCC0635}] => (Allow) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
FirewallRules: [{1D54E38B-A94B-4C0F-86DC-39D2C53B1108}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS267E\HPDiagnosticCoreUI.exe
FirewallRules: [{4DA27258-16BC-4E65-8D0F-B298B8789180}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS267E\HPDiagnosticCoreUI.exe
FirewallRules: [{36549049-E886-4551-98D7-018ADCDC414D}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS26E7\HPDiagnosticCoreUI.exe
FirewallRules: [{88CF446C-2FB5-4942-9994-E828FAD6F8E2}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS26E7\HPDiagnosticCoreUI.exe
FirewallRules: [{423C0111-B2C3-420B-980E-484F6ED7F0C9}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{E067BE79-7B60-4D3D-B6BE-494B1C5C3005}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{A30B2B7D-B896-4487-9286-4E35AB1E6CF7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Talisman Prologue\Talisman.exe
FirewallRules: [{B92E44BE-C387-4BA4-9393-9793BF725BC7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Talisman Prologue\Talisman.exe
FirewallRules: [{6BFCD3A5-1B7C-46AF-800F-0C53A4D554E6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Talisman\Talisman.exe
FirewallRules: [{D43C6E45-E341-49B1-9DDF-D5A97F121217}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Talisman\Talisman.exe
FirewallRules: [{8893FEA2-5967-4105-95D1-2E6736F83DD3}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
FirewallRules: [{8F6ED0C7-5E59-4279-BE1B-BCBBEC1FB140}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
FirewallRules: [{B6BE2F94-28D2-42A0-92B5-1B118A3E2F5E}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgdiagex.exe
FirewallRules: [{E78CEA7B-E405-494A-95D9-3723F7B8EBD9}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgdiagex.exe
FirewallRules: [{D84A77AE-F730-4A29-9C6B-A9A7A737EDA0}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
FirewallRules: [{94F11A1B-D644-4024-8433-7EAEAD29B0F6}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
FirewallRules: [{D8CAFF58-61BC-48A6-8824-473488C3C580}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AF0B1ABE-E677-4975-B58D-4CBA422FC7AB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A126729B-A79D-4DA6-8828-3BC830FB0420}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS3C52\HPDiagnosticCoreUI.exe
FirewallRules: [{9B7FB6DE-687B-4B2F-9161-1E5285CC8F2D}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS3C52\HPDiagnosticCoreUI.exe
FirewallRules: [{FE12C3BE-C21F-4982-BB02-4AD8B5222A3E}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS3CE5\HPDiagnosticCoreUI.exe
FirewallRules: [{3AC3FA4C-3EC7-4D9B-B43C-D6A8D8246B7C}] => (Allow) C:\Users\Goodwin\AppData\Local\Temp\7zS3CE5\HPDiagnosticCoreUI.exe
FirewallRules: [{A6A4775F-E99A-4DAD-BA6B-F7C9DEF1BA5D}] => (Allow) C:\Program Files\HP\HP Deskjet 2540 series\Bin\DeviceSetup.exe
FirewallRules: [{AB5DFEE8-C9C3-4B6B-BC17-14C66E3E4ABD}] => (Allow) C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{40E9FD7B-E767-49E2-AEB9-805873081189}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Kerbal Space Program Demo\KSP.exe
FirewallRules: [{54FE8DBF-ED00-4340-86C0-66B1EDCA100A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Kerbal Space Program Demo\KSP.exe
FirewallRules: [{6EF94B6F-6779-447E-A4D5-87841E691314}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [TCP Query User{19A4A402-90A1-4412-A65F-F45E295076B7}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{025ECCCB-19F4-48B6-8AA0-8E8F1291AFDB}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{447D9213-1506-4504-8162-4BA8D750C1DA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\NoLimits 2 Demo\64bit\nolimits2app.exe
FirewallRules: [{0027176E-97D5-425D-8217-CF829F4DD61B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\NoLimits 2 Demo\64bit\nolimits2app.exe
FirewallRules: [{85A21375-620F-4932-AD3C-2440D141B500}] => (Allow) C:\Users\Goodwin\AppData\Local\TNT2\2.0.0.1976\TNT2User.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (04/26/2015 03:07:44 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/26/2015 03:07:29 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/26/2015 03:07:14 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/26/2015 03:06:59 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/26/2015 03:06:44 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/26/2015 03:06:29 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/26/2015 03:06:14 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/26/2015 03:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   17 [removed].in-addr.arpa. PTR GoodwinPC.local.

Error: (04/26/2015 03:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.1.2:5353   19 [removed].in-addr.arpa. PTR GoodwinPC-2.local.

Error: (04/26/2015 03:06:07 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Windows cannot access the file for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program HP LED INDICATOR because of this error.

Program: HP LED INDICATOR
File:

The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
   - It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
   - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.

Additional Data
Error value: 00000000
Disk type: 0

System errors:
=============
Error: (04/26/2015 03:07:36 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/26/2015 03:04:59 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 3:00:47 PM on ‎4/‎26/‎2015 was unexpected.

Error: (04/26/2015 03:00:47 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 2:21:31 PM on ‎4/‎26/‎2015 was unexpected.

Error: (04/26/2015 01:44:22 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/26/2015 01:36:55 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error:
%%1056

Error: (04/26/2015 01:36:39 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/26/2015 01:36:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (04/26/2015 01:36:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The HP Support Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (04/26/2015 01:36:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The HP Connected Remote Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Error: (04/26/2015 01:36:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Microsoft Office Sessions:
=========================
Error: (04/26/2015 03:07:44 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/26/2015 03:07:29 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/26/2015 03:07:14 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/26/2015 03:06:59 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/26/2015 03:06:44 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/26/2015 03:06:29 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/26/2015 03:06:14 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/26/2015 03:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   17 [removed].in-addr.arpa. PTR GoodwinPC.local.

Error: (04/26/2015 03:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.1.2:5353   19 [removed].in-addr.arpa. PTR GoodwinPC-2.local.

Error: (04/26/2015 03:06:07 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: HP LED INDICATOR000000000

==================== Memory info ===========================

Processor: AMD A10-5700 APU with Radeon™ HD Graphics
Percentage of memory in use: 24%
Total physical RAM: 7575.3 MB
Available physical RAM: 5709.07 MB
Total Pagefile: 7975.3 MB
Available Pagefile: 6014.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1850.69 GB) (Free:1709.85 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:10.85 GB) (Free:1.32 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: EDF89B76)

Partition: GPT Partition Type.

==================== End Of Log ============================

ken545

Post #25April 26, 2015, 10:18 PM UTC

iWin Games comes bundled with garbage that is considered Ad Ware, see if you can go to Programs and Features in the Control Panel and uninstall it

Either way, run this quick fix

Attachments:

📎Fixlist.txt

Clstlg

Post #26April 26, 2015, 10:30 PM UTC

It was listed in my programs, but when I tried to uninstall it–I got a "this is already uninstalled, but we'll take it off your programs list" message.

I ran the Fixlist, but I didn't get a log. Is that right?

Clstlg

Post #27April 26, 2015, 10:32 PM UTC

I just looked up iWin and it is one that my children like. Is there any way to download the games without the adware?

Clstlg

Post #28April 26, 2015, 10:37 PM UTC

Scrap that…it was hiding on the other side of the desktop…

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-04-2015
Ran by [removed] at 2015-04-26 15:24:52 Run:3
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
S2 iWinTrusted; C:\Program Files (x86)\iWin Games\iWinTrusted.exe [X]
EmptyTemp:
End

*****************

Processes closed successfully.
iWinTrusted => Service deleted successfully.
EmptyTemp: => Removed 107.7 MB temporary data.

The system needed a reboot.

==== End of Fixlog 15:25:09 ====

ken545

Post #29April 26, 2015, 10:46 PM UTC

Lots of game sites , some have problems with Ad Ware. I really dont know how to download any iWin Games without adware

Some sites say its safe to use and some are questionable, the thing here is that its not a virus , maybe just giving you a few adds, its up to you if you want to put up with it.

AdwCleaner removed it

Folder Deleted : C:\Program Files (x86)\iWin.com Games

Clstlg

Post #30April 26, 2015, 10:49 PM UTC

OK…I'll talk to the children about it.

Did all this take care of the PCKeeper too?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Yahoo, pop-ups, and underlines--Oh My! [Solved]

✨ Ask AI

Ask AI