Spyware / Malware / Virus Removal

Slow web loading /Offers4U widget the problem? [Solved]

8 min read

Looking for the outcome? Ask AI

denisemn Topic Starter

Post #1May 7, 2015, 10:05 PM UTC

Hi,

My PC has been really slow to load web pages. I realized that there was this ad thingy from Offers4U that kept coming up so I am thinking that may be the problem. I did some searches on removing it but was unable to find it listed in my uninstall programs menu or other places on the PC. It isn’t showing up right now, but I don’t think it is gone. There is a settings on the widget hat allows you to shut it off for a day or a week and I may have done that.

We have been using both Chrome & Firefox OS on this PC.

I do need hekp with the FRST download. I tried multiple times to dowload the frst64 bit from a couple of sites but it isn't working. It is in the recent dowload history folder but the 'open containg folder' is grayed out so i assume it hasn't actually downloaded. (I do have W8.1 OS and verified I have a 64 bit machine.) I downloaded the 32 bit version, ran as admin, MS tried to block it as an app buy I told it to run anyway, then was told it was incompatible.

My aswMBR log is below (it's really short so I hope that worked)

Thanks for your help

=========================================

swMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-05-07 15:56:40
—————————–
15:56:40.946    OS Version: Windows x64 6.2.9200
15:56:40.946    Number of processors: 2 586 0x1
15:56:40.946    ComputerName: MAINPC UserName: Jim
15:56:43.060    Initialize success
15:56:43.310    VM: initialized successfully
15:56:43.310    VM: Amd CPU BiosDisabled
15:58:04.134    AVAST engine defs: 15050603
15:59:27.457    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000001b
15:59:27.457    Disk 0 Vendor: WDC_WD5000AAKX-60U6AA0 18.01H18 Size: 476940MB BusType: 11
15:59:27.551    Disk 0 MBR read successfully
15:59:27.567    Disk 0 MBR scan
15:59:27.582    Disk 0 unknown MBR code
15:59:27.598    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
15:59:27.645    Disk 0 scanning C:\windows\system32\drivers
15:59:43.369    Service scanning
15:59:48.482    Service BHDrvx64 C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20150418.001\BHDrvx64.sys **LOCKED** 5
15:59:52.327    Service eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys **LOCKED** 5
15:59:52.687    Service EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys **LOCKED** 5
15:59:56.500    Service IDSVia64 C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20150506.003\IDSvia64.sys **LOCKED** 5
16:00:01.049    Service NAVENG C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20150506.025\ENG64.SYS **LOCKED** 5
16:00:01.345    Service NAVEX15 C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20150506.025\EX64.SYS **LOCKED** 5
16:00:20.591    Modules scanning
16:00:20.606    Disk 0 trace - called modules:
16:00:20.637    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys
16:00:20.653    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe0019b3053e0]
16:00:20.669    3 CLASSPNP.SYS[fffff801bcd00170] -> nt!IofCallDriver -> [0xffffe0019b93bb30]
16:00:20.669    5 amd_xata.sys[fffff801bc180634] -> nt!IofCallDriver -> \Device\0000001b[0xffffe0019b9407f0]
16:00:21.827    AVAST engine scan C:\windows
16:00:24.781    AVAST engine scan C:\windows\system32
16:05:11.867    AVAST engine scan C:\windows\system32\drivers
16:05:35.492    AVAST engine scan C:\Users\Jim
16:10:34.162    Disk 0 MBR has been saved successfully to "C:\Users\Jim\Desktop\MBR.dat"
16:10:34.193    The log file has been saved successfully to "C:\Users\Jim\Desktop\aswMBR.txt"

ken545

Post #2May 11, 2015, 7:12 PM UTC last edited May 11, 2015, 7:14 PM UTC

You need the 64 bit version of FRST, if you cant download it than you need to download it from a known clean computer and transfer it by disk ( USB Thumb drive would be fine ) then transfer it to the infected computer, run the scan and post both logs

Please download Farbar Recovery Scan Tool and save it to your DESKTOP

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

A simple way to check your system: Start –> Computer (right click) –> Properties

[external image: FRST_zps5d956a1a.jpg]

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

Please make sure All Users is checked

Just keep the defaults as in the picture checkmarked

Press Scan button.

It will produce a log called FRST.txt in the same directory the tool is run from.

Please copy and paste log back here.

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

denisemn

Post #3May 11, 2015, 9:46 PM UTC

Hi Ken,

I have tried multiple times to run FRST64.exe. The file appears to download, is in my download library. I am unable to drag it to my desktop. When I double right click on the file I get a list box with 5 choices : Remove from History, Open Containing Folder, Go to Download Page, Copy download link, & Clear downloads. The Open Containing Folder & Go to Download Page are grayed out so I can't even select those if I wanted to.

Any idea how I can get the download to work?

ken545

Post #4May 11, 2015, 10:40 PM UTC

Try downloading and run FRST in safemode with networking

With windows 8 you have to enable it first

http://www.bleepingcomputer.com/tutorials/enable-the-f8-key-in-windows-8/

After you have done the above try booting to safemode with networking

To Enter Safemode

Go to Start> Shut off your Computer> Restart

As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,

this will bring up a menu.

Use the Up and Down Arrow Keys to scroll up to Safemode with Networking

Then press the Enter Key on your Keyboard

Tutorial if you need it How to boot into Safemode

denisemn

Post #5May 11, 2015, 11:51 PM UTC

Thanks Ken that worked scans are below:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2015
Ran by [removed] (administrator) on MAINPC on 11-05-2015 18:45:39
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\HelpPane.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2793016 2013-09-05] (Hewlett-Packard)
HKLM\…\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\…\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7506648 2014-01-13] (Realtek Semiconductor)
HKLM-x32\…\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-11] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\…\Run: [ComcastAntispyClient] => "C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" /hide
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Constant Guard.lnk [2014-08-09]
ShortcutTarget: Constant Guard.lnk -> C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe (White Sky, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Fast Connect.lnk [2014-12-10]
ShortcutTarget: Fast Connect.lnk -> C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe (White Sky, Inc.)
ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\buShell.dll [2015-03-06] (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\buShell.dll [2015-03-06] (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\buShell.dll [2015-03-06] (Symantec Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK14/1
HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://xfinity.comcast.net/
HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK14/1
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> DefaultScope {BC8143CF-927E-436E-AE39-AE87B3925F74} URL = http://search.whiteskyservices.com/?wstoken=1510AD7A-56F8-41A8-A06C-2A1BD851A375&dtid;=1&pid;=21&src;=sgsearch&v;=1.14.1126.5&searchparam;={SearchTerms}
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> {BC8143CF-927E-436E-AE39-AE87B3925F74} URL = http://search.whiteskyservices.com/?wstoken=1510AD7A-56F8-41A8-A06C-2A1BD851A375&dtid;=1&pid;=21&src;=sgsearch&v;=1.14.1126.5&searchparam;={SearchTerms}
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> {C6523212-13C9-43C9-8D87-6235EF9B5745} URL = http://search.xfinity.com/?cat=web&con;=toolbar&cid;=xfstart_tech_search&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
BHO: XFINITY Toolbar -> {4b9bcce8-a70b-402a-a7e1-db96831ee26f} -> C:\Program Files (x86)\xfin_portal\comcastdx64.dll [2013-12-11] ()
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: XFINITY Toolbar -> {4b9bcce8-a70b-402a-a7e1-db96831ee26f} -> C:\Program Files (x86)\xfin_portal\comcastdx.dll [2013-12-11] ()
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\IPS\IPSBHO.DLL [2015-03-04] (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-01] (Oracle Corporation)
BHO-x32: Fast Connect -> {B84CDBE7-1B46-494B-A188-01D4C52DEB61} -> C:\ProgramData\White Sky, Inc\ID Vault\IEBHO1.15.414.3\NativeBHO.dll [2015-04-14] (WhiteSky)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-01] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - XFINITY Toolbar - {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx64.dll [2013-12-11] ()
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
Toolbar: HKLM-x32 - XFINITY Toolbar - {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll [2013-12-11] ()
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75

FireFox:
========
FF ProfilePath: C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default
FF DefaultSearchEngine: Connect Search
FF DefaultSearchEngine.US: Google
FF SelectedSearchEngine: Connect Search
FF Homepage: hxxp://xfinity.comcast.net/?xcr=1&referrer;=http%253A%252F%252Fwww.google.com%252Fsearch%253Fq%253Dinfinity%252Btv%252Bcomcast%2526sourceid%253Die7%2526rls%253Dcom.microsoft%253Aen-us%253AIE-SearchBox%2526ie%253D%2526oe%253D
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-28] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-28] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-05-06] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-01] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-03] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF SearchPlugin: C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default\searchplugins\Connect Search.xml [2014-12-19]
FF Extension: White Sky Fast Connect - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default\Extensions\idvaultaddon@whitesky [2015-04-07]
FF Extension: No Name - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default\Extensions\temp [2014-08-09]
FF HKLM-x32\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2015-05-11]

Chrome:
=======
CHR HomePage: Default -> hxxp://xfinity.comcast.net/tt/
CHR Profile: C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-19]
CHR Extension: (Google Drive) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-19]
CHR Extension: (Google Search) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-19]
CHR Extension: (XFINITY Constant Guard Protection Suite) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\faknfdmfmhcmgphbfjhgmomfcihmocmp [2014-07-05]
CHR Extension: (Bookmark Manager) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-01-26]
CHR Extension: (Norton Identity Safe) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-08-15]
CHR Extension: (Wolf Pack 1366x768) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfcmbfncajdbnpecmokohfalodnlpkln [2014-04-19]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Norton Security Toolbar) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-08-09]
CHR Extension: (Google Wallet) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-19]
CHR Extension: (Gmail) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-19]
CHR HKLM\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\Exts\Chrome.crx [2015-04-08]
CHR HKLM-x32\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\Exts\Chrome.crx [2015-04-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)
S2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-09-05] () [File not signed]
S2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
S2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
S2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-04] (Microsoft Corporation)
S2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\N360.exe [265000 2015-03-26] (Symantec Corporation)
S2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-09-05] (Softex Inc.) [File not signed]
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-13] (Realtek Semiconductor)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-07-02] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)
S2 mcbootdelaystartsvc; "C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-22] (Advanced Micro Devices, Inc.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
S1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20150418.001\BHDrvx64.sys [1639128 2015-04-08] (Symantec Corporation)
S1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1507000.00B\ccSetx64.sys [162392 2013-09-25] (Symantec Corporation)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-11] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-11] (Symantec Corporation)
S1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20150508.001\IDSvia64.sys [671448 2015-03-27] (Symantec Corporation)
S3 NAVENG; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20150510.018\ENG64.SYS [129752 2015-04-29] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20150510.018\EX64.SYS [2137304 2015-04-29] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\1507000.00B\SRTSP64.SYS [876248 2014-08-25] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\1507000.00B\SRTSPX64.SYS [37592 2014-08-25] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1507000.00B\SYMDS64.SYS [493656 2013-09-09] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1507000.00B\SYMEFA64.SYS [1148120 2014-08-25] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1507000.00B\SymELAM.sys [23568 2013-09-09] (Symantec Corporation)
S3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-08-09] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\1507000.00B\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\1507000.00B\SYMNETS.SYS [593112 2014-08-25] (Symantec Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)
S1 AntiLog32; \??\C:\windows\system32\drivers\AntiLog64.sys [X]
U3 McMPFSvc; No ImagePath
U3 McNaiAnn; No ImagePath
U3 mcpltsvc; No ImagePath
U3 McProxy; No ImagePath
U3 mfecore; No ImagePath
U3 MSK80Service; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-11 18:45 - 2015-05-11 18:46 - 00018901 _____ () C:\Users\Jim\Desktop\FRST.txt
2015-05-11 18:44 - 2015-05-11 18:45 - 00000000 ____D () C:\FRST
2015-05-11 18:43 - 2015-05-11 18:43 - 02102784 _____ (Farbar) C:\Users\Jim\Desktop\FRST64.exe
2015-05-07 16:10 - 2015-05-07 16:10 - 00002671 _____ () C:\Users\Jim\Desktop\aswMBR.txt
2015-05-07 16:10 - 2015-05-07 16:10 - 00000512 _____ () C:\Users\Jim\Desktop\MBR.dat
2015-05-06 17:26 - 2015-05-06 17:27 - 05198336 _____ (AVAST Software) C:\Users\Jim\Desktop\aswMBR.exe
2015-05-04 16:48 - 2015-03-19 20:56 - 00080384 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ahcache.sys
2015-05-04 16:48 - 2015-03-17 12:26 - 00467776 ____C (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2015-05-04 16:48 - 2015-03-08 21:02 - 00057856 ____C (Microsoft Corporation) C:\windows\system32\Drivers\bthhfenum.sys
2015-05-04 16:48 - 2015-03-03 20:32 - 00172544 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Input.Inking.dll
2015-05-04 16:48 - 2015-03-03 20:12 - 00141824 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-04 16:47 - 2015-04-02 19:35 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\PhotoMetadataHandler.dll
2015-05-04 16:47 - 2015-04-02 19:14 - 00364544 _____ (Microsoft Corporation) C:\windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-04 16:47 - 2015-04-01 17:22 - 02985984 _____ (Microsoft Corporation) C:\windows\SysWOW64\dbgeng.dll
2015-05-04 16:47 - 2015-04-01 17:20 - 04417536 _____ (Microsoft Corporation) C:\windows\system32\dbgeng.dll
2015-05-04 16:47 - 2015-03-31 22:45 - 01491456 _____ (Microsoft Corporation) C:\windows\system32\dbghelp.dll
2015-05-04 16:47 - 2015-03-31 21:31 - 01207296 _____ (Microsoft Corporation) C:\windows\SysWOW64\dbghelp.dll
2015-05-04 16:47 - 2015-03-13 21:03 - 04179968 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-05-04 16:47 - 2015-03-12 21:59 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-05-04 16:47 - 2015-03-12 21:38 - 00358912 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-05-04 16:47 - 2015-03-10 20:49 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\sdbinst.exe
2015-05-04 16:47 - 2015-03-10 20:09 - 00021504 _____ (Microsoft Corporation) C:\windows\SysWOW64\sdbinst.exe
2015-05-04 16:47 - 2015-02-17 18:19 - 00186368 _____ (Microsoft Corporation) C:\windows\system32\dpapisrv.dll
2015-05-04 16:47 - 2015-02-12 21:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2015-05-04 16:47 - 2015-02-12 20:46 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2015-05-04 16:45 - 2015-03-12 19:29 - 00410017 _____ () C:\windows\system32\ApnDatabase.xml
2015-05-03 19:19 - 2015-01-05 22:01 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndproxy.sys
2015-05-03 19:19 - 2015-01-05 21:59 - 00080896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wanarp.sys
2015-05-03 19:19 - 2015-01-05 20:12 - 00185856 _____ (Microsoft Corporation) C:\windows\system32\rascfg.dll
2015-05-03 19:19 - 2015-01-05 20:02 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\rascfg.dll
2015-05-03 19:17 - 2015-01-29 19:53 - 02819584 _____ (Microsoft Corporation) C:\windows\system32\SettingsHandlers.dll
2015-05-03 19:16 - 2015-03-12 23:03 - 00239424 ____C (Microsoft Corporation) C:\windows\system32\Drivers\sdbus.sys
2015-05-03 19:16 - 2015-03-12 23:03 - 00154432 ____C (Microsoft Corporation) C:\windows\system32\Drivers\dumpsd.sys
2015-05-03 19:16 - 2015-03-12 21:02 - 00316416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\udfs.sys
2015-05-03 19:14 - 2015-03-04 18:09 - 01429504 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll
2015-05-03 16:59 - 2015-03-12 21:49 - 02256896 _____ (Microsoft Corporation) C:\windows\system32\dwmcore.dll
2015-05-03 16:59 - 2015-03-12 21:28 - 01943040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmcore.dll
2015-05-03 16:59 - 2015-03-12 20:11 - 02162176 _____ (Microsoft Corporation) C:\windows\system32\SRH.dll
2015-05-03 16:59 - 2015-03-12 19:39 - 01812992 _____ (Microsoft Corporation) C:\windows\SysWOW64\SRH.dll
2015-05-03 16:58 - 2015-03-05 21:47 - 01696256 _____ (Microsoft Corporation) C:\windows\system32\wevtsvc.dll
2015-05-03 16:56 - 2015-03-05 22:08 - 02067968 _____ (Microsoft Corporation) C:\windows\system32\wpdshext.dll
2015-05-03 16:56 - 2015-03-05 21:43 - 01969664 _____ (Microsoft Corporation) C:\windows\SysWOW64\wpdshext.dll
2015-04-25 13:06 - 2015-05-10 13:08 - 00003148 _____ () C:\windows\System32\Tasks\HPCeeScheduleForJim
2015-04-25 13:06 - 2015-05-10 13:08 - 00000338 _____ () C:\windows\Tasks\HPCeeScheduleForJim.job
2015-04-23 11:09 - 2015-04-23 11:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-21 18:23 - 2015-04-21 18:23 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf
2015-04-19 16:02 - 2015-04-19 16:02 - 00000000 ____D () C:\windows\System32\Tasks\Norton Security Suite
2015-04-19 15:46 - 2015-04-19 15:46 - 00000000 ____D () C:\windows\system32\appraiser
2015-04-17 17:20 - 2015-03-23 16:59 - 07476032 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-04-17 17:20 - 2015-03-23 16:59 - 01733952 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-04-17 17:20 - 2015-03-23 16:59 - 00360480 _____ (Microsoft Corporation) C:\windows\system32\sechost.dll
2015-04-17 17:20 - 2015-03-23 16:58 - 01498872 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-04-17 17:20 - 2015-03-23 16:45 - 00257216 _____ (Microsoft Corporation) C:\windows\SysWOW64\sechost.dll
2015-04-17 17:20 - 2015-03-19 23:12 - 00246272 _____ (Microsoft Corporation) C:\windows\system32\microsoft-windows-system-events.dll
2015-04-17 17:20 - 2015-03-19 23:10 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-04-17 17:20 - 2015-03-19 23:10 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-04-17 17:20 - 2015-03-19 22:17 - 00411648 _____ (Microsoft Corporation) C:\windows\system32\tracerpt.exe
2015-04-17 17:20 - 2015-03-19 21:41 - 00369152 _____ (Microsoft Corporation) C:\windows\SysWOW64\tracerpt.exe
2015-04-17 17:20 - 2015-03-19 21:40 - 00950784 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2015-04-17 17:20 - 2015-03-19 21:16 - 00749568 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll
2015-04-17 17:20 - 2015-03-12 23:32 - 24980480 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-17 17:20 - 2015-03-12 23:08 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-17 17:20 - 2015-03-12 23:07 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-04-17 17:20 - 2015-03-12 22:53 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-04-17 17:20 - 2015-03-12 22:50 - 06025216 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-17 17:20 - 2015-03-12 22:42 - 19695616 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-17 17:20 - 2015-03-12 22:28 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-17 17:20 - 2015-03-12 22:26 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-04-17 17:20 - 2015-03-12 22:22 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-04-17 17:20 - 2015-03-12 22:17 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-04-17 17:20 - 2015-03-12 22:16 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-04-17 17:20 - 2015-03-12 22:08 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-04-17 17:20 - 2015-03-12 22:07 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-17 17:20 - 2015-03-12 22:00 - 14397440 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-17 17:20 - 2015-03-12 21:50 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-04-17 17:20 - 2015-03-12 21:49 - 04305408 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-17 17:20 - 2015-03-12 21:45 - 02358784 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-17 17:20 - 2015-03-12 21:44 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-17 17:20 - 2015-03-12 21:34 - 12825600 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-17 17:20 - 2015-03-12 21:33 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-17 17:20 - 2015-03-12 21:22 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-04-17 17:20 - 2015-03-12 21:20 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-17 17:20 - 2015-03-12 21:16 - 01311232 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-17 17:20 - 2015-03-12 21:14 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-04-17 17:20 - 2015-02-20 18:49 - 00780800 _____ (Microsoft Corporation) C:\windows\system32\lsm.dll
2015-04-17 17:19 - 2015-03-12 21:58 - 00259072 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
2015-04-17 17:19 - 2015-03-12 21:37 - 00208896 _____ (Microsoft Corporation) C:\windows\SysWOW64\pku2u.dll
2015-04-17 17:19 - 2015-02-24 03:32 - 00991552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
2015-04-17 17:16 - 2015-03-04 05:25 - 00377152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\clfs.sys
2015-04-17 17:16 - 2015-03-03 22:04 - 00075264 _____ (Microsoft Corporation) C:\windows\system32\clfsw32.dll
2015-04-17 17:16 - 2015-03-03 21:19 - 00058880 _____ (Microsoft Corporation) C:\windows\SysWOW64\clfsw32.dll
2015-04-17 17:15 - 2015-03-22 17:45 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 01111552 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00957440 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00769024 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00726528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-04-17 17:15 - 2015-03-14 03:54 - 00133256 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-04-17 17:15 - 2015-03-13 20:56 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-04-17 17:15 - 2015-03-13 20:56 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-04-17 17:15 - 2015-03-13 20:51 - 00015360 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-04-17 17:15 - 2015-03-13 20:37 - 00267264 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-04-17 17:15 - 2015-03-13 20:14 - 00027136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2015-04-17 17:15 - 2015-03-13 19:22 - 03678720 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-04-17 17:15 - 2015-03-13 19:12 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-04-17 17:15 - 2015-03-13 19:12 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-04-17 17:15 - 2015-03-13 19:09 - 00200192 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2015-04-17 17:15 - 2015-03-13 19:08 - 00408064 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2015-04-17 17:15 - 2015-03-13 19:08 - 00095744 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-04-17 17:15 - 2015-03-13 19:06 - 02373632 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-04-17 17:15 - 2015-03-13 19:06 - 00891392 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-04-17 17:15 - 2015-03-13 19:02 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-04-17 17:15 - 2015-03-13 19:02 - 00029696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-04-17 17:15 - 2015-03-13 18:59 - 00721920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-04-17 17:15 - 2015-03-13 18:59 - 00081920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-04-17 17:15 - 2014-12-02 18:09 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-11 18:38 - 2014-03-30 17:25 - 01236852 _____ () C:\windows\WindowsUpdate.log
2015-05-11 18:38 - 2013-08-22 09:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-05-11 18:38 - 2013-08-22 08:25 - 00262144 ___SH () C:\windows\system32\config\BBI
2015-05-11 18:37 - 2014-08-09 17:05 - 00000000 ____D () C:\Users\Jim\AppData\Roaming\ID Vault
2015-05-11 18:36 - 2014-04-19 18:59 - 00000920 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-11 18:34 - 2014-04-19 19:33 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-05-11 18:31 - 2013-08-22 08:25 - 00262144 ___SH () C:\windows\system32\config\ELAM
2015-05-11 18:28 - 2014-04-19 18:59 - 00000916 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-11 18:28 - 2014-03-30 17:38 - 00000000 __RDO () C:\Users\Jim\SkyDrive
2015-05-11 18:28 - 2013-08-22 10:36 - 00000000 ___HD () C:\windows\ELAMBKUP
2015-05-11 18:28 - 2013-08-22 09:46 - 00021177 _____ () C:\windows\setupact.log
2015-05-11 18:00 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\system32\sru
2015-05-09 12:03 - 2014-04-05 11:53 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2015-05-07 11:11 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\LiveKernelReports
2015-05-06 18:54 - 2014-08-09 17:04 - 00000000 ____D () C:\Program Files (x86)\Constant Guard Protection Suite
2015-05-06 17:56 - 2014-03-30 17:33 - 00000000 ____D () C:\Users\Jim
2015-05-06 16:32 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\rescache
2015-05-05 17:29 - 2014-04-05 16:57 - 00000000 ____D () C:\Users\Jim\AppData\Local\CrashDumps
2015-05-04 17:31 - 2014-08-09 17:05 - 00000000 ____D () C:\Users\Jim\AppData\Local\ID Vault
2015-05-04 17:12 - 2013-08-22 10:20 - 00000000 ____D () C:\windows\CbsTemp
2015-05-04 16:54 - 2013-08-22 09:44 - 00390888 _____ () C:\windows\system32\FNTCACHE.DAT
2015-05-04 10:52 - 2013-08-24 16:38 - 00338230 _____ () C:\windows\system32\PerfStringBackup.INI
2015-05-03 21:56 - 2014-04-28 17:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-03 21:56 - 2013-08-24 16:32 - 04500318 _____ () C:\windows\PFRO.log
2015-05-03 19:19 - 2013-08-22 10:36 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
2015-05-03 19:19 - 2013-08-22 08:36 - 00000000 ____D () C:\windows\system32\AdvancedInstallers
2015-05-01 19:55 - 2014-03-30 17:41 - 00003600 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2929747491-3707589749-4234719784-1001
2015-05-01 19:08 - 2014-04-04 20:28 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-01 19:05 - 2014-10-28 20:40 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-01 18:53 - 2015-01-21 18:32 - 00097888 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-30 18:05 - 2014-04-04 19:32 - 00000000 ____D () C:\Users\Jim\Documents\Lexar
2015-04-29 21:43 - 2014-04-19 19:01 - 00002210 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-28 16:33 - 2014-04-19 19:33 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-04-28 16:33 - 2014-04-19 19:32 - 00000000 ____D () C:\Users\Jim\AppData\Local\Adobe
2015-04-24 10:41 - 2014-12-10 11:45 - 00002216 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fast Connect.lnk
2015-04-19 16:32 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\AppCompat
2015-04-19 15:57 - 2014-08-09 17:09 - 00003228 _____ () C:\windows\System32\Tasks\Norton WSC Integration
2015-04-19 15:57 - 2014-08-09 17:09 - 00002467 _____ () C:\Users\Public\Desktop\Norton Security Suite.lnk
2015-04-19 15:57 - 2014-08-09 17:09 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Suite
2015-04-19 15:57 - 2014-08-09 17:09 - 00000000 ____D () C:\windows\system32\Drivers\N360x64
2015-04-19 15:46 - 2014-11-26 19:45 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-04-17 17:55 - 2014-03-30 18:59 - 00000000 ____D () C:\windows\system32\MRT
2015-04-17 17:34 - 2014-03-30 18:59 - 128913832 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-04-17 17:33 - 2014-04-04 19:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-13 18:24 - 2015-03-13 22:22 - 00792056 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-04-13 18:24 - 2015-03-13 22:22 - 00178168 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2014-09-21 21:14 - 2014-09-21 21:14 - 0004608 _____ () C:\Users\Jim\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-01 16:17 - 2014-04-01 16:17 - 0007605 _____ () C:\Users\Jim\AppData\Local\Resmon.ResmonCfg

Some content of TEMP:
====================
C:\Users\Jim\AppData\Local\Temp\Extract.exe
C:\Users\Jim\AppData\Local\Temp\ose00000.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-05-02 12:47

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-05-2015
Ran by [removed] at 2015-05-11 18:48:39
Running from C:\Users\[removed]\Desktop
Boot Mode: Safe Mode (with Networking)
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2929747491-3707589749-4234719784-500 - Administrator - Disabled)
Guest (S-1-5-21-2929747491-3707589749-4234719784-501 - Limited - Disabled)
Jim (S-1-5-21-2929747491-3707589749-4234719784-1001 - Administrator - Enabled) => C:\Users\Jim

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Security Suite (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Security Suite (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Security Suite (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Digital Editions 3.0 (HKLM-x32\…\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Alcor Micro USB Card Reader Driver (HKLM-x32\…\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
Amazon Kindle (HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\…\Amazon Kindle) (Version: - Amazon)
AMD Catalyst Install Manager (HKLM\…\{7288D4D9-90E0-2B03-43D0-0BB6D4496577}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\…\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bing Bar (HKLM-x32\…\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3103 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\…\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.3.4323 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3215 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.5.3215 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Fast Connect (HKLM-x32\…\ID Vault) (Version: 1.15.414.3 - White Sky)
Fishdom 3: Collector's Edition (x32 Version: 3.0.2.38 - WildTangent) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 42.0.2311.135 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\…\HPConnectedMusic) (Version: 1.1 (build 126) hp - Meridian Audio Ltd)
HP Documentation (HKLM-x32\…\{06600E94-1C34-40E2-AB09-D30AECF78172}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7127.4628 - Hewlett-Packard)
HP SimplePass (HKLM-x32\…\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.51 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\…\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
Inst5675 (Version: 8.00.51 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.51 - Softex Inc.) Hidden
iTunes (HKLM\…\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 8 Update 45 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
King Oddball (x32 Version: 3.0.2.48 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mahjongg Dimensions Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Microsoft Mouse and Keyboard Center (HKLM\…\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 37.0.2 (x86 en-US)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
Norton Security Suite (HKLM-x32\…\N360) (Version: 21.7.0.11 - Symantec Corporation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Driver Installation Program (HKLM-x32\…\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.30175 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7135 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7001 - CyberLink Corp.) Hidden
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
XFINITY Toolbar (HKLM-x32\…\xfin_portal) (Version: 4.1.0.14 - )
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points =========================

17-04-2015 17:21:17 Windows Update
27-04-2015 16:06:54 Scheduled Checkpoint
30-04-2015 17:41:30 HPSF Applying updates
01-05-2015 21:20:06 HPSF Restore Point
09-05-2015 11:59:09 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00DBE29E-5B14-4B50-8926-5C05D1B796D5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {076340C4-AD63-46E3-8CF9-E39AF1360D70} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {107BD6D1-AA6C-4F4F-9CD6-42A895170E53} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2013-11-04] (Hewlett-Packard Company)
Task: {1C32742F-3381-4203-9120-E76871322F06} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {22D1052A-AE5F-4CC5-8A8E-6B5737233C9E} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {2D96A8E3-B35D-40FD-89E3-87276666D77A} - System32\Tasks\HPCeeScheduleForJim => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {36EA9248-1D0B-48FF-BE0B-E2DAF110A39D} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {3EDFABD2-0A12-48F6-AD49-39ABBCD3606C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-19] (Google Inc.)
Task: {4853E8D1-769C-4EAE-8815-59FADD783C98} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {4B205B60-653F-4E40-98AC-A3660B83E4B0} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\WSCStub.exe [2015-03-07] (Symantec Corporation)
Task: {4E00FF75-92A8-44CD-AC46-35D039887A48} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {601D9685-A4B9-4C67-8971-1CADC60B6258} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-23] (Microsoft Corporation)
Task: {631DEFA6-223B-4EFD-8B5D-9FD232B0CE7D} - System32\Tasks\Norton Security Suite\Norton Error Processor => C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {6B62C899-F4C8-40DA-A2B5-659EE79C77F1} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {7004F9A3-4465-427C-96BA-6C6CB0C7855E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-04-17] (Microsoft Corporation)
Task: {809C5432-A542-4412-A2AE-59A0F5E274BE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {831632FB-4DEC-4A4E-AD7A-EAED02B5AC62} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {87B6ED10-08F1-4714-88C0-9B19D332C304} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-28] (Adobe Systems Incorporated)
Task: {929F3A4F-07BE-45D6-AD50-1B0C53535A6B} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {9D596D3C-65CA-40F7-8ED8-E6F1AA3FCBCA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {AFF12284-AA86-4129-8B39-F4A91092EF73} - System32\Tasks\Norton Security Suite\Norton Error Analyzer => C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {B3CBBD9C-FDDB-4DF1-912B-F7DC985A2041} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {CC8F743E-0498-4BD1-96EE-DE5BDB0521C3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {ECCBDD2A-B697-4E84-B7B7-B5BDB1B63806} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-19] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForJim.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) ==============

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Jim\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\HP\HP_Svinoya_Norway_Sunset.jpg
DNS Servers: 75.75.76.76 - 75.75.75.75

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\…\StartupApproved\StartupFolder: => "Constant Guard.lnk"
HKLM\…\StartupApproved\Run32: => "iTunesHelper"

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{0495187A-1A97-4F48-B9BB-71295F838ED0}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{142F0EFE-F134-46F4-B4F1-51A03381809E}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{8C107EC2-A34B-43C8-A695-0B4C53E6DEC9}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe
FirewallRules: [{7A4D53A8-02E0-4F48-BEBB-F3A5CE0F40F8}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe
FirewallRules: [{49345102-4F25-4113-8C45-5C278970877D}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe
FirewallRules: [{E840CC4C-80AD-40BC-AEAC-5A6871696FDC}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe
FirewallRules: [{C9C82C7D-30AE-43A1-9C8A-CD47EFC56A1A}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{E986A8C4-5608-4C1F-9B70-8E0DF4E5E56D}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{AB4B9E2B-FA9B-4CED-97F8-9B91165947E7}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{ED9C10DC-B46D-492E-AFF1-3D74641478D6}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{00FB08CB-7A8F-4BC1-8A24-7A56BA4D27E9}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{D5E892C0-1AD0-4971-97CF-93FCD55E3EDA}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{D5BDC82A-C719-4A29-803F-76CA68F8242B}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{3E2F0CFB-81B7-43E9-9421-2C315CD8F019}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{353788C0-E8A9-4646-9E2B-055C7332ACD6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C9B099B9-8F35-4546-9EEC-BCC911A98D80}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8E45761C-C8A9-43DB-BFC5-460C597FFD4E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D31A0594-DB62-4921-8658-D4D0EAB8E994}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{1E210E58-2554-474C-AC91-E72FD7F0893A}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{BF7009A5-79A0-429B-BEB5-FBAE150B20A6}] => (Allow) C:\Program Files (x86)\xfin_portal\dtuser.exe
FirewallRules: [{C900CE85-B48A-47F9-8943-B0358F92A3D7}] => (Allow) C:\Program Files (x86)\xfin_portal\dtuser.exe
FirewallRules: [{BE151535-29D9-417E-AF5F-D064D0C9FEBC}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{8B362C06-356F-475B-AE7D-B6686E0AACCF}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPPSdr\HPDiagnosticCoreUI.exe
FirewallRules: [{89A91A52-F3AD-4887-BF4A-B48FC5723931}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPPSdr\HPDiagnosticCoreUI.exe
FirewallRules: [{1DFC5900-FF38-458C-AAAC-0A9ADCD7CC06}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{556ABD8E-708F-4E5F-8ECA-E8DAA5638714}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{346F7E13-4840-4885-9A01-B8BCA16D2E8F}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{4097390B-6AD5-4CE2-B8B6-CD9D9AD747EF}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{4EBF33C4-8E47-460F-8BE6-B39712A3A145}] => (Allow) LPort=2869
FirewallRules: [{44A857F9-8D7D-4E4A-B1F9-5265019B9682}] => (Allow) LPort=1900
FirewallRules: [{89B3B2A9-033A-4C30-9012-A5A13C8F6C25}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{24A8B934-B3D0-4917-B139-E098E544B747}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{4A358EAF-3FDC-47A6-A8A9-9FF59EE520C7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5FE87D83-6E7F-4281-802C-C58A64C6D865}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CB1A7A78-E27F-4EC8-9110-427320E04C75}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{7D3873B8-3F7E-49A2-8CD7-6A330C0EF3C0}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [{D2A2DBAD-0B0C-4E2B-9037-C461D2CC3022}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{9A78B8A4-555B-4321-BC42-AC067A262D60}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (05/11/2015 00:18:07 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (05/10/2015 11:10:09 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (05/09/2015 01:30:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3281

Error: (05/09/2015 01:30:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3281

Error: (05/09/2015 01:30:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/09/2015 01:30:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1593

Error: (05/09/2015 01:30:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1593

Error: (05/09/2015 01:30:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/09/2015 11:03:12 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (05/09/2015 10:27:46 AM) (Source: IDVault) (EventID: 0) (User: )
Description: SessionChange Error No process is associated with this object.

System errors:
=============
Error: (05/11/2015 06:48:57 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (05/11/2015 06:48:40 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (05/11/2015 06:48:40 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (05/11/2015 06:48:30 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (05/11/2015 06:48:30 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (05/11/2015 06:48:30 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (05/11/2015 06:45:40 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (05/11/2015 06:45:40 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (05/11/2015 06:45:08 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (05/11/2015 06:43:37 PM) (Source: DCOM) (EventID: 10005) (User: MAINPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: AMD E1-2500 APU with Radeon(TM) HD Graphics
Percentage of memory in use: 28%
Total physical RAM: 3517.36 MB
Available physical RAM: 2513.99 MB
Total Pagefile: 4157.36 MB
Available Pagefile: 3219.61 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:448.63 GB) (Free:389.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:15.65 GB) (Free:1.9 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 35A870C1)

Partition: GPT Partition Type.

==================== End Of Log ============================

ken545

Post #6May 11, 2015, 11:58 PM UTC

Glad that worked out for you, looking at some PUPs (Potentially Unwanted Programs)

Run these tools in order and post the log for each one so I can see where we stand

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner To your Desktop

Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers

Do not click on any links in the top Advertisment.

[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click on Scan.

After the scan is complete click on "Clean"

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the content of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

===============================================================================

[external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

===============================================================================

Download Malwarebytes' Anti-Malware to your desktop. <———

Windows XP : Double click on the icon to run it.

Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

[external image: MBAM2010601022_zpsyvzbaddn.jpg]

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Treat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up…select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

denisemn

Post #7May 12, 2015, 1:42 AM UTC

Hi Ken,

New logs are posted below.

I wanted to mention that after I restarted from Safe mode my Comcast Fast Coonect thing wanted to start and I said okay. The Offers4U popup widget is back. Is Comcast possible a problem?

Thanks, Denise

# AdwCleaner v4.203 - Logfile created 11/05/2015 at 19:26:23
# Updated 30/04/2015 by Xplode
# Database : 2015-05-11.1 [Server]
# Operating system : Windows 8.1 (x64)
# Username : Jim - MAINPC
# Running from : C:\Users\Jim\Desktop\adwcleaner_4.203.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\xfin_portal
Folder Deleted : C:\Users\Jim\AppData\LocalLow\comcasttb
Folder Deleted : C:\Users\Jim\AppData\LocalLow\xfin_portal
Folder Deleted : C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{49BC4DD1-0E69-4611-9164-0009538C5E46}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0214A12B-C5A3-437F-A6F3-068ABCD8C85E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{08635077-8829-49E2-B338-C968817EB460}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{20A3F109-F7C1-47B4-8098-8E654B264B1D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8C7478AB-3155-463E-936F-55F91F0F10D0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{96DD9437-5D20-4EFB-BF52-A4A605A4E0AA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9E1B65EE-A131-42B4-94CA-847505E2F611}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0214A12B-C5A3-437F-A6F3-068ABCD8C85E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{96DD9437-5D20-4EFB-BF52-A4A605A4E0AA}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4A11A6BD-7880-49BD-92D4-6F09D0BD3250}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{68DE31F7-43FF-4EE2-B88B-10665016970D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1791C1B5-FFD0-4D4B-ABCD-7A7DF6EAA89C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49BC4DD1-0E69-4611-9164-0009538C5E46}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0214A12B-C5A3-437F-A6F3-068ABCD8C85E}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{96DD9437-5D20-4EFB-BF52-A4A605A4E0AA}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}]
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49BC4DD1-0E69-4611-9164-0009538C5E46}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B9BCCE8-A70B-402A-A7E1-DB96831EE26F}
Key Deleted : HKCU\Software\AppDataLow\Software\xfin_portal
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\xfin_portal

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416

-\\ Mozilla Firefox v37.0.2 (x86 en-US)

-\\ Google Chrome v42.0.2311.135

[C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : mkfokfffehpeedafpekjeddnmnjhmcmk

*************************

AdwCleaner[R0].txt - [4656 bytes] - [11/05/2015 19:22:56]
AdwCleaner[S0].txt - [4629 bytes] - [11/05/2015 19:26:23]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4688 bytes] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.7.0 (05.09.2015:1)
OS: Windows 8.1 x64
Ran by [removed] on Mon 05/11/2015 at 19:38:18.07
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

Successfully deleted: [Task] C:\windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-1042574177-205660189-2733560804-500
Successfully deleted: [Task] C:\windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2412690050-1992779262-99719292-500
Successfully deleted: [Task] C:\windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2929747491-3707589749-4234719784-1001
Successfully deleted: [Task] C:\windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2929747491-3707589749-4234719784-500

~~~ Registry Values

~~~ Registry Keys

~~~ Files

Successfully deleted: [File] C:\windows\prefetch\XFINITYTOOLBAR.EXE-615EB273.pf

~~~ Folders

~~~ Chrome

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 05/11/2015 at 19:47:54.06
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/11/2015
Scan Time: 7:56:54 PM
Logfile: MWbytes.txt
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.05.11.07
Rootkit Database: v2015.04.21.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Jim

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 357939
Time Elapsed: 27 min, 13 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\${dtUserElevationPolicyID}, , [6102eaa896f46acc6a8f72e4ac59e31d],
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\${dtUserElevationPolicyID}, , [1c47e8aa711994a24eabca8c9273d828],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

ken545

Post #8May 12, 2015, 2:40 AM UTC

Not sure about Comcast but we can look into it

When you ran Malwarebytes, you need to remove those entries it found, maybe run it again to make sure there gone, make sure you followed the instructions I posted

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

After your sure the entries in Malwarebytes are gone, open up FRST, be sure to checkmark Additions, run a new scan and post both logs please

denisemn

Post #9May 12, 2015, 11:43 PM UTC

Hi Ken,

I was unable to open MWB's at first, tried several times to run as admin. Not sure what was going on but my husband said the email had been slow all day. So I restarted the PC and it MWB's did open for me. Both MWB and the FRST64 logs are below.

Thanks abundle.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/12/2015
Scan Time: 5:41:04 PM
Logfile: Malw5.12.txt
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.05.12.08
Rootkit Database: v2015.04.21.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Jim

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 357745
Time Elapsed: 25 min, 18 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\${dtUserElevationPolicyID}, , [f1d7bcd686041c1a104dd681778e49b7],
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\${dtUserElevationPolicyID}, , [f3d5e1b1c3c780b6cc91eb6c3acb9769],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

=================================================

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2015
Ran by [removed] (administrator) on MAINPC on 12-05-2015 18:34:23
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(White Sky, Inc.) C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\n360.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(White Sky, Inc.) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\n360.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2793016 2013-09-05] (Hewlett-Packard)
HKLM\…\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\…\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7506648 2014-01-13] (Realtek Semiconductor)
HKLM-x32\…\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-11] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\…\Run: [ComcastAntispyClient] => "C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" /hide
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Constant Guard.lnk [2014-08-09]
ShortcutTarget: Constant Guard.lnk -> C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe (White Sky, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Fast Connect.lnk [2014-12-10]
ShortcutTarget: Fast Connect.lnk -> C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe (White Sky, Inc.)
ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\buShell.dll [2015-03-06] (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\buShell.dll [2015-03-06] (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\buShell.dll [2015-03-06] (Symantec Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK14/1
HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://xfinity.comcast.net/
HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK14/1
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> DefaultScope {BC8143CF-927E-436E-AE39-AE87B3925F74} URL = http://search.whiteskyservices.com/?wstoken=1510AD7A-56F8-41A8-A06C-2A1BD851A375&dtid=1&pid=21&src=sgsearch&v=1.14.1126.5&searchparam={SearchTerms}
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> {BC8143CF-927E-436E-AE39-AE87B3925F74} URL = http://search.whiteskyservices.com/?wstoken=1510AD7A-56F8-41A8-A06C-2A1BD851A375&dtid=1&pid=21&src=sgsearch&v=1.14.1126.5&searchparam={SearchTerms}
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> {C6523212-13C9-43C9-8D87-6235EF9B5745} URL = http://search.xfinity.com/?cat=web&con=toolbar&cid=xfstart_tech_search&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\IPS\IPSBHO.DLL [2015-03-04] (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-01] (Oracle Corporation)
BHO-x32: Fast Connect -> {B84CDBE7-1B46-494B-A188-01D4C52DEB61} -> C:\ProgramData\White Sky, Inc\ID Vault\IEBHO1.15.414.3\NativeBHO.dll [2015-04-14] (WhiteSky)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-01] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75

FireFox:
========
FF ProfilePath: C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default
FF DefaultSearchEngine: Connect Search
FF DefaultSearchEngine.US: Google
FF SelectedSearchEngine: Connect Search
FF Homepage: hxxp://xfinity.comcast.net/?xcr=1&referrer=http%253A%252F%252Fwww.google.com%252Fsearch%253Fq%253Dinfinity%252Btv%252Bcomcast%2526sourceid%253Die7%2526rls%253Dcom.microsoft%253Aen-us%253AIE-SearchBox%2526ie%253D%2526oe%253D
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-28] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-28] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-05-06] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-01] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-03] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF SearchPlugin: C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default\searchplugins\Connect Search.xml [2014-12-19]
FF Extension: White Sky Fast Connect - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default\Extensions\idvaultaddon@whitesky [2015-04-07]
FF Extension: No Name - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default\Extensions\temp [2014-08-09]
FF HKLM-x32\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2015-05-12]

Chrome:
=======
CHR HomePage: Default -> hxxp://xfinity.comcast.net/tt/
CHR Profile: C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-19]
CHR Extension: (Google Drive) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-19]
CHR Extension: (Google Search) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-19]
CHR Extension: (XFINITY Constant Guard Protection Suite) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\faknfdmfmhcmgphbfjhgmomfcihmocmp [2014-07-05]
CHR Extension: (Bookmark Manager) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-01-26]
CHR Extension: (Norton Identity Safe) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-08-15]
CHR Extension: (Wolf Pack 1366x768) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfcmbfncajdbnpecmokohfalodnlpkln [2014-04-19]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Google Wallet) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-19]
CHR Extension: (Gmail) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-19]
CHR HKLM\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\Exts\Chrome.crx [2015-04-08]
CHR HKLM-x32\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\Exts\Chrome.crx [2015-04-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)
R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-09-05] () [File not signed]
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-04] (Microsoft Corporation)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\N360.exe [265000 2015-03-26] (Symantec Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-09-05] (Softex Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-13] (Realtek Semiconductor)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-07-02] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)
S2 mcbootdelaystartsvc; "C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-22] (Advanced Micro Devices, Inc.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
R1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20150506.001\BHDrvx64.sys [1639128 2015-05-01] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1507000.00B\ccSetx64.sys [162392 2013-09-25] (Symantec Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20150512.001\IDSvia64.sys [671448 2015-03-27] (Symantec Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-05-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20150512.008\ENG64.SYS [129752 2015-04-29] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20150512.008\EX64.SYS [2137304 2015-04-29] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1507000.00B\SRTSP64.SYS [876248 2014-08-25] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1507000.00B\SRTSPX64.SYS [37592 2014-08-25] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1507000.00B\SYMDS64.SYS [493656 2013-09-09] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1507000.00B\SYMEFA64.SYS [1148120 2014-08-25] (Symantec Corporation)
S4 SymELAM; C:\Windows\system32\drivers\N360x64\1507000.00B\SymELAM.sys [23568 2013-09-09] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-08-09] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1507000.00B\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1507000.00B\SYMNETS.SYS [593112 2014-08-25] (Symantec Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)
S1 AntiLog32; \??\C:\windows\system32\drivers\AntiLog64.sys [X]
U3 McMPFSvc; No ImagePath
U3 McNaiAnn; No ImagePath
U3 mcpltsvc; No ImagePath
U3 McProxy; No ImagePath
U3 mfecore; No ImagePath
U3 MSK80Service; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-12 18:31 - 2015-05-12 18:31 - 00001352 _____ () C:\Users\Jim\Desktop\Malw5.12.txt
2015-05-11 20:38 - 2015-05-11 20:38 - 00001351 _____ () C:\Users\Jim\Desktop\MWbytes.txt
2015-05-11 19:57 - 2015-05-12 18:07 - 00003600 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2929747491-3707589749-4234719784-1001
2015-05-11 19:52 - 2015-05-12 17:36 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-11 19:51 - 2015-05-11 19:51 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-11 19:51 - 2015-05-11 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-11 19:51 - 2015-05-11 19:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-11 19:51 - 2015-05-11 19:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-05-11 19:51 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-05-11 19:51 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-05-11 19:51 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-05-11 19:50 - 2015-05-11 19:50 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Jim\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-11 19:47 - 2015-05-11 19:47 - 00001358 _____ () C:\Users\Jim\Desktop\JRT.txt
2015-05-11 19:38 - 2015-05-11 19:38 - 00000207 _____ () C:\windows\tweaking.com-regbackup-MAINPC-Windows-8.1-(64-bit).dat
2015-05-11 19:38 - 2015-05-11 19:38 - 00000000 ____D () C:\RegBackup
2015-05-11 19:37 - 2015-05-11 19:37 - 02720307 _____ (Thisisu) C:\Users\Jim\Desktop\JRT.exe
2015-05-11 19:29 - 2015-05-11 19:29 - 00004800 _____ () C:\Users\Jim\Desktop\AdwCleaner[S0].txt
2015-05-11 19:22 - 2015-05-11 19:31 - 00000000 ____D () C:\AdwCleaner
2015-05-11 19:19 - 2015-05-11 19:19 - 02204160 _____ () C:\Users\Jim\Desktop\adwcleaner_4.203.exe
2015-05-11 18:48 - 2015-05-11 18:49 - 00029121 _____ () C:\Users\Jim\Desktop\Addition.txt
2015-05-11 18:45 - 2015-05-12 18:34 - 00021883 _____ () C:\Users\Jim\Desktop\FRST.txt
2015-05-11 18:44 - 2015-05-12 18:34 - 00000000 ____D () C:\FRST
2015-05-11 18:43 - 2015-05-11 18:43 - 02102784 _____ (Farbar) C:\Users\Jim\Desktop\FRST64.exe
2015-05-07 16:10 - 2015-05-07 16:10 - 00002671 _____ () C:\Users\Jim\Desktop\aswMBR.txt
2015-05-07 16:10 - 2015-05-07 16:10 - 00000512 _____ () C:\Users\Jim\Desktop\MBR.dat
2015-05-06 17:26 - 2015-05-06 17:27 - 05198336 _____ (AVAST Software) C:\Users\Jim\Desktop\aswMBR.exe
2015-05-04 16:48 - 2015-03-19 20:56 - 00080384 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ahcache.sys
2015-05-04 16:48 - 2015-03-17 12:26 - 00467776 ____C (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2015-05-04 16:48 - 2015-03-08 21:02 - 00057856 ____C (Microsoft Corporation) C:\windows\system32\Drivers\bthhfenum.sys
2015-05-04 16:48 - 2015-03-03 20:32 - 00172544 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Input.Inking.dll
2015-05-04 16:48 - 2015-03-03 20:12 - 00141824 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-04 16:47 - 2015-04-02 19:35 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\PhotoMetadataHandler.dll
2015-05-04 16:47 - 2015-04-02 19:14 - 00364544 _____ (Microsoft Corporation) C:\windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-04 16:47 - 2015-04-01 17:22 - 02985984 _____ (Microsoft Corporation) C:\windows\SysWOW64\dbgeng.dll
2015-05-04 16:47 - 2015-04-01 17:20 - 04417536 _____ (Microsoft Corporation) C:\windows\system32\dbgeng.dll
2015-05-04 16:47 - 2015-03-31 22:45 - 01491456 _____ (Microsoft Corporation) C:\windows\system32\dbghelp.dll
2015-05-04 16:47 - 2015-03-31 21:31 - 01207296 _____ (Microsoft Corporation) C:\windows\SysWOW64\dbghelp.dll
2015-05-04 16:47 - 2015-03-13 21:03 - 04179968 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-05-04 16:47 - 2015-03-12 21:59 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-05-04 16:47 - 2015-03-12 21:38 - 00358912 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-05-04 16:47 - 2015-03-10 20:49 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\sdbinst.exe
2015-05-04 16:47 - 2015-03-10 20:09 - 00021504 _____ (Microsoft Corporation) C:\windows\SysWOW64\sdbinst.exe
2015-05-04 16:47 - 2015-02-17 18:19 - 00186368 _____ (Microsoft Corporation) C:\windows\system32\dpapisrv.dll
2015-05-04 16:47 - 2015-02-12 21:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2015-05-04 16:47 - 2015-02-12 20:46 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2015-05-04 16:45 - 2015-03-12 19:29 - 00410017 _____ () C:\windows\system32\ApnDatabase.xml
2015-05-03 19:19 - 2015-01-05 22:01 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndproxy.sys
2015-05-03 19:19 - 2015-01-05 21:59 - 00080896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wanarp.sys
2015-05-03 19:19 - 2015-01-05 20:12 - 00185856 _____ (Microsoft Corporation) C:\windows\system32\rascfg.dll
2015-05-03 19:19 - 2015-01-05 20:02 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\rascfg.dll
2015-05-03 19:17 - 2015-01-29 19:53 - 02819584 _____ (Microsoft Corporation) C:\windows\system32\SettingsHandlers.dll
2015-05-03 19:16 - 2015-03-12 23:03 - 00239424 ____C (Microsoft Corporation) C:\windows\system32\Drivers\sdbus.sys
2015-05-03 19:16 - 2015-03-12 23:03 - 00154432 ____C (Microsoft Corporation) C:\windows\system32\Drivers\dumpsd.sys
2015-05-03 19:16 - 2015-03-12 21:02 - 00316416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\udfs.sys
2015-05-03 19:14 - 2015-03-04 18:09 - 01429504 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll
2015-05-03 16:59 - 2015-03-12 21:49 - 02256896 _____ (Microsoft Corporation) C:\windows\system32\dwmcore.dll
2015-05-03 16:59 - 2015-03-12 21:28 - 01943040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmcore.dll
2015-05-03 16:59 - 2015-03-12 20:11 - 02162176 _____ (Microsoft Corporation) C:\windows\system32\SRH.dll
2015-05-03 16:59 - 2015-03-12 19:39 - 01812992 _____ (Microsoft Corporation) C:\windows\SysWOW64\SRH.dll
2015-05-03 16:58 - 2015-03-05 21:47 - 01696256 _____ (Microsoft Corporation) C:\windows\system32\wevtsvc.dll
2015-05-03 16:56 - 2015-03-05 22:08 - 02067968 _____ (Microsoft Corporation) C:\windows\system32\wpdshext.dll
2015-05-03 16:56 - 2015-03-05 21:43 - 01969664 _____ (Microsoft Corporation) C:\windows\SysWOW64\wpdshext.dll
2015-04-25 13:06 - 2015-05-10 13:08 - 00003148 _____ () C:\windows\System32\Tasks\HPCeeScheduleForJim
2015-04-25 13:06 - 2015-05-10 13:08 - 00000338 _____ () C:\windows\Tasks\HPCeeScheduleForJim.job
2015-04-23 11:09 - 2015-04-23 11:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-21 18:23 - 2015-04-21 18:23 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf
2015-04-19 16:02 - 2015-04-19 16:02 - 00000000 ____D () C:\windows\System32\Tasks\Norton Security Suite
2015-04-19 15:46 - 2015-04-19 15:46 - 00000000 ____D () C:\windows\system32\appraiser
2015-04-17 17:20 - 2015-03-23 16:59 - 07476032 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-04-17 17:20 - 2015-03-23 16:59 - 01733952 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-04-17 17:20 - 2015-03-23 16:59 - 00360480 _____ (Microsoft Corporation) C:\windows\system32\sechost.dll
2015-04-17 17:20 - 2015-03-23 16:58 - 01498872 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-04-17 17:20 - 2015-03-23 16:45 - 00257216 _____ (Microsoft Corporation) C:\windows\SysWOW64\sechost.dll
2015-04-17 17:20 - 2015-03-19 23:12 - 00246272 _____ (Microsoft Corporation) C:\windows\system32\microsoft-windows-system-events.dll
2015-04-17 17:20 - 2015-03-19 23:10 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-04-17 17:20 - 2015-03-19 23:10 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-04-17 17:20 - 2015-03-19 22:17 - 00411648 _____ (Microsoft Corporation) C:\windows\system32\tracerpt.exe
2015-04-17 17:20 - 2015-03-19 21:41 - 00369152 _____ (Microsoft Corporation) C:\windows\SysWOW64\tracerpt.exe
2015-04-17 17:20 - 2015-03-19 21:40 - 00950784 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2015-04-17 17:20 - 2015-03-19 21:16 - 00749568 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll
2015-04-17 17:20 - 2015-03-12 23:32 - 24980480 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-17 17:20 - 2015-03-12 23:08 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-17 17:20 - 2015-03-12 23:07 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-04-17 17:20 - 2015-03-12 22:53 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-04-17 17:20 - 2015-03-12 22:50 - 06025216 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-17 17:20 - 2015-03-12 22:42 - 19695616 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-17 17:20 - 2015-03-12 22:28 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-17 17:20 - 2015-03-12 22:26 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-04-17 17:20 - 2015-03-12 22:22 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-04-17 17:20 - 2015-03-12 22:17 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-04-17 17:20 - 2015-03-12 22:16 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-04-17 17:20 - 2015-03-12 22:08 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-04-17 17:20 - 2015-03-12 22:07 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-17 17:20 - 2015-03-12 22:00 - 14397440 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-17 17:20 - 2015-03-12 21:50 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-04-17 17:20 - 2015-03-12 21:49 - 04305408 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-17 17:20 - 2015-03-12 21:45 - 02358784 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-17 17:20 - 2015-03-12 21:44 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-17 17:20 - 2015-03-12 21:34 - 12825600 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-17 17:20 - 2015-03-12 21:33 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-17 17:20 - 2015-03-12 21:22 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-04-17 17:20 - 2015-03-12 21:20 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-17 17:20 - 2015-03-12 21:16 - 01311232 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-17 17:20 - 2015-03-12 21:14 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-04-17 17:20 - 2015-02-20 18:49 - 00780800 _____ (Microsoft Corporation) C:\windows\system32\lsm.dll
2015-04-17 17:19 - 2015-03-12 21:58 - 00259072 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
2015-04-17 17:19 - 2015-03-12 21:37 - 00208896 _____ (Microsoft Corporation) C:\windows\SysWOW64\pku2u.dll
2015-04-17 17:19 - 2015-02-24 03:32 - 00991552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
2015-04-17 17:16 - 2015-03-04 05:25 - 00377152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\clfs.sys
2015-04-17 17:16 - 2015-03-03 22:04 - 00075264 _____ (Microsoft Corporation) C:\windows\system32\clfsw32.dll
2015-04-17 17:16 - 2015-03-03 21:19 - 00058880 _____ (Microsoft Corporation) C:\windows\SysWOW64\clfsw32.dll
2015-04-17 17:15 - 2015-03-22 17:45 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 01111552 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00957440 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00769024 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00726528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-04-17 17:15 - 2015-03-22 17:09 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-04-17 17:15 - 2015-03-14 03:54 - 00133256 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-04-17 17:15 - 2015-03-13 20:56 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-04-17 17:15 - 2015-03-13 20:56 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-04-17 17:15 - 2015-03-13 20:51 - 00015360 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-04-17 17:15 - 2015-03-13 20:37 - 00267264 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-04-17 17:15 - 2015-03-13 20:14 - 00027136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2015-04-17 17:15 - 2015-03-13 19:22 - 03678720 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-04-17 17:15 - 2015-03-13 19:12 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-04-17 17:15 - 2015-03-13 19:12 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-04-17 17:15 - 2015-03-13 19:09 - 00200192 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2015-04-17 17:15 - 2015-03-13 19:08 - 00408064 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2015-04-17 17:15 - 2015-03-13 19:08 - 00095744 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-04-17 17:15 - 2015-03-13 19:06 - 02373632 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-04-17 17:15 - 2015-03-13 19:06 - 00891392 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-04-17 17:15 - 2015-03-13 19:02 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-04-17 17:15 - 2015-03-13 19:02 - 00029696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-04-17 17:15 - 2015-03-13 18:59 - 00721920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-04-17 17:15 - 2015-03-13 18:59 - 00081920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-04-17 17:15 - 2014-12-02 18:09 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-12 18:36 - 2014-04-19 18:59 - 00000920 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-12 18:34 - 2014-04-19 19:33 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-05-12 18:13 - 2014-08-09 17:04 - 00000000 ____D () C:\Program Files (x86)\Constant Guard Protection Suite
2015-05-12 18:00 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\system32\sru
2015-05-12 17:57 - 2014-03-30 17:25 - 01423276 _____ () C:\windows\WindowsUpdate.log
2015-05-12 17:37 - 2014-08-09 17:05 - 00000000 ____D () C:\Users\Jim\AppData\Roaming\ID Vault
2015-05-12 17:36 - 2014-03-30 17:38 - 00000000 ___DO () C:\Users\Jim\SkyDrive
2015-05-12 17:35 - 2014-04-19 18:59 - 00000916 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-12 17:35 - 2013-08-22 09:46 - 00021525 _____ () C:\windows\setupact.log
2015-05-12 17:35 - 2013-08-22 09:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-05-12 17:34 - 2013-08-24 16:32 - 04502036 _____ () C:\windows\PFRO.log
2015-05-12 17:34 - 2013-08-22 08:25 - 00262144 ___SH () C:\windows\system32\config\BBI
2015-05-12 10:48 - 2014-04-05 16:57 - 00000000 ____D () C:\Users\Jim\AppData\Local\CrashDumps
2015-05-11 19:28 - 2013-08-22 10:36 - 00000000 ___HD () C:\windows\ELAMBKUP
2015-05-11 18:31 - 2013-08-22 08:25 - 00262144 ___SH () C:\windows\system32\config\ELAM
2015-05-09 12:03 - 2014-04-05 11:53 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2015-05-07 11:11 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\LiveKernelReports
2015-05-06 17:56 - 2014-03-30 17:33 - 00000000 ____D () C:\Users\Jim
2015-05-06 16:32 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\rescache
2015-05-04 17:31 - 2014-08-09 17:05 - 00000000 ____D () C:\Users\Jim\AppData\Local\ID Vault
2015-05-04 17:12 - 2013-08-22 10:20 - 00000000 ____D () C:\windows\CbsTemp
2015-05-04 16:54 - 2013-08-22 09:44 - 00390888 _____ () C:\windows\system32\FNTCACHE.DAT
2015-05-04 10:52 - 2013-08-24 16:38 - 00338230 _____ () C:\windows\system32\PerfStringBackup.INI
2015-05-03 21:56 - 2014-04-28 17:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-03 19:19 - 2013-08-22 10:36 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
2015-05-03 19:19 - 2013-08-22 08:36 - 00000000 ____D () C:\windows\system32\AdvancedInstallers
2015-05-01 19:08 - 2014-04-04 20:28 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-01 19:05 - 2014-10-28 20:40 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-01 18:53 - 2015-01-21 18:32 - 00097888 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-30 18:05 - 2014-04-04 19:32 - 00000000 ____D () C:\Users\Jim\Documents\Lexar
2015-04-29 21:43 - 2014-04-19 19:01 - 00002210 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-28 16:33 - 2014-04-19 19:33 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-04-28 16:33 - 2014-04-19 19:32 - 00000000 ____D () C:\Users\Jim\AppData\Local\Adobe
2015-04-24 10:41 - 2014-12-10 11:45 - 00002216 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fast Connect.lnk
2015-04-19 16:32 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\AppCompat
2015-04-19 15:57 - 2014-08-09 17:09 - 00003228 _____ () C:\windows\System32\Tasks\Norton WSC Integration
2015-04-19 15:57 - 2014-08-09 17:09 - 00002467 _____ () C:\Users\Public\Desktop\Norton Security Suite.lnk
2015-04-19 15:57 - 2014-08-09 17:09 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Suite
2015-04-19 15:57 - 2014-08-09 17:09 - 00000000 ____D () C:\windows\system32\Drivers\N360x64
2015-04-19 15:46 - 2014-11-26 19:45 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-04-17 17:55 - 2014-03-30 18:59 - 00000000 ____D () C:\windows\system32\MRT
2015-04-17 17:34 - 2014-03-30 18:59 - 128913832 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-04-17 17:33 - 2014-04-04 19:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-13 18:24 - 2015-03-13 22:22 - 00792056 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-04-13 18:24 - 2015-03-13 22:22 - 00178168 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2014-09-21 21:14 - 2014-09-21 21:14 - 0004608 _____ () C:\Users\Jim\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-01 16:17 - 2014-04-01 16:17 - 0007605 _____ () C:\Users\Jim\AppData\Local\Resmon.ResmonCfg

Some content of TEMP:
====================
C:\Users\Jim\AppData\Local\Temp\Extract.exe
C:\Users\Jim\AppData\Local\Temp\ose00000.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-05-12 18:07

==================== End Of Log ============================

ken545

Post #10May 13, 2015, 12:25 AM UTC

Hi,

FF DefaultSearchEngine: Connect Search <– Do you use this ?

Those two items that Malwarebytes found are still there, you need to reread my instructions about setting Malwarebytes to automatically Quarantine detected items is checked, run Malwarebytes again and remove them

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

You did not post the Additions log, it may still be on your desktop

After your sure the entries in Malwarebytes are gone, open up FRST, be sure to checkmark Additions, run a new scan and post both logs please

denisemn

Post #11May 14, 2015, 1:50 AM UTC

Hi Ken,

I'm don't know what 'FF DefaultSearchEngine: Connect Search' is. I tend to use google for my web searches.

I deleted the two items from MWB, ran the scan again & the FRST scans. The new scans are below

=============================================================================

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/13/2015
Scan Time: 8:08:02 PM
Logfile: mwb513.txt
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.05.13.06
Rootkit Database: v2015.04.21.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Jim

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 358227
Time Elapsed: 22 min, 20 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

=================================================================================

LastRegBack: 2015-05-12 18:07

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-05-2015 01
Ran by [removed] at 2015-05-13 20:39:07
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2929747491-3707589749-4234719784-500 - Administrator - Disabled)
Guest (S-1-5-21-2929747491-3707589749-4234719784-501 - Limited - Disabled)
Jim (S-1-5-21-2929747491-3707589749-4234719784-1001 - Administrator - Enabled) => C:\Users\Jim

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Security Suite (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Security Suite (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Security Suite (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Digital Editions 3.0 (HKLM-x32\…\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Alcor Micro USB Card Reader Driver (HKLM-x32\…\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
Amazon Kindle (HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\…\Amazon Kindle) (Version: - Amazon)
AMD Catalyst Install Manager (HKLM\…\{7288D4D9-90E0-2B03-43D0-0BB6D4496577}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\…\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bing Bar (HKLM-x32\…\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3103 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\…\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.3.4323 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3215 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.5.3215 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Fast Connect (HKLM-x32\…\ID Vault) (Version: 1.15.414.3 - White Sky)
Fishdom 3: Collector's Edition (x32 Version: 3.0.2.38 - WildTangent) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\…\HPConnectedMusic) (Version: 1.1 (build 126) hp - Meridian Audio Ltd)
HP Documentation (HKLM-x32\…\{06600E94-1C34-40E2-AB09-D30AECF78172}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7127.4628 - Hewlett-Packard)
HP SimplePass (HKLM-x32\…\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.51 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\…\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
Inst5675 (Version: 8.00.51 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.51 - Softex Inc.) Hidden
iTunes (HKLM\…\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 8 Update 45 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
King Oddball (x32 Version: 3.0.2.48 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mahjongg Dimensions Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Mouse and Keyboard Center (HKLM\…\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 37.0.2 (x86 en-US)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
Norton Security Suite (HKLM-x32\…\N360) (Version: 21.7.0.11 - Symantec Corporation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Driver Installation Program (HKLM-x32\…\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.30175 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7135 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7001 - CyberLink Corp.) Hidden
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points =========================

27-04-2015 16:06:54 Scheduled Checkpoint
30-04-2015 17:41:30 HPSF Applying updates
01-05-2015 21:20:06 HPSF Restore Point
09-05-2015 11:59:09 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00DBE29E-5B14-4B50-8926-5C05D1B796D5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {076340C4-AD63-46E3-8CF9-E39AF1360D70} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {107BD6D1-AA6C-4F4F-9CD6-42A895170E53} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2013-11-04] (Hewlett-Packard Company)
Task: {1C32742F-3381-4203-9120-E76871322F06} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {22D1052A-AE5F-4CC5-8A8E-6B5737233C9E} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {2D96A8E3-B35D-40FD-89E3-87276666D77A} - System32\Tasks\HPCeeScheduleForJim => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {36EA9248-1D0B-48FF-BE0B-E2DAF110A39D} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {3EDFABD2-0A12-48F6-AD49-39ABBCD3606C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-19] (Google Inc.)
Task: {4853E8D1-769C-4EAE-8815-59FADD783C98} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {4B205B60-653F-4E40-98AC-A3660B83E4B0} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\WSCStub.exe [2015-03-07] (Symantec Corporation)
Task: {4E00FF75-92A8-44CD-AC46-35D039887A48} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {601D9685-A4B9-4C67-8971-1CADC60B6258} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-23] (Microsoft Corporation)
Task: {631DEFA6-223B-4EFD-8B5D-9FD232B0CE7D} - System32\Tasks\Norton Security Suite\Norton Error Processor => C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {6B62C899-F4C8-40DA-A2B5-659EE79C77F1} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {71A9CAF7-7963-4915-8E41-157F213DD037} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-04-17] (Microsoft Corporation)
Task: {809C5432-A542-4412-A2AE-59A0F5E274BE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {831632FB-4DEC-4A4E-AD7A-EAED02B5AC62} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {87B6ED10-08F1-4714-88C0-9B19D332C304} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-28] (Adobe Systems Incorporated)
Task: {929F3A4F-07BE-45D6-AD50-1B0C53535A6B} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {9D596D3C-65CA-40F7-8ED8-E6F1AA3FCBCA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {AFF12284-AA86-4129-8B39-F4A91092EF73} - System32\Tasks\Norton Security Suite\Norton Error Analyzer => C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {B3CBBD9C-FDDB-4DF1-912B-F7DC985A2041} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {CC8F743E-0498-4BD1-96EE-DE5BDB0521C3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {DAACBF0E-C97C-4213-A287-7757FD6FA500} - \Optimize Start Menu Cache Files-S-1-5-21-2929747491-3707589749-4234719784-500 No Task File <==== ATTENTION
Task: {ECCBDD2A-B697-4E84-B7B7-B5BDB1B63806} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-19] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForJim.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) ==============

2013-09-05 06:22 - 2013-09-05 06:22 - 00109568 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
2013-09-05 06:24 - 2013-09-05 06:24 - 00627200 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachedrv.dll
2013-09-05 06:24 - 2013-09-05 06:24 - 02540544 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2013-09-05 06:21 - 2013-09-05 06:21 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2013-09-05 06:21 - 2013-09-05 06:21 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2013-09-05 06:21 - 2013-09-05 06:21 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2013-09-05 06:36 - 2013-09-05 06:36 - 00306064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2013-09-05 06:36 - 2013-09-05 06:36 - 01298832 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2013-09-05 06:31 - 2013-09-05 06:31 - 00064000 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2013-06-05 15:51 - 2013-06-05 15:51 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-27 12:50 - 2015-02-27 12:50 - 03530752 _____ () C:\windows\assembly\NativeImages_v4.0.30319_32\Windows.UI.Xaml\0b2afd93fc0545b7b94339e8a4a7af97\Windows.UI.Xaml.ni.dll
2015-02-27 12:50 - 2015-02-27 12:50 - 00228864 _____ () C:\windows\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\16c3eb7650767d95d002c998d0c73eb5\Windows.Foundation.ni.dll
2015-04-14 17:13 - 2015-04-14 17:13 - 00548152 _____ () C:\Program Files (x86)\Constant Guard Protection Suite\sqlite3.DLL
2013-12-10 17:23 - 2013-08-05 02:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 18:48 - 2013-08-05 18:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Jim\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2929747491-3707589749-4234719784-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\HP\HP_Svinoya_Norway_Sunset.jpg
DNS Servers: 75.75.76.76 - 75.75.75.75

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\…\StartupApproved\StartupFolder: => "Constant Guard.lnk"
HKLM\…\StartupApproved\Run32: => "iTunesHelper"

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{0495187A-1A97-4F48-B9BB-71295F838ED0}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{142F0EFE-F134-46F4-B4F1-51A03381809E}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{8C107EC2-A34B-43C8-A695-0B4C53E6DEC9}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe
FirewallRules: [{7A4D53A8-02E0-4F48-BEBB-F3A5CE0F40F8}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe
FirewallRules: [{49345102-4F25-4113-8C45-5C278970877D}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe
FirewallRules: [{E840CC4C-80AD-40BC-AEAC-5A6871696FDC}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe
FirewallRules: [{C9C82C7D-30AE-43A1-9C8A-CD47EFC56A1A}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{E986A8C4-5608-4C1F-9B70-8E0DF4E5E56D}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{AB4B9E2B-FA9B-4CED-97F8-9B91165947E7}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{ED9C10DC-B46D-492E-AFF1-3D74641478D6}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{00FB08CB-7A8F-4BC1-8A24-7A56BA4D27E9}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{D5E892C0-1AD0-4971-97CF-93FCD55E3EDA}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{D5BDC82A-C719-4A29-803F-76CA68F8242B}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{3E2F0CFB-81B7-43E9-9421-2C315CD8F019}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{353788C0-E8A9-4646-9E2B-055C7332ACD6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C9B099B9-8F35-4546-9EEC-BCC911A98D80}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8E45761C-C8A9-43DB-BFC5-460C597FFD4E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D31A0594-DB62-4921-8658-D4D0EAB8E994}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{1E210E58-2554-474C-AC91-E72FD7F0893A}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{BF7009A5-79A0-429B-BEB5-FBAE150B20A6}] => (Allow) C:\Program Files (x86)\xfin_portal\dtuser.exe
FirewallRules: [{C900CE85-B48A-47F9-8943-B0358F92A3D7}] => (Allow) C:\Program Files (x86)\xfin_portal\dtuser.exe
FirewallRules: [{BE151535-29D9-417E-AF5F-D064D0C9FEBC}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{8B362C06-356F-475B-AE7D-B6686E0AACCF}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPPSdr\HPDiagnosticCoreUI.exe
FirewallRules: [{89A91A52-F3AD-4887-BF4A-B48FC5723931}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPPSdr\HPDiagnosticCoreUI.exe
FirewallRules: [{1DFC5900-FF38-458C-AAAC-0A9ADCD7CC06}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{556ABD8E-708F-4E5F-8ECA-E8DAA5638714}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{346F7E13-4840-4885-9A01-B8BCA16D2E8F}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{4097390B-6AD5-4CE2-B8B6-CD9D9AD747EF}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{4EBF33C4-8E47-460F-8BE6-B39712A3A145}] => (Allow) LPort=2869
FirewallRules: [{44A857F9-8D7D-4E4A-B1F9-5265019B9682}] => (Allow) LPort=1900
FirewallRules: [{89B3B2A9-033A-4C30-9012-A5A13C8F6C25}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{24A8B934-B3D0-4917-B139-E098E544B747}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{4A358EAF-3FDC-47A6-A8A9-9FF59EE520C7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5FE87D83-6E7F-4281-802C-C58A64C6D865}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CB1A7A78-E27F-4EC8-9110-427320E04C75}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{7D3873B8-3F7E-49A2-8CD7-6A330C0EF3C0}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [{D2A2DBAD-0B0C-4E2B-9037-C461D2CC3022}] => (Allow) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe
FirewallRules: [{331EC94C-1137-47E8-8078-9CAE7DCE83D5}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (05/13/2015 07:20:38 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (05/13/2015 10:46:00 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20461 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1328

Start Time: 01d08d9323a8e007

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20461_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 1e4e3055-f987-11e4-82aa-a0481c8d40aa

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20461_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (05/12/2015 06:08:51 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (05/12/2015 11:11:36 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20461 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: c90

Start Time: 01d08ccd962fd5c7

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20461_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 8bee9531-f8c1-11e4-82a9-a0481c8d40aa

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20461_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (05/12/2015 10:52:10 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20461 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1738

Start Time: 01d08ccae1be2949

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20461_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: d7d67fd2-f8be-11e4-82a9-a0481c8d40aa

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20461_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (05/12/2015 10:47:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: HPSmplPass.exe, version: 8.0.0.51, time stamp: 0x522840d0
Faulting module name: autheng.dll, version: 0.0.0.0, time stamp: 0x52283faa
Exception code: 0xc0000005
Fault offset: 0x000000000002fef7
Faulting process id: 0x1740
Faulting application start time: 0xHPSmplPass.exe0
Faulting application path: HPSmplPass.exe1
Faulting module path: HPSmplPass.exe2
Report Id: HPSmplPass.exe3
Faulting package full name: HPSmplPass.exe4
Faulting package-relative application ID: HPSmplPass.exe5

Error: (05/11/2015 00:18:07 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (05/10/2015 11:10:09 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (05/09/2015 01:30:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3281

Error: (05/09/2015 01:30:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3281

System errors:
=============
Error: (05/12/2015 09:51:28 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly. It has done this 1 time(s).

Error: (05/12/2015 06:50:33 PM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer KITCHEN-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{219C19BE-8981-41CC-9584-B827DA94A165}.
The master browser is stopping or an election is being forced.

Error: (05/12/2015 05:35:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The McAfee Boot Delay Start Service service failed to start due to the following error:
%%2

Error: (05/12/2015 05:34:00 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WerSvc service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error:
%%50

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (05/12/2015 05:34:00 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WerSvc service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error:
%%50

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (05/11/2015 10:08:21 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly. It has done this 1 time(s).

Error: (05/11/2015 08:10:08 PM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer KITCHEN-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{219C19BE-8981-41CC-9584-B827DA94A165}.
The master browser is stopping or an election is being forced.

Error: (05/11/2015 07:39:40 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The HP Support Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (05/11/2015 07:39:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The CGPS Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (05/11/2015 07:39:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: AMD E1-2500 APU with Radeon(TM) HD Graphics
Percentage of memory in use: 69%
Total physical RAM: 3517.36 MB
Available physical RAM: 1061.04 MB
Total Pagefile: 4461.36 MB
Available Pagefile: 1403.48 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:448.63 GB) (Free:390.28 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:15.65 GB) (Free:1.9 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 35A870C1)

Partition: GPT Partition Type.

==================== End Of Log ============================

ken545

Post #12May 14, 2015, 11:25 AM UTC

It looks like Norton is your main Anti Virus program, have you had McAfee on this before and tried to remove it ?

I am attaching a FIXLIST file, you need to download it to your desktop where you now have FRST64 or the fix wont work, use your mouse to drag FIXLIST right next to FRST64, either above or below it but not right on top of it, after its downloaded open up FRST64 and click on FIX (Not Scan) it wont take long, after your computer reboots you will find a FIXLOG file on your desktop, post it please and let me know how your system is behaving now

Attachments:

📎Fixlist.txt

denisemn

Post #13May 14, 2015, 11:30 PM UTC

Hi Ken,

I don't recall if the PC came with McAfee, but we do use Norton as it is free with comcast. My husband said that he thought the PC was a bit slow. He has been having problems getting on to our banking site on Firefox the last couple of days. He would click to look at something on the site and it just wouldn't do anything. So he would go to Chrome & it would work with noproblem. Not sure if that is FF or something else.

When i was running the scan a pop up for IE to change search engines to Connect Search appeared. I think that is connected with Comcasts Constant Guard. I don't know if that caused a problem for the scan or not. Log is below. Thanks

================================================================================

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-05-2015 02
Ran by [removed] at 2015-05-14 18:02:05 Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> DefaultScope {BC8143CF-927E-436E-AE39-AE87B3925F74} URL = http://search.whites…m={SearchTerms}
SearchScopes: HKU\S-1-5-21-2929747491-3707589749-4234719784-1001 -> {BC8143CF-927E-436E-AE39-AE87B3925F74} URL = http://search.whites…m={SearchTerms}
FF Extension: No Name - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\3hqaqvs2.default\Extensions\temp [2014-08-09]
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:
End

denisemn

Post #14May 14, 2015, 11:48 PM UTC

Oh Sorry ken,

I did some surfing and played a pogo game and the PC seems to be running better. My husband seems to find it sluggish in the morning. maybe a Comcast issue?

ken545

Post #15May 15, 2015, 12:56 AM UTC

Why dont you try shutting off your router and your cable modem for about 5 minutes, do this just by pulling out the power plug in the back of both units, this wont break anything it will just flush all the old data out, after about 5 min, plug the power cable back into your modem and wait until all the lights come on, then do the same for your router, then check your internet and see if things are better

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Slow web loading /Offers4U widget the problem? [Solved]

✨ Ask AI

Ask AI