Spyware / Malware / Virus Removal

Dollarsaver Infection [Solved]

18 min read

Looking for the outcome? Ask AI

cranmergirl

Post #16May 9, 2015, 12:38 PM UTC last edited May 9, 2015, 12:49 PM UTC

Good Morning Ken545,

I did everything as instructed but ran into a problem this morning. I ran the ESET scan last night (it takes almost 3 hours on my computer.) I checked Remove Found Threats and this morning, there were 7 threats identified. I created a txt file of the log, then checked remove quarantined items and closed ESET scanner. Full disclosure….I also downloaded critical updates for Windows yesterday: 1) Microsoft .NET Framework 4.5.2 for Windows 7 x64-based Systems (KB2901983) 52.4 MB and 2) Update for Windows 7 for x64-based Systems (KB3021917) 420 KB.

After closing out the ESET scanner, I tried going online to post the txt file to you and was unable to get online. My computer was showing a full internet connection but I was unable to get on the internet through any browser (internet explorer, mozilla firefox, aol). I rebooted and when that didn't work, I rebooted my Linksys router. That didn't work either. My husband has been able to access the internet the entire time. So I figure that I either removed something crucial when I checked the ESET scanner to remove quarantined items or one of those two Windows updates did something strange to my internet connection. I did System Restore. Went back to May 7 at 4:32:17pm and now everything went back to normal.

I will follow your instructions again starting with May 7 (the adw cleaner is back on my desktop) and run the ESET scan and post the log file. I will delete the downloads now before the scan.

Look forward to hearing what you think happened. Thanks!

PS When going through the above steps, I saw this logfile on my desktop. Don't ask me how it got there since the computer was restored to May 7 but this is the ESET Scan results from earlier today:

C:\Windows\SysWOW64\LavasoftTcpService.dll   a variant of Win32/Packed.Komodia.A potentially unwanted application
C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftLSPInstaller.exe   a variant of Win32/Packed.Komodia.A potentially unwanted application   deleted - quarantined
C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.dll   a variant of Win32/Packed.Komodia.A potentially unwanted application   deleted - quarantined
C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe   a variant of Win32/Packed.Komodia.A potentially unwanted application   deleted (after the next restart) - quarantined
C:\Windows\Installer\77e08e.msi   a variant of Win32/Packed.Komodia.A potentially unwanted application   deleted - quarantined
C:\Windows\System32\LavasoftTcpService.dll   a variant of Win32/Packed.Komodia.A potentially unwanted application   deleted (after the next restart) - quarantined
Operating memory   a variant of Win32/Packed.Komodia.A potentially unwanted application   contained infected files

ken545

Post #17May 9, 2015, 2:05 PM UTC

Komodia.A , seems to have infected a few files

Looks like removing Lavasoft TcpService was the problem, why dont you try just uninstalling Lavasofts programs and when were done we can discuss programs that may help keeping you more secure

ken545

Post #18May 9, 2015, 5:44 PM UTC

Been reading up on Lavasoft, some other people have been having issues with it to, after you uninstall it reboot your system to make sure all is ok then open up FRST, check mark Additions, run a new scan and post both new logs please

cranmergirl

Post #19May 9, 2015, 8:22 PM UTC

Hi again,

Here is a rundown of what I have done since my System Restore of this morning; went back to your May 7 evening post and redid everything as follows:

1) Removed quarantined items in Malwarebytes;

2) Uninstalled ADWCleaner;

3) Cleaned out Downloads folder as instructed;

4) Ran ESET Scan…here is log:

C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftLSPInstaller.exe   a variant of Win32/Packed.Komodia.A potentially unwanted application
C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.dll   a variant of Win32/Packed.Komodia.A potentially unwanted application
C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe   a variant of Win32/Packed.Komodia.A potentially unwanted application
C:\Windows\Installer\77e08e.msi   a variant of Win32/Packed.Komodia.A potentially unwanted application
C:\Windows\System32\LavasoftTcpService.dll   a variant of Win32/Packed.Komodia.A potentially unwanted application
C:\Windows\SysWOW64\LavasoftTcpService.dll   a variant of Win32/Packed.Komodia.A potentially unwanted application
Operating memory   a variant of Win32/Packed.Komodia.A potentially unwanted application

5) Uninstalled Lavasoft (Web Companion)….still have no idea how that software made its way into my computer….I did not intentionally download it and I think I am fairly careful (apparently, not careful enough!);

6) Rebooted my computer;

7) Ran FRST scan; here are both logs:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2015
Ran by [removed] (administrator) on BEACHMASTER-HP on 09-05-2015 14:13:42
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Two Pilots) C:\Windows\VPDAgent_x64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Carbonite, Inc. (www.carbonite.com)) C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
(CinemaNow, Inc.) C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(PFU LIMITED) C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardLauncher.exe
() C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe
(PFU LIMITED) C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\AOL\1380287399\ee\aolsoftware.exe
(Hewlett-Packard Company) C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\Digital Imaging\bin\HpqSRmon.exe
(PFU LIMITED) C:\Windows\SSDriver\fi5110\SsWiaChecker.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Carbonite, Inc.) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(PFU LIMITED) C:\Program Files (x86)\PFU\ScanSnap\SSFolder\SSFolderTray.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(The Neat Company) C:\Program Files (x86)\Neat\exec\NeatStartupService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM\…\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\…\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [570152 2014-08-14] (Acronis)
HKLM-x32\…\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [563736 2009-10-14] (PDF Complete Inc)
HKLM-x32\…\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1380287399\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.)
HKLM-x32\…\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\…\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [ScanSnap WIA Service Checker] => C:\Windows\SSDriver\fi5110\SsWiaChecker.exe [86016 2009-09-30] (PFU LIMITED)
HKLM-x32\…\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2014-05-08] (Adobe Systems Inc.)
HKLM-x32\…\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [Carbonite Backup] => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe [1063632 2015-01-19] (Carbonite, Inc.)
HKLM-x32\…\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5306776 2014-11-27] (Acronis)
HKLM-x32\…\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [603904 2014-10-17] (Acronis International GmbH)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [109480 2015-01-15] (SlySoft, Inc.)
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [Garmin Lifetime Updater] => C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [Desktop Software] => "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe" /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [ComcastAntispyClient] => "C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" /hide
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [GarminExpressTrayApp] => "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe –minimize
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-18\…\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\tray.exe [1010008 2015-04-08] (Garmin Ltd. or its subsidiaries)
HKU\S-1-5-18\…\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-12-17] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CardMinder Viewer.lnk [2012-09-09]
ShortcutTarget: CardMinder Viewer.lnk -> C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardLauncher.exe (PFU LIMITED)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Conversion to PDF with ScanSnap Organizer.lnk [2012-09-09]
ShortcutTarget: Conversion to PDF with ScanSnap Organizer.lnk -> C:\Program Files (x86)\PFU\ScanSnap\Organizer\PfuSsOrgOcrChk.exe (PFU LIMITED)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ImageBrowser EX Agent.lnk [2013-06-14]
ShortcutTarget: ImageBrowser EX Agent.lnk -> C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanSnap Manager.lnk [2012-09-09]
ShortcutTarget: ScanSnap Manager.lnk -> C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe (PFU LIMITED)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish PictureMover.lnk [2010-12-17]
ShortcutTarget: Snapfish PictureMover.lnk -> C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
ShellIconOverlayIdentifiers: [ Carbonite.Green] -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers: [ Carbonite.Partial] -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers: [ Carbonite.Yellow] -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [Carbonite.Green] -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers: [Carbonite.Partial] -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers: [Carbonite.Yellow] -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: [ Carbonite.Green] -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: [ Carbonite.Partial] -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: [ Carbonite.Yellow] -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: [Carbonite.Green] -> {95A27763-F62A-4114-9072-E81D87DE3B68} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: [Carbonite.Partial] -> {E300CD91-100F-4E67-9AF3-1384A6124015} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)
ShellIconOverlayIdentifiers-x32: [Carbonite.Yellow] -> {5E529433-B50E-4bef-A63B-16A6B71B071A} => C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll [2015-01-19] (Carbonite, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.foxnews.com|www.google.com
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
SearchScopes: HKLM -> DefaultScope {0C7A60FC-387F-422A-845B-753E095A9DEE} URL = http://www.bing.com/search?q={searchTerms}&form;=HPDTDF&pc;=HPDTDF&src;=IE-SearchBox
SearchScopes: HKLM -> {0C7A60FC-387F-422A-845B-753E095A9DEE} URL = http://www.bing.com/search?q={searchTerms}&form;=HPDTDF&pc;=HPDTDF&src;=IE-SearchBox
SearchScopes: HKLM -> {46C84E52-52FB-484D-8D7A-C039DF6C995A} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {6F99C7B0-85C6-4E0C-97FF-55DC77C33EFC} URL = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=chr-hp-psg&type;=HPDTDF
SearchScopes: HKLM-x32 -> DefaultScope {0C7A60FC-387F-422A-845B-753E095A9DEE} URL = http://www.bing.com/search?q={searchTerms}&form;=HPDTDF&pc;=HPDTDF&src;=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0C7A60FC-387F-422A-845B-753E095A9DEE} URL = http://www.bing.com/search?q={searchTerms}&form;=HPDTDF&pc;=HPDTDF&src;=IE-SearchBox
SearchScopes: HKLM-x32 -> {46C84E52-52FB-484D-8D7A-C039DF6C995A} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {6F99C7B0-85C6-4E0C-97FF-55DC77C33EFC} URL = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=chr-hp-psg&type;=HPDTDF
SearchScopes: HKU\S-1-5-21-2199333989-2354862195-3862359076-1001 -> DefaultScope {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2199333989-2354862195-3862359076-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?pc=COSP&ptag;=D040415-A510D0E105D5B4CC49CF&form;=CONBDF&conlogo;=CT3330941&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-2199333989-2354862195-3862359076-1001 -> {74A7284D-4B38-4C27-AD3D-29DE1E376C2F} URL = http://www.microsoft.com/windows/compatibility/windows-7/en-us/Search.aspx?type=Hardware&s;={searchTerms}
SearchScopes: HKU\S-1-5-21-2199333989-2354862195-3862359076-1001 -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = https://www.google.com/search?q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-04] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Updater For XFIN_PORTAL -> {bb46be07-13eb-4c49-b0f0-fc78b9ea4983} -> C:\Program Files (x86)\xfin_portal\auxi\comcastAu.dll No File
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-04] (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Tcpip\Parameters: [DhcpNameServer] 10.169.238.110

FireFox:
========
FF ProfilePath: C:\Users\Beachmaster\AppData\Roaming\Mozilla\Firefox\Profiles\vmyp5gkj.default-1417057766930
FF DefaultSearchEngine: Google
FF DefaultSearchEngine.US: Google
FF SelectedSearchEngine: Google
FF Homepage: www.foxnews.com|www.google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-05-06] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-05-06] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()
FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll [2008-10-15] (CANON INC.)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2013-04-03] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2013-04-03] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-04] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @viewpoint.com/VMP -> C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll [2004-02-20] ()
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2199333989-2354862195-3862359076-1001: @hulu.com/Hulu Desktop -> C:\Windows\..\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\npHDPlg.dll [2010-04-09] (Hulu LLC)
FF Plugin HKU\S-1-5-21-2199333989-2354862195-3862359076-1001: CouponNetwork.com/CMDUniversalCouponPrintActivator -> C:\Users\Beachmaster\AppData\Roaming\Catalina – Print Savings\npBcsKtTcIO.dll [2013-06-07] (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll [2011-09-06] (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-06-08] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-06-08] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-06-08] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-06-08] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-06-08] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll [2012-10-19] (Coupons, Inc.)
FF Extension: Start Page - C:\Users\Beachmaster\AppData\Roaming\Mozilla\Firefox\Profiles\vmyp5gkj.default-1417057766930\Extensions\{7ec0d03e-d893-49f1-8db7-614e27b2a9c7} [2015-04-03]
FF Extension: Adblock Plus - C:\Users\Beachmaster\AppData\Roaming\Mozilla\Firefox\Profiles\vmyp5gkj.default-1417057766930\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-02]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-09-10]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Agent; C:\Windows\VPDAgent_x64.exe [148480 2013-11-14] (Two Pilots) [File not signed]
R2 FoxitCloudUpdateService; C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe [244392 2015-04-10] (Foxit Software Inc.)
S2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [708616 2015-04-08] (Garmin Ltd. or its subsidiaries)
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 Neat Startup Service; C:\Program Files (x86)\Neat\exec\NeatStartupService.exe [5632 2014-01-03] (The Neat Company) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-14] (PDF Complete Inc)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HP Health Check Service; "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [150440 2014-12-23] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [150440 2014-12-23] (SlySoft, Inc.)
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [296736 2015-02-11] (Acronis International GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-05-09] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1328928 2015-02-11] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [234784 2015-02-11] (Acronis International GmbH)
S1 MpKsl4d6db7a0; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A56B984C-4700-4736-97D5-EACD147DDDF1}\MpKsl4d6db7a0.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-09 14:13 - 2015-05-09 14:14 - 00026742 _____ () C:\Users\Beachmaster\Desktop\FRST.txt
2015-05-09 14:13 - 2015-05-09 14:13 - 00000000 ____D () C:\Users\Beachmaster\Desktop\FRST-OlderVersion
2015-05-09 14:07 - 2015-05-09 14:07 - 00000000 _____ () C:\Windows\SysWOW64\shoA1D0.tmp
2015-05-09 13:59 - 2015-05-09 13:59 - 00000891 _____ () C:\Users\Beachmaster\Desktop\ESETScan05 09 2015.txt
2015-05-09 08:44 - 2015-05-09 08:44 - 02347384 _____ (ESET) C:\Users\Beachmaster\Desktop\esetsmartinstaller_enu.exe
2015-05-07 16:27 - 2015-05-07 16:27 - 00000000 ____D () C:\Users\Public\Foxit Software
2015-05-07 16:26 - 2015-05-09 08:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2015-05-07 16:26 - 2015-05-07 16:26 - 00002111 _____ () C:\Users\Public\Desktop\Foxit Reader.lnk
2015-05-07 16:26 - 2015-05-07 16:26 - 00002111 _____ () C:\ProgramData\Desktop\Foxit Reader.lnk
2015-05-07 10:05 - 2015-05-07 10:05 - 00000000 ____D () C:\ProgramData\Viewpoint
2015-05-07 10:05 - 2015-05-07 10:05 - 00000000 ____D () C:\Program Files (x86)\Viewpoint
2015-05-07 10:00 - 2015-05-09 08:04 - 00000000 ____D () C:\Program Files (x86)\AOL Desktop 9.7a
2015-05-07 09:47 - 2015-05-07 09:47 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-05-07 09:47 - 2015-05-07 09:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-05-07 09:47 - 2015-05-07 09:47 - 00002009 _____ () C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2015-05-07 09:47 - 2015-05-07 09:47 - 00002009 _____ () C:\ProgramData\Desktop\Acrobat Reader DC.lnk
2015-05-05 16:17 - 2015-05-09 14:11 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-05 16:17 - 2015-05-05 16:17 - 00001068 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-05 16:17 - 2015-05-05 16:17 - 00001068 _____ () C:\ProgramData\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-05 16:17 - 2015-05-05 16:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-05 16:17 - 2015-05-05 16:17 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-05 16:17 - 2015-05-05 16:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-05-05 16:17 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-05 16:17 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-05 16:17 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-05 14:45 - 2015-05-05 14:45 - 00000000 __SHD () C:\found.000
2015-05-05 14:18 - 2015-05-05 14:18 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-BEACHMASTER-HP-Windows-7-Home-Premium-(64-bit).dat
2015-05-05 14:17 - 2015-05-05 14:17 - 02716306 _____ (Thisisu) C:\Users\Beachmaster\Desktop\JRT.exe
2015-05-05 14:17 - 2015-05-05 14:17 - 00000000 ____D () C:\RegBackup
2015-05-05 14:06 - 2015-05-05 14:06 - 00276648 _____ () C:\Windows\Minidump\050515-39998-01.dmp
2015-05-05 01:16 - 2015-05-09 13:59 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-05 01:16 - 2015-05-06 11:33 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-05 01:16 - 2015-05-06 11:33 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 01:16 - 2015-05-06 11:33 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-04 15:43 - 2015-05-09 14:13 - 00000000 ____D () C:\FRST
2015-05-04 15:42 - 2015-05-09 14:13 - 02102784 _____ (Farbar) C:\Users\Beachmaster\Desktop\FRST64.exe
2015-05-02 16:20 - 2015-05-02 16:20 - 00001125 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-02 16:20 - 2015-05-02 16:20 - 00001113 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-05-02 16:20 - 2015-05-02 16:20 - 00001113 _____ () C:\ProgramData\Desktop\Mozilla Firefox.lnk
2015-05-02 16:20 - 2015-05-02 16:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-30 22:13 - 2015-05-02 08:24 - 00000000 ____D () C:\Program Files (x86)\Whiskey Militia Countdown Timer
2015-04-30 14:48 - 2015-05-02 16:20 - 00000000 ____D () C:\Program Files (x86)\mozilla firefox
2015-04-30 14:11 - 2015-05-02 08:24 - 00000000 ____D () C:\ProgramData\cheap-o
2015-04-17 09:36 - 2015-04-17 09:36 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2015-04-14 17:09 - 2015-04-14 17:09 - 18178736 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-04-10 05:10 - 2015-04-10 05:10 - 00000000 ____D () C:\Users\Default\AppData\Local\Garmin_Ltd._or_its_subsid
2015-04-10 05:10 - 2015-04-10 05:10 - 00000000 ____D () C:\Users\Default User\AppData\Local\Garmin_Ltd._or_its_subsid
2015-04-10 05:08 - 2015-04-10 05:08 - 00001852 _____ () C:\Users\Public\Desktop\Garmin Express.lnk
2015-04-10 05:08 - 2015-04-10 05:08 - 00001852 _____ () C:\ProgramData\Desktop\Garmin Express.lnk
2015-04-10 05:08 - 2015-04-10 05:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-09 14:08 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-09 14:08 - 2009-07-14 00:51 - 00081082 _____ () C:\Windows\setupact.log
2015-05-09 14:07 - 2010-12-17 10:00 - 01689069 _____ () C:\Windows\WindowsUpdate.log
2015-05-09 12:49 - 2011-04-11 22:25 - 00003974 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{0A98C437-5501-4B46-875A-8AF89AC922A9}
2015-05-09 11:10 - 2012-09-10 09:54 - 00000000 ____D () C:\Users\Beachmaster\Documents\ScanSnap
2015-05-09 08:13 - 2009-07-14 00:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-09 08:13 - 2009-07-14 00:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-09 08:03 - 2011-04-11 19:04 - 00000000 ____D () C:\Users\Beachmaster
2015-05-09 08:00 - 2015-04-07 09:10 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-09 08:00 - 2015-02-19 16:13 - 00000000 ____D () C:\Program Files (x86)\AOL Desktop 9.7
2015-05-09 08:00 - 2014-12-10 04:52 - 00000000 ____D () C:\Windows\system32\appraiser
2015-05-09 08:00 - 2014-07-09 03:03 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-05-09 08:00 - 2011-05-27 14:27 - 00000000 ____D () C:\Users\Drew.Beachmaster-HP
2015-05-09 08:00 - 2011-04-12 13:14 - 00000000 ____D () C:\Users\Kelly
2015-05-09 08:00 - 2010-12-17 10:09 - 00000000 ____D () C:\ProgramData\CinemaNow
2015-05-09 08:00 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-09 08:00 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
2015-05-09 08:00 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\AppCompat
2015-05-09 08:00 - 2009-07-13 23:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-05-09 07:59 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\registration
2015-05-09 07:58 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-05-09 07:52 - 2011-04-25 08:41 - 00000000 __RHD () C:\MSOCache
2015-05-09 07:52 - 2011-04-12 00:57 - 00000000 ____D () C:\Users\Beachmaster\AppData\Roaming\SoftGrid Client
2015-05-08 23:08 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\tracing
2015-05-08 16:41 - 2013-09-03 17:18 - 00000000 ____D () C:\ProgramData\boost_interprocess
2015-05-07 16:43 - 2013-08-15 03:00 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-07 14:08 - 2011-04-12 11:14 - 00000000 ____D () C:\Users\Beachmaster\AppData\Roaming\HpUpdate
2015-05-07 11:10 - 2012-02-08 22:29 - 00000000 ____D () C:\Users\Beachmaster\AppData\Local\Adobe
2015-05-07 11:10 - 2011-04-11 19:10 - 00000000 ____D () C:\Users\Beachmaster\AppData\Roaming\Adobe
2015-05-07 10:06 - 2015-02-19 16:16 - 00001000 _____ () C:\Users\Public\Desktop\AOL Desktop 9.7.lnk
2015-05-07 10:06 - 2015-02-19 16:16 - 00001000 _____ () C:\ProgramData\Desktop\AOL Desktop 9.7.lnk
2015-05-07 10:06 - 2015-02-19 16:16 - 00000932 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\AOL Desktop 9.7.lnk
2015-05-07 10:06 - 2011-04-11 23:45 - 00168993 _____ () C:\install.log
2015-05-07 10:06 - 2011-04-11 23:45 - 00000000 ____D () C:\Users\Beachmaster\AppData\Roaming\AOL
2015-05-07 10:06 - 2011-04-11 23:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOL
2015-05-07 10:03 - 2011-04-11 23:44 - 00000000 ____D () C:\Users\Beachmaster\AppData\Local\AOL
2015-05-07 10:00 - 2011-04-11 23:44 - 00000000 ____D () C:\ProgramData\AOL
2015-05-07 09:52 - 2010-12-18 00:31 - 00498104 _____ () C:\Windows\PFRO.log
2015-05-07 09:47 - 2012-02-08 22:30 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-05-07 00:09 - 2010-12-17 10:00 - 00000000 ____D () C:\ProgramData\PDFC
2015-05-06 16:14 - 2009-07-14 01:13 - 00783464 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-05 14:06 - 2011-05-21 08:27 - 00000000 ____D () C:\Windows\Minidump
2015-05-05 14:05 - 2011-05-21 08:27 - 577126512 _____ () C:\Windows\MEMORY.DMP
2015-05-04 15:23 - 2014-04-16 10:35 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-04 05:54 - 2014-04-16 10:34 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-05-04 05:53 - 2012-10-08 02:24 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-02 08:26 - 2010-12-18 00:37 - 00000000 ____D () C:\Windows\PCHEALTH
2015-04-30 14:59 - 2011-04-19 07:57 - 00003222 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForBeachmaster
2015-04-30 14:59 - 2011-04-19 07:57 - 00000356 _____ () C:\Windows\Tasks\HPCeeScheduleForBeachmaster.job
2015-04-16 09:40 - 2009-07-14 01:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-04-14 15:12 - 2009-07-14 00:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-04-10 05:12 - 2013-03-24 20:27 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-10 05:10 - 2011-08-17 15:08 - 00000000 ____D () C:\Program Files (x86)\Garmin
2015-04-10 05:09 - 2011-08-17 15:08 - 00000000 ____D () C:\ProgramData\Garmin
2015-04-10 05:08 - 2014-03-15 11:00 - 00003556 _____ () C:\Windows\System32\Tasks\GarminUpdaterTask

==================== Files in the root of some directories =======

2013-03-26 15:16 - 2013-03-26 15:16 - 0000288 _____ () C:\Users\Beachmaster\AppData\Roaming\.backup.dm
2011-05-10 20:28 - 2011-06-07 20:15 - 0001854 _____ () C:\Users\Beachmaster\AppData\Roaming\GhostObjGAFix.xml
2013-10-03 17:43 - 2013-10-03 17:43 - 1019772 _____ () C:\Users\Beachmaster\AppData\Local\a.zip
2013-10-03 17:43 - 2013-10-03 17:43 - 2743024 _____ (Catalina Marketing Corp) C:\Users\Beachmaster\AppData\Local\BcsKtYcIO.dll
2012-02-29 15:51 - 2012-02-29 15:51 - 0003584 _____ () C:\Users\Beachmaster\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-04-12 01:15 - 2015-03-22 12:26 - 0000083 ___SH () C:\ProgramData\.zreglib
2011-04-11 23:34 - 2011-06-23 09:03 - 0009902 _____ () C:\ProgramData\hpzinstall.log
2011-04-12 12:26 - 2011-04-12 12:26 - 0000122 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

Some content of TEMP:
====================
C:\Users\Beachmaster\AppData\Local\Temp\AcsInstall.dll
C:\Users\Beachmaster\AppData\Local\Temp\FoxitUpdater.exe
C:\Users\Beachmaster\AppData\Local\Temp\SHFOLDER.DLL

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-05-05 14:37

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-05-2015
Ran by [removed] at 2015-05-09 14:14:57
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2199333989-2354862195-3862359076-500 - Administrator - Disabled)
Beachmaster (S-1-5-21-2199333989-2354862195-3862359076-1001 - Administrator - Enabled) => C:\Users\Beachmaster
Drew (S-1-5-21-2199333989-2354862195-3862359076-1008 - Limited - Enabled) => C:\Users\Drew.Beachmaster-HP
Guest (S-1-5-21-2199333989-2354862195-3862359076-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2199333989-2354862195-3862359076-1002 - Limited - Enabled)
Kelly (S-1-5-21-2199333989-2354862195-3862359076-1006 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader for ScanSnap (TM) 4.1 (HKLM-x32\…\{FB410000-0002-0000-0000-074957833700}) (Version: 8.02.650.72520 - ABBYY)
Acronis True Image 2015 (HKLM-x32\…\{9C48ED33-4A66-4299-B274-BD8110AB6EAA}Visible) (Version: 18.0.6525 - Acronis)
Acronis True Image 2015 (x32 Version: 18.0.6525 - Acronis) Hidden
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe Acrobat X Standard - English, Français, Deutsch (HKLM-x32\…\{AC76BA86-1033-F400-BA7E-000000000005}) (Version: 10.1.10 - Adobe Systems)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
AnyDVD (HKLM-x32\…\AnyDVD) (Version: 7.5.7.0 - SlySoft)
AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\…\AOL Uninstaller) (Version: - AOL Inc.)
Apple Application Support (HKLM-x32\…\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{C6579A65-9CAE-4B31-8B6B-3306E0630A66}) (Version: 2.1.3.127 - Apple Inc.)
Ask Toolbar (HKLM-x32\…\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.6.5.0 - Ask.com) <==== ATTENTION
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
Canon G.726 WMP-Decoder (HKLM-x32\…\Canon G.726 WMP-Decoder) (Version: 1.1.0.4 - Canon Inc.)
Canon MovieEdit Task for ZoomBrowser EX (HKLM-x32\…\MovieEditTask) (Version: 2.6.0.4 - Canon Inc.)
Canon PowerShot SX500 IS Camera User Guide (HKLM-x32\…\CameraUserGuide-PSSX500IS) (Version: 1.0.0.1 - Canon Inc.)
Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\…\RAW Image Task) (Version: 0.9.3.9 - Canon Inc.)
Canon Utilities CameraWindow DC 8 (HKLM-x32\…\CameraWindowDC) (Version: 8.9.0.4 - Canon Inc.)
Canon Utilities ImageBrowser EX (HKLM-x32\…\ImageBrowser EX) (Version: 1.2.1.13 - Canon Inc.)
Canon Utilities MyCamera DC (HKLM-x32\…\MyCameraDC) (Version: 7.0.1.8 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\…\PhotoStitch) (Version: 3.1.23.47 - Canon Inc.)
Canon Utilities RemoteCapture Task for ZoomBrowser EX (HKLM-x32\…\RemoteCaptureTask) (Version: 1.7.1.9 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM-x32\…\ZoomBrowser EX) (Version: 6.1.0.20 - Canon Inc.)
Carbonite (HKLM-x32\…\Carbonite Backup) (Version: 5.7.2 build 4667 (Jan-19-2015) - Carbonite)
CardMinder (HKLM-x32\…\{D4F2AFD3-0167-4464-B92F-78AB6DA8A0AA}) (Version: V4.1L40 - PFU)
CardMinder V4.1 (x32 Version: 4.1.40.1 - PFU) Hidden
Catalina Savings Printer (HKLM\…\{21C069A6-6934-4EF1-92C9-CC6CFF1416A0}) (Version: 1.0.0 - Catalina Marketing Corp) <==== ATTENTION
CinemaNow Media Manager (HKLM-x32\…\{6C122441-1861-4CD7-B1C5-A163A6984E12}) (Version: 1.9.1.105 - CinemaNow, Inc.)
CloneDVD2 (HKLM-x32\…\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Coupon Printer for Windows (HKLM-x32\…\Coupon Printer for Windows5.0.0.3) (Version: 5.0.0.3 - Coupons.com Incorporated)
CutterGeneration (HKLM-x32\…\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{3621a1ae}) (Version: - Software Publisher) <==== ATTENTION
CyberLink DVD Suite Deluxe (HKLM-x32\…\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.2823 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
DVD Menu Pack for HP MediaSmart Video (HKLM-x32\…\InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}) (Version: 4.1.4030 - Hewlett-Packard)
DVD Menu Pack for HP MediaSmart Video (x32 Version: 4.1.4030 - Hewlett-Packard) Hidden
ebgcInfra (x32 Version: 1.1.0 - Default Company Name) Hidden
ebgcRes (x32 Version: 1.0.0 - Default Company Name) Hidden
ebgcSDK (x32 Version: 1.0.0 - Default Company Name) Hidden
Elevated Installer (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
Evernote v. 4.4 (HKLM-x32\…\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.4.0.4848 - Evernote Corp.)
Foxit Cloud (HKLM-x32\…\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 3.3.76.410 - Foxit Software Inc.)
Foxit Creator (HKLM-x32\…\Foxit Creator) (Version: 3,0,2,0506 - Foxit Corporation)
Foxit PDF Editor (HKLM-x32\…\Foxit PDF Editor) (Version: 2.2.0.0205 - Foxit Software)
Foxit PhantomPDF Standard (HKLM-x32\…\{3238DE1A-5F40-4FB5-B1EB-05C35DDDB81C}) (Version: 6.0.5.618 - Foxit Corporation)
Foxit Reader (HKLM-x32\…\Foxit Reader_is1) (Version: 7.1.5.425 - Foxit Software Inc.)
Garmin Express (HKLM-x32\…\{50755d67-ae60-4e47-b3d6-ce44d01b5a95}) (Version: 4.0.15.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HP Games (HKLM-x32\…\WildTangent hp Master Uninstall) (Version: 1.0.1.3 - WildTangent)
HP Imaging Device Functions 13.0 (HKLM\…\HP Imaging Device Functions) (Version: 13.0 - HP)
HP MediaSmart CinemaNow 2.0 (HKLM-x32\…\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.0 - Hewlett-Packard)
HP MediaSmart DVD (HKLM-x32\…\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 4.1.4229 - Hewlett-Packard)
HP MediaSmart Music (HKLM-x32\…\InstallShield_{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}) (Version: 4.1.4301 - Hewlett-Packard)
HP MediaSmart Photo (HKLM-x32\…\InstallShield_{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}) (Version: 4.1.4211 - Hewlett-Packard)
HP MediaSmart SmartMenu (HKLM\…\{5B08AF35-B699-4A44-BB89-3E51E70611E8}) (Version: 3.1.1.12 - Hewlett-Packard)
HP MediaSmart Video (HKLM-x32\…\InstallShield_{D12E3E7F-1B13-4933-A915-16C7DD37A095}) (Version: 4.1.4214 - Hewlett-Packard)
HP MediaSmart/TouchSmart Netflix (HKLM-x32\…\{BDDA1E1E-204E-4368-B0C2-737F16B76307}) (Version: 1.0.3.0 - Hewlett-Packard)
HP Odometer (HKLM-x32\…\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Photosmart Essential 3.5 (HKLM\…\HP Photosmart Essential) (Version: 3.5 - HP)
HP Scanjet G4000 Series (HKLM\…\{10297E58-2DFE-478B-9A1D-4B14E4E79CDF}) (Version: 13.0 - HP)
HP Setup (HKLM-x32\…\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard)
HP Solution Center 13.0 (HKLM\…\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Support Information (HKLM-x32\…\{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}) (Version: 10.1.0002 - Hewlett-Packard)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HP Vision Hardware Diagnostics (HKLM\…\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.1.2.27173 - Hewlett-Packard)
hpg4000 (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hulu Desktop (HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\HuluDesktop) (Version: 0.9.13 - Hulu LLC)
inSSIDer (HKLM-x32\…\{F8A10A25-D8DD-4661-9A1E-7F6DBAAA3C5E}) (Version: 2.1.5 - MetaGeek)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2119 - Intel Corporation)
iTunes (HKLM\…\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)
Java 7 Update 55 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java 8 Update 45 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kobo (HKLM-x32\…\Kobo) (Version: - )
LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2823 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2823 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\…\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\…\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\…\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\…\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\…\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\…\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\…\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\…\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Theme Pack for HP MediaSmart Video (HKLM-x32\…\InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}) (Version: 4.1.4030 - Hewlett-Packard)
Movie Theme Pack for HP MediaSmart Video (x32 Version: 4.1.4030 - Hewlett-Packard) Hidden
Mozilla Firefox 37.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 37.0.2 (x86 en-US)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Neat (HKLM-x32\…\Neat) (Version: 5.4.1.273 - The Neat Company)
Neat ADF Scanner 2008 Driver (HKLM\…\{8A2BC7D4-A7D3-45D5-B3D2-394718C53C41}) (Version: 2.0.1.5 - The Neat Company)
Neat ADF Scanner Driver (HKLM\…\{A55F1206-BFA7-4027-92B8-CE4EFDBC3CF2}) (Version: 2.0.2.1 - The Neat Company)
Neat Core Files (x32 Version: 5.4.1.273 - The Neat Company) Hidden
Neat Mobile Scanner (Silver) Driver (HKLM\…\{D1108D4B-72F8-419F-88C5-ABB8DC09B3C7}) (Version: 2.0.1.5 - The Neat Company)
Neat Mobile Scanner 2008 Driver (HKLM\…\{DDE25FC9-892D-4D24-9325-3BAA5C15ACA9}) (Version: 2.0.1.4 - The Neat Company)
Neat Mobile Scanner Driver (HKLM\…\{7EA2D88A-C8B7-4102-8644-0A437B6FC143}) (Version: 2.0.1.2 - The Neat Company)
NeatConnect Scanner Driver (HKLM\…\{6895EF47-6BD8-468E-BA09-B33636C65B7C}) (Version: 2.0.2.26 - The Neat Company)
OCR Software by I.R.I.S. 13.0 (HKLM\…\HPOCR) (Version: 13.0 - HP)
PDF Complete Special Edition (HKLM-x32\…\PDF Complete) (Version: 3.5.111 - PDF Complete, Inc)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDFCreator (HKLM-x32\…\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
pdfforge Toolbar v11.3 (HKLM-x32\…\{EB0B5926-421D-46E7-AB2C-47C7BDEFF9D6}) (Version: 11.3 - Spigot, Inc.) <==== ATTENTION
PhotoNow! (HKLM-x32\…\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.)
PhotoNow! (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden
PictureMover (HKLM-x32\…\{264FE20A-757B-492a-B0C3-4009E2997D8A}) (Version: 3.5.0.28 - Hewlett-Packard Company)
PlayReady PC Runtime amd64 (HKLM\…\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Power2Go (HKLM-x32\…\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4022 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.4022 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\…\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2906 - CyberLink Corp.)
PowerDirector (x32 Version: 8.0.2906 - CyberLink Corp.) Hidden
PressReader (HKLM-x32\…\{912CED74-88D3-4C5B-ACB0-13231864975D}) (Version: 5.10.621.0 - NewspaperDirect Inc.)
QuickTime 7 (HKLM-x32\…\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Ralink RT2860 Wireless LAN Card (HKLM-x32\…\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: - Ralink)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6132 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.2926 - CyberLink Corp.) Hidden
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
ScanSnap (x32 Version: 5.1.41.1 - PFU Limited) Hidden
ScanSnap (x32 Version: 5.1.51.23 Update - PFU Limited) Hidden
ScanSnap (x32 Version: 5.1.61.1 - PFU Limited) Hidden
ScanSnap Manager (HKLM-x32\…\{DBCDB997-EEEB-4BE9-BAFF-26B4094DBDE6}) (Version: V5.1L61 - PFU)
ScanSnap Organizer (HKLM-x32\…\{E58F3B88-3B3E-4F85-9323-04789D979C15}) (Version: V4.1L41 - PFU)
ScanSnap Organizer (x32 Version: 4.1.41.1 - PFU LIMITED) Hidden
Send To Neat (HKLM\…\{237E305C-B625-466A-88CE-1E121BF4FDB1}) (Version: 1.1.0.0 - The Neat Company)
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SP45575 - Wallpaper Picture Position Enabler for Windows 7 (HKLM-x32\…\{86391634-A94B-4355-8397-3D85C2F942DA}) (Version: 1.0.0 - Hewlett-Packard International Pte. Ltd.)
Viewpoint Media Player (HKLM-x32\…\ViewpointMediaPlayer) (Version: - )
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\…\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows Driver Package - Hewlett-Packard Image (12/14/2009 13.0.0.61) (HKLM\…\743EFCFE43C32543E0804C954858554E49909A4A) (Version: 12/14/2009 13.0.0.61 - Hewlett-Packard)
Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\…\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
WinRAR 4.01 (64-bit) (HKLM\…\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
Wondershare PDF Splitter (Build 1.5.0) (HKLM-x32\…\{ABE700CB-BDE4-4BCA-8DCF-69DF8DAAE9C5_Splitter}_is1) (Version: - Wondershare Software)
Zinio Reader 4 (HKLM-x32\…\ZinioReader4.9310D8F796442B71068C511E15D70529A702D19D.1) (Version: 4.0.2811 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.0.2811 - Zinio LLC) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Zuma Deluxe 1.0 (HKLM-x32\…\Zuma Deluxe 1.0) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2199333989-2354862195-3862359076-1001_Classes\CLSID\{caffac23-bb21-4945-8574-40cf5a940ad0}\InprocServer32 -> C:\Users\Beachmaster\AppData\Roaming\Catalina – Print Savings\npBcsKtTcIO.dll (Catalina Marketing Corporation)

==================== Restore Points =========================

08-05-2015 16:31:04 Windows Update
09-05-2015 07:49:23 Restore Operation
09-05-2015 14:01:58 LavasoftWeCompanion

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {119FB58D-47D8-4D2D-BE86-439F43F20691} - System32\Tasks\RecoveryCDWin7 => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: {14B7346C-85B8-4BE7-A675-D10675C1B5CA} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: {2DB5DADB-5AA5-4F45-9646-3ADB7C1EAF31} - System32\Tasks\AdobeAAMUpdater-1.0-Beachmaster-HP-Beachmaster => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15] (Adobe Systems Incorporated)
Task: {30FA612C-E093-41EA-A13A-39E33348E97D} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {4071D481-5DC5-49A0-A8EF-5DF289CC0152} - System32\Tasks\HPCeeScheduleForBeachmaster => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {4F90784C-BAAA-42BB-A842-67349B9569CD} - System32\Tasks\{5D0B0BFE-8A1D-4754-8ABA-9B45556286B3} => pcalua.exe -a "C:\Program Files (x86)\NeatWorks\uninstallNR.exe"
Task: {58AB5F1B-D598-40D5-B77B-E6032BCFA378} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {5D365E77-F061-4B79-94FD-6658D2C6AEF6} - System32\Tasks\{63E8C853-C2F9-4F41-9356-95FE118D2242} => pcalua.exe -a "C:\Program Files (x86)\PopCap Games\Zuma Deluxe\PopUninstall.exe" -c "C:\Program Files (x86)\PopCap Games\Zuma Deluxe\Install.log"
Task: {65B88EA3-A525-4780-9BAB-D8D00AC55F5E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-06] (Adobe Systems Incorporated)
Task: {8B4961CC-B050-47FF-951B-514FF336F6B3} - System32\Tasks\{22EEC096-D0DB-4C7F-9B8C-A23E22B0D2D0} => C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqpse.exe [2008-08-20] (Hewlett-Packard Development Co. L.P.)
Task: {93A219F8-602A-4120-8589-CB674F00F620} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {9D1204D7-CF3C-4AF5-865F-672735A4AB66} - System32\Tasks\{DBCAE2E2-19DB-4454-BD4E-6F05F535F669} => pcalua.exe -a E:\ZumaSetup_1_2.exe -d E:\
Task: {AE631FD0-4063-418F-8EF1-25A3746E0936} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {B4326220-2AA4-4D37-8B8A-FFF26CAE41BC} - System32\Tasks\{2F22FF1C-9EBF-4585-B662-3F76E598E780} => C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqpse.exe [2008-08-20] (Hewlett-Packard Development Co. L.P.)
Task: {B4770280-E886-4F2A-8CCD-CA94F952EF09} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {DFA532FA-26CF-4E10-8F49-8B158BFF1D97} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {E2628696-6B39-4D20-A289-90BF51E035BF} - System32\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} => C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe
Task: {EAD1E656-EF36-4DCF-9416-8890833B3F54} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {FA3CDFC4-17F7-4D2D-837F-71407DC18537} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HPCeeScheduleForBeachmaster.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) ==============

2014-07-31 16:33 - 2013-11-14 04:05 - 00054784 _____ () C:\Windows\System32\sdtnpm.dll
2013-06-14 02:36 - 2013-01-29 19:56 - 00069120 _____ () C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe
2014-09-29 20:51 - 2014-09-29 20:51 - 00074664 _____ () C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-09-09 21:18 - 2008-11-12 15:32 - 00014848 _____ () C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardPath.dll
2013-06-14 02:36 - 2013-01-29 19:45 - 00112128 _____ () C:\Program Files (x86)\Canon\ImageBrowser EX\MFMFileSystemWatcher.dll
2012-09-09 21:14 - 2012-01-18 17:35 - 00385024 _____ () C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsConfig.dll
2012-09-09 21:14 - 2011-12-14 22:49 - 00233472 _____ () C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsExtention.dll
2012-09-09 21:14 - 2003-03-26 18:46 - 00135168 _____ () C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsImgIO.dll
2012-09-09 21:14 - 2010-08-24 17:56 - 00167936 _____ () C:\Program Files (x86)\PFU\ScanSnap\Driver\SSsltsa.dll
2011-04-11 19:06 - 2010-06-17 21:00 - 12286520 _____ () C:\Users\Beachmaster\AppData\Roaming\PictureMover\Bin\Core.dll
2009-07-13 17:03 - 2009-07-13 21:15 - 00364544 _____ () C:\Windows\SysWOW64\msjetoledb40.dll
2011-04-11 19:06 - 2010-06-17 21:11 - 01699384 _____ () C:\Users\Beachmaster\AppData\Roaming\PictureMover\EN-US\Presentation.dll
2014-11-27 11:42 - 2014-11-27 11:42 - 00037696 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-11-27 11:42 - 2014-11-27 11:42 - 00034624 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2014-11-27 11:47 - 2014-11-27 11:47 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2014-11-27 11:44 - 2014-11-27 11:44 - 00129344 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\EXPAT.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Beachmaster\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.169.238.110

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: HPAdvisorDock => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
MSCONFIG\startupreg: SmartMenu => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [{F2A9FD5F-3C69-4767-B6F6-53037C0774D9}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector\PDR8.EXE
FirewallRules: [{2C108505-9A9B-482E-922D-6BAFA34346AE}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\CinemaNow\CinemaNow.exe
FirewallRules: [{12F7B843-54C1-4AF6-8C1A-63BE2941C6E6}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\CinemaNow\CinemaNow.exe
FirewallRules: [{43FE1ED4-BFFD-46C5-9AE9-08AFFBBD9E8A}] => (Allow) C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowShell.exe
FirewallRules: [{228FA884-A266-4F73-94E7-E4C39391EC82}] => (Allow) C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowShell.exe
FirewallRules: [{7B70CD78-7184-414B-BBCA-6DC0D2796783}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartMusic.exe
FirewallRules: [{7363CCBB-E87D-49B6-9F1E-04B3075B4A0E}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartPhoto.exe
FirewallRules: [{D1B2AD48-5C1F-47B3-B2B2-C216A8FEE399}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartVideo.exe
FirewallRules: [{3583C114-DD1B-49D9-B5ED-2A05CCEAE019}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\TSMAgent.exe
FirewallRules: [{A5F53CC6-3C19-4011-9F12-E541F11E676A}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\CLML\CLMLSvc.exe
FirewallRules: [{3888B3E6-63A2-455C-B425-0F4A0198A453}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPDVDSmart.exe
FirewallRules: [{8EF74867-3381-4916-9231-06E16522821B}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\Photo\HPMediaSmartPhoto.exe
FirewallRules: [{2C63BA2A-6F3C-4B42-B6DB-C519441F02E3}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\Video\HPMediaSmartVideo.exe
FirewallRules: [{451F998B-013A-4C42-8E3B-49967A1580B4}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Music\HPTouchSmartMusic.exe
FirewallRules: [{29626087-0239-42B4-B6DC-1E281A407039}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{A3FE1BA4-B872-41B4-A18A-F2890B0A6F2D}] => (Allow) svchost.exe
FirewallRules: [{ACD4791A-312D-44FB-A478-3BC4D7C817A4}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{0ACA948C-120D-4736-A4E1-E7715A46309E}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLDial.exe
FirewallRules: [{FF04778C-8AAF-40E1-9A17-023FB27CCC63}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLDial.exe
FirewallRules: [{24E22E74-0634-4222-BFAE-168D927C7D90}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLacsd.exe
FirewallRules: [{101FF4ED-5015-4E14-BB4A-23412B13A832}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLacsd.exe
FirewallRules: [{3B7B4719-219F-4ECD-A28A-5F8FE47F86D1}] => (Allow) C:\Program Files (x86)\Common Files\AOL\1302579866\ee\aolsoftware.exe
FirewallRules: [{B1B79A69-8F97-4B26-B7A6-47D7E6EF0A4E}] => (Allow) C:\Program Files (x86)\Common Files\AOL\1302579866\ee\aolsoftware.exe
FirewallRules: [{68B47CC6-7082-45FF-934A-82A64E5B6A67}] => (Allow) C:\Program Files (x86)\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe
FirewallRules: [{EE5D80AD-96C7-4CA2-A966-EC3F104FE328}] => (Allow) C:\Program Files (x86)\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe
FirewallRules: [{F5923C98-DE81-4E45-957F-CD82DAA71089}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{9D620C22-DB2D-4F62-AB27-BB99C96F0276}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{044D0F8B-DC26-405E-9498-3B75FADB9B55}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{FE2D23D4-1ACA-4D36-9A9C-625C4ACF2EB1}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{21370987-C8CB-4766-9DCD-B3028BE70B59}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{CEDD690B-8879-4259-9608-9928B868F471}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{41FAE0FA-22A5-4321-B8F5-F381EAD117EB}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{FFEDEADE-4E83-4026-96E8-334F5E50A1A9}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{1FE51F82-B4C1-4811-B1CA-45435BC3CB17}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{6132F9FF-91E5-43EC-A59E-2891EC94479C}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{3AF66C59-51A1-4665-9086-E8DAE3B3AF2A}] => (Allow) C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
FirewallRules: [{639906B1-1EAB-44E5-AC51-84ED4EF46646}] => (Allow) C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
FirewallRules: [{72E29275-FBD0-4DC6-8DAC-B4BA55F0474F}] => (Allow) C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
FirewallRules: [{10686417-ECA1-40AF-8CBB-EF85902B8ED2}] => (Allow) C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
FirewallRules: [{FFB03457-0EC5-4A96-B41E-B823C82B1EB9}] => (Allow) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteSetup.exe
FirewallRules: [{EC7922BE-4413-485E-BBBD-BD3D82F87B02}] => (Allow) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteSetup.exe
FirewallRules: [{EB0F8662-EDCF-444A-B54E-2F180E806C81}] => (Allow) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteSetup.exe
FirewallRules: [{05240697-B6E6-4C4A-893A-9D46EED5A8CB}] => (Allow) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteSetup.exe
FirewallRules: [{05A89569-6FD9-4A99-9396-A726060D2E92}] => (Allow) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
FirewallRules: [{F79D905D-8B6F-4901-9BD0-C59F056C561E}] => (Allow) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
FirewallRules: [{D341D8F4-DD92-44DE-A51F-552C98CFFD5E}] => (Allow) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
FirewallRules: [{636E6ED3-C57A-48A0-BCC6-04386ED002A2}] => (Allow) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
FirewallRules: [{8601CCD9-929A-4E0D-BBE3-F668C18B53AB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{A4B623F9-EAF2-4593-AFE2-8E2746B262EC}] => (Allow) LPort=2869
FirewallRules: [{B55B9D82-B7EA-4F9F-AF85-81C795BAF008}] => (Allow) LPort=1900
FirewallRules: [{D45982CB-721E-4D91-960B-FE94AD286B7B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{89594814-5D2D-40D5-A963-495467F7F16E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{EFD33ED9-035D-4C8C-895C-0A0287B46823}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DB56F856-A2A1-4D28-819A-DD2BAF7C9EC9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{734B1DAF-696C-4271-9198-C86FCA2E9FB0}] => (Allow) C:\Program Files (x86)\Common Files\AOL\1380287399\ee\aolsoftware.exe
FirewallRules: [{53390183-DD4A-49A4-9614-74B404D6B4EA}] => (Allow) C:\Program Files (x86)\Common Files\AOL\1380287399\ee\aolsoftware.exe
FirewallRules: [{A861AF8E-EBCD-43C4-895B-EFFFE08AB064}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7\waol.exe
FirewallRules: [{B0453A19-44BD-44F8-ADEC-CF834D2CBE65}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7\waol.exe
FirewallRules: [{056A3E41-F9D9-418A-8507-67963FC47EC8}] => (Allow) C:\Program Files (x86)\Common Files\AOL\Loader\aolload.exe
FirewallRules: [{CB8B5746-FB98-4B87-8AA2-60A892B6E493}] => (Allow) C:\Program Files (x86)\Common Files\AOL\Loader\aolload.exe
FirewallRules: [{BA0C82EA-FC6A-44BB-AD28-EFE51E0D1F3F}] => (Allow) C:\Program Files (x86)\Common Files\AOL\System Information\sinf.exe
FirewallRules: [{3179ADD4-E86B-4D89-9AF3-89892EBAD4C7}] => (Allow) C:\Program Files (x86)\Common Files\AOL\System Information\sinf.exe
FirewallRules: [{8201D610-E7D0-4124-8D2B-97A6A92DF81E}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7\AOLBrowser\aolbrowser.exe
FirewallRules: [{D03D7F10-0AD8-45E3-A5CB-D83B2C8FE3C5}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7\AOLBrowser\aolbrowser.exe
FirewallRules: [{03DD6F4A-7BDC-4727-BA70-5DF3154DFB94}] => (Allow) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
FirewallRules: [{92C73AF9-9F87-4B39-900D-182BE58272F5}] => (Allow) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
FirewallRules: [{38338FC6-479D-47DF-9309-81A2C8F36C72}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{7E7A4A50-AFA2-4131-9D17-6CF345483948}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLDial.exe
FirewallRules: [{F1B95606-9728-4B55-A928-17DB7E13FFD9}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLDial.exe
FirewallRules: [{70A0E2DD-D360-444F-93B7-E8BFDC031400}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLacsd.exe
FirewallRules: [{E52B2C60-C3B1-4523-A8AA-73314CF5E342}] => (Allow) C:\Program Files (x86)\Common Files\AOL\acs\AOLacsd.exe
FirewallRules: [{D4F382DC-0686-4862-B67E-B77674720AB7}] => (Allow) C:\Program Files (x86)\Common Files\AOL\1380287399\ee\aolsoftware.exe
FirewallRules: [{68E73F4F-C684-4131-8EEF-B236ABCDE51F}] => (Allow) C:\Program Files (x86)\Common Files\AOL\1380287399\ee\aolsoftware.exe
FirewallRules: [{F668B0C4-71B1-400D-B27D-FDE3C5D4096B}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7a\waol.exe
FirewallRules: [{CD619663-CF7B-4C95-A4E2-00D55AB3B6C0}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7a\waol.exe
FirewallRules: [{0755B94B-B062-4054-B17A-4E1DBF00656A}] => (Allow) C:\Program Files (x86)\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe
FirewallRules: [{18C0F0A6-2C5B-4695-B1D9-E65EFBF9EDA1}] => (Allow) C:\Program Files (x86)\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe
FirewallRules: [{D9A6B0F2-272A-4620-BA95-223FBFB9AA1D}] => (Allow) C:\Program Files (x86)\Common Files\AOL\Loader\aolload.exe
FirewallRules: [{9090C52F-EC91-4A61-AE46-4C16924CF641}] => (Allow) C:\Program Files (x86)\Common Files\AOL\Loader\aolload.exe
FirewallRules: [{108D57DD-B7F2-486D-9B79-80DE4279DF32}] => (Allow) C:\Program Files (x86)\Common Files\AOL\System Information\sinf.exe
FirewallRules: [{C6AB447C-4897-499A-89E3-4FDD48372F79}] => (Allow) C:\Program Files (x86)\Common Files\AOL\System Information\sinf.exe
FirewallRules: [{8DCBF166-A768-41DD-9745-5FDFB47F6C96}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7a\aolbrowser.exe
FirewallRules: [{B4251A6E-913F-4A76-8D14-6BAC69CAED9E}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7a\aolbrowser.exe
FirewallRules: [{2F1E1C5A-A42D-4642-BB1C-E477F49ABAE6}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{32C1D026-AB53-4949-9725-5BD1A1EAB0E2}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{062F0ABC-EB9D-4515-9256-996D4EF718C7}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{15CDF1C6-7735-43CE-951F-B90484F6A41E}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{18EC4F16-B29C-4395-9C49-1F237CEACA72}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{AC737B6D-B900-4D57-B1B6-98BA9FA2848B}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{9D1325A9-732E-4266-983D-9B215CE01A32}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7\waol.exe
FirewallRules: [{332B212D-0DD1-467B-989D-0409F4AA7A26}] => (Allow) C:\Program Files (x86)\AOL Desktop 9.7\waol.exe
FirewallRules: [{55F96740-8A65-404E-A89F-03985D1D83E7}] => (Allow) C:\Program Files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{796C316F-B7DD-4290-A931-7DC2AF20CF2B}] => (Allow) C:\Program Files (x86)\mozilla firefox\firefox.exe

==================== Faulty Device Manager Devices =============

Name: MpKsl4d6db7a0
Description: MpKsl4d6db7a0
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MpKsl4d6db7a0
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:
==================
Error: (05/09/2015 02:07:47 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070013, The media is write protected.
.

Error: (05/09/2015 02:07:47 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x80070013, The media is write protected.
]

Error: (05/09/2015 02:07:47 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070013, The media is write protected.
.

Error: (05/09/2015 02:07:47 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x80070013, The media is write protected.
]

Error: (05/09/2015 02:01:58 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-2199333989-2354862195-3862359076-1006.bak). hr = 0x80070539, The security ID structure is invalid.
.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {7ae48a79-949c-46c3-8f78-163d22c61340}

Error: (05/09/2015 08:50:54 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (05/09/2015 08:50:52 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (05/09/2015 08:45:16 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (05/09/2015 08:45:09 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (05/09/2015 07:49:23 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-2199333989-2354862195-3862359076-1006.bak). hr = 0x80070539, The security ID structure is invalid.
.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {8a5ec838-accf-4a51-b575-9413b103d55f}

System errors:
=============
Error: (05/09/2015 02:13:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Health Check Service service failed to start due to the following error:
%%2

Error: (05/09/2015 02:09:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Garmin Device Interaction Service service failed to start due to the following error:
%%1053

Error: (05/09/2015 02:09:44 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Garmin Device Interaction Service service to connect.

Error: (05/09/2015 08:05:56 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Health Check Service service failed to start due to the following error:
%%2

Error: (05/09/2015 08:02:52 AM) (Source: Microsoft Antimalware) (EventID: 2004) (User: )
Description: %60 has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.

   Signatures Attempted: %24

   Error Code: 0x80070002

   Error description: The system cannot find the file specified.

   Signature version: 0.0.0.0;0.0.0.0

   Engine version: %600

Error: (05/09/2015 07:50:30 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the CarboniteService service.

Error: (05/09/2015 07:47:46 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureCommand with the following error:
%%5

Error: (05/09/2015 07:47:42 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5

Error: (05/09/2015 07:42:07 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Acronis Sync Agent Service service failed to start due to the following error:
%%1053

Error: (05/09/2015 07:42:07 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Acronis Sync Agent Service service to connect.

Microsoft Office Sessions:
=========================
Error: (05/09/2015 02:07:47 PM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070013, The media is write protected.

Error: (05/09/2015 02:07:47 PM) (Source: VSS) (EventID: 13) (User: )
Description: {4e14fba2-2e22-11d1-9964-00c04fbbb345}CEventSystem0x80070013, The media is write protected.

Error: (05/09/2015 02:07:47 PM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070013, The media is write protected.

Error: (05/09/2015 02:07:47 PM) (Source: VSS) (EventID: 13) (User: )
Description: {4e14fba2-2e22-11d1-9964-00c04fbbb345}CEventSystem0x80070013, The media is write protected.

Error: (05/09/2015 02:01:58 PM) (Source: VSS) (EventID: 8193) (User: )
Description: ConvertStringSidToSid(S-1-5-21-2199333989-2354862195-3862359076-1006.bak)0x80070539, The security ID structure is invalid.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {7ae48a79-949c-46c3-8f78-163d22c61340}

Error: (05/09/2015 08:50:54 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Beachmaster\Desktop\esetsmartinstaller_enu.exe

Error: (05/09/2015 08:50:52 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Beachmaster\Desktop\esetsmartinstaller_enu.exe

Error: (05/09/2015 08:45:16 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Beachmaster\Desktop\esetsmartinstaller_enu.exe

Error: (05/09/2015 08:45:09 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Beachmaster\Downloads\esetsmartinstaller_enu.exe

Error: (05/09/2015 07:49:23 AM) (Source: VSS) (EventID: 8193) (User: )
Description: ConvertStringSidToSid(S-1-5-21-2199333989-2354862195-3862359076-1006.bak)0x80070539, The security ID structure is invalid.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {8a5ec838-accf-4a51-b575-9413b103d55f}

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E5500 @ 2.80GHz
Percentage of memory in use: 52%
Total physical RAM: 4061.24 MB
Available physical RAM: 1930.66 MB
Total Pagefile: 8120.67 MB
Available Pagefile: 5980.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:919.48 GB) (Free:799.35 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:11.93 GB) (Free:1.46 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (THE_AMERICANS_SEASON2_DISC3) (CDROM) (Total:7.75 GB) (Free:0 GB) UDF
Drive k: (HD-LCU3) (Fixed) (Total:2794.52 GB) (Free:2755.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 6F413CEF)
Partition 1: (Active) - (Size=107 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=919.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=11.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2794.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

Will await further instructions….thanks very much!!

ken545

Post #20May 9, 2015, 8:30 PM UTC

Have to go out for about an hour or so, will go over your log when I return

ken545

Post #21May 9, 2015, 9:35 PM UTC

I am attaching a FIXLIST file, you need to download it to your desktop where you now have FRST64 or the fix wont work, use your mouse to drag FIXLIST right next to FRST64, either above or below it but not right on top of it, after its downloaded open up FRST64 and click on FIX (Not Scan) it wont take long, after your computer reboots you will find a FIXLOG file on your desktop, post it please and let me know how your system is behaving now

Attachments:

📎Fixlist.txt

cranmergirl

Post #22May 10, 2015, 4:57 AM UTC

Hi Ken545,

Here is the log you requested:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-05-2015
Ran by [removed] at 2015-05-10 00:47:15 Run:2
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\…\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe –minimize
C:\Program Files (x86)\Lavasoft
2013-10-03 17:43 - 2013-10-03 17:43 - 2743024 _____ (Catalina Marketing Corp) C:\Users\Beachmaster\AppData\Local\BcsKtYcIO.dll
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:
End

*****************

Processes closed successfully.
Restore point was successfully created.
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value deleted successfully.
HKU\S-1-5-21-2199333989-2354862195-3862359076-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Web Companion => value deleted successfully.
"C:\Program Files (x86)\Lavasoft" => File/Directory not found.
C:\Users\Beachmaster\AppData\Local\BcsKtYcIO.dll => Moved successfully.

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 316 MB temporary data.

The system needed a reboot.

==== End of Fixlog 00:48:24 ====

Things are working well. Thanks so much!!

ken545

Post #23May 10, 2015, 10:37 AM UTC last edited May 10, 2015, 11:45 PM UTC

[external image: cool.gif]

Ad-Aware by Lavasoft has been around a long time but there are programs that offer more protection, it was a good program back in the days of win 98 but with today's threats is a bit out of date

You ran Malwarebytes the free edition, it will let you update, run scans and remove what it finds, if you upgraded to the Pro Version it has a protection module that blocks known bad sites from loading and also warns you if your downloading a bad file, I have it on all my systems as well as family and friends computers, the cost is minimal and worth every penny but this of course is up to you if you wanted to upgrade

Double click on AdwCleaner.exe to run the tool again.

Click on the Uninstall button.

Click Yes when asked are you sure you want to uninstall.

Both AdwCleaner.exe, its folder and all logs will be removed.

==========================================================

Please download DelFix and save the file to your Desktop.

[external image: DelFix_zps139e2ea1.jpg]

Windows XP Double Click DelFix.exe to run the program.

Windows Vista > Win 7 > Win 8 Right Click on DelFix.exe and select RUN AS ADMINISTRATOR

Checkmark " Remove Disinfection Tools"

Click the Run button

This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually

==========================================================

Safe Surfn

Ken

cranmergirl

Post #24May 10, 2015, 12:02 PM UTC

Good morning Ken,

Went to the first link…Tutorial for System Restore. It's for Windows XP. Which link do you recommend for Windows 7??

Thanks!!

ken545

Post #25May 10, 2015, 12:06 PM UTC last edited May 10, 2015, 12:08 PM UTC

I need to update that, thanks for bringing it to my attention

http://windows.microsoft.com/en-us/windows7/create-a-restore-point

The instructions are pretty clear right under the video

Another

http://windows.microsoft.com/en-us/windows7/products/features/system-restore

cranmergirl

Post #26May 10, 2015, 3:59 PM UTC last edited May 10, 2015, 5:40 PM UTC

Hi again,

Going through the steps as recommended but under WhatthTech, it recommends downloading ERUNT. I did that but it says it's for Windows 2000 and XP. So I uninstalled it. Could you please clarify?? I'm confused….

Addendum to my previous post….

1) I upgraded to the paying version of Malwarebytes as you recommended;

2) I created a Restore Point as recommended;

3) Tried to update my IE as recommended but 2 things I could not find under Options

1) Navigate subframes across different domains

2) Installation of desktop items

4) Is Microsoft Security Essentials sufficient as the only anti-virus program on my computer? The recommendations said not to pick more than one but MSE was not listed;

5) Is the Windows Firewall sufficient as the firewall for my computer or do you recommend a different one??

6) I downloaded Secunia as recommended but I don't necessarily want to update everything…I got a 95% score. What is Adobe AIR? Do you recommend it? Also what is Microsoft XML Core Services (MSXML) 4.x and do I need to update??

7) Instructions for how to flushdns are for XP…is there an update for Windows 7?

8) I am a little confused about MVPS Hosts file…I don't want to make things worse by delving into something I really don't understand…do you have any particular recommendations for a Windows 7 user?

9) Last question…I sometimes get a notification when I'm on Mozilla Firefox that Shockwave Flash (I think) has stopped running and after getting that message, I sometimes have to reboot my computer to get my browser to work properly. It actually has not happened for a long time but it just happened yesterday. Do you know anything about that?

Thank you so much!

ken545

Post #27May 10, 2015, 11:44 PM UTC

Hey, been gone since early this morning on account of Mothers day

I am going to remove the links I posted earlier about HOW DID I GET INFECTED IN THE FIRST PLACE as a lot of that information is way out of date

Your running Windows 7 and the current IE Browser is version 11 which you have, windows updates will take care of any updates that are needed .

MSE is fine, along with the Pro version of Malwarebytes and the windows firewall.

I would ignore secunia right now, if you feel that any or your hardware needs to be updated go right to the manufacturer's site for the latest drivers

When we ran a fix with FRST, we flushed your DNS Cache and we also replaced your hosts file so your ok in both those departments

ERUNT, is getting old, here is one for backing up the windows registry that is current, unless you plan to make some major changes to the registry there really is no reason to back it up

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Please download the installer for Registry Backup from here or here and save to your desktop.

Right-click on tweaking.com_registry_backup_setup.exe and select Run as Administrator >> Follow the prompts for a default installation

Ensure the option Open "Tweaking.com - Registry Backup" When Install Completes is selected >> Next > >> Finish

Once the GUI(graphical user interface) has appeared/loaded:-

[external image: TCRB-1.jpg]

Click on Backup Now >> once the process is complete the below will be displayed in the GUI:-

[external image: TBRB-2.jpg]

Close Tweaking.com - Registry Backup

Note: There will now be a folder at the root of the Hard-Drive named C:\RegBackup, do not delete this as it is the actual backup just created.

A tutorial for Registry Backup explaining the various features be viewed HERE

Hope this helps

Ken

cranmergirl

Post #28May 11, 2015, 12:35 PM UTC

Hi Ken,

Hope you had a nice Mother's Day! (I did!)

Everything seems to be shipshape with my computer. Yay!

I just have 2 final questions because I am a little OCD I guess…lol. I think Adobe Air came installed on my computer but I'm not sure. Can't remember choosing to download it. Can I safely remove it or is it connected to flash players or something?? Should I remove it or leave well enough alone?

And 2, do you know anything about shockwave flash that I mentioned in my previous post? When on Mozilla Firefox, a box would pop up saying the shockwave flash plugin had crashed or was unstable. Something like that….can't remember exactly. But then I would have to reboot my computer to straighten out Mozilla Firefox so I could continue whatever I was doing. It was going on for a long time and then I did something (can't remember what I did!) which stopped it. Now it happened again the other day, very briefly. And this time I didn't have to reboot. But it got me to wondering what the heck that is all about. Do you know anything about this issue??

Thank you so very much again for all your help! I truly appreciate it! (I did just make a donation via Paypal.)

ken545

Post #29May 11, 2015, 1:02 PM UTC

Saw that, THANK YOU

I would leave Adobe Air be as its used to run some desktop applications and its safe

Open up FF and go to Tools > Add ons > Plugins and under Shockwave Flash Player change it to ASK TO ACTIVATE and then it wont bother you and you can activate it as needed

See if it helps

cranmergirl

Post #30May 11, 2015, 1:22 PM UTC

Good. I think we are done here. Thank you, thank you, thank you!!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Dollarsaver Infection [Solved]

✨ Ask AI

Ask AI