MS office won't run - tech says system infected [Solved]

wilma1313 Topic Starter

Post #1August 14, 2015, 1:52 AM UTC

thanks for your help - system is running pretty well aside from difficulties with office.

aswMBR version 1.0.1.2041 Copyright© 2014 AVAST Software
Run date: 2015-08-13 20:19:53
—————————–
20:19:53.388    OS Version: Windows x64 6.2.9200
20:19:53.388    Number of processors: 4 586 0x3C03
20:19:53.388    ComputerName: PURPLE UserName: l
20:19:54.670    Initialize success
20:19:54.670    VM: initialized successfully
20:19:54.670    VM: Intel CPU BiosDisabled
20:19:57.667    VM: disk I/O iaStorA.sys
20:20:01.214    AVAST engine defs: 15081302
20:20:02.667    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000039
20:20:02.667    Disk 0 Vendor: ST2000DM001-1CH164 HP33 Size: 1907729MB BusType: 11
20:20:02.792    Disk 0 MBR read successfully
20:20:02.792    Disk 0 MBR scan
20:20:02.792    Disk 0 unknown MBR code
20:20:02.792    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
20:20:02.808    Disk 0 scanning C:\windows\system32\drivers
20:20:12.074    Service scanning
20:20:27.796    Modules scanning
20:20:27.796    Disk 0 trace - called modules:
20:20:27.827    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll iaStorA.sys
20:20:27.827    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800bd33060]
20:20:27.842    3 CLASSPNP.SYS[fffff88001201e0a] -> nt!IofCallDriver -> [0xfffffa800977b9f0]
20:20:27.842    5 ACPI.sys[fffff88001194a91] -> nt!IofCallDriver -> [0xfffffa80096fee40]
20:20:27.842    7 ACPI.sys[fffff88001194a91] -> nt!IofCallDriver -> \Device\00000039[0xfffffa800ac31720]
20:20:28.796    AVAST engine scan C:\windows
20:20:31.546    AVAST engine scan C:\windows\system32
20:22:34.997    AVAST engine scan C:\windows\system32\drivers
20:22:48.545    AVAST engine scan C:\Users\l
20:38:56.466    AVAST engine scan C:\ProgramData
20:40:45.166    Scan finished successfully
20:46:19.308    Disk 0 MBR has been saved successfully to "C:\Users\l\Desktop\MBR.dat"
20:46:19.308    The log file has been saved successfully to "C:\Users\l\Desktop\aswMBR1.txt"

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-08-2015
Ran by [removed] (administrator) on PURPLE (13-08-2015 20:48:26)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 8 (X64) Language: English (United States)
Internet Explorer Version 10 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\afwServ.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\windows\System32\hkcmd.exe
(Intel Corporation) C:\windows\System32\igfxpers.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2012-08-22] (Hewlett-Packard )
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-11-12] (IDT, Inc.)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-06-29] (Apple Inc.)
HKLM-x32\…\Run: [BtTray] => c:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [379904 2013-01-10] (IVT Corporation)
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-06-27] (Avast Software s.r.o.)
HKLM-x32\…\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [4369952 2014-11-07] (Fitbit, Inc.)
HKLM-x32\…\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [39179912 2015-07-23] (Dropbox, Inc.)
HKLM-x32\…\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2497467096-1107912187-4260812050-1001\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7930136 2015-08-04] (SUPERAntiSpyware)
HKU\S-1-5-21-2497467096-1107912187-4260812050-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-2497467096-1107912187-4260812050-1001\…\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-2497467096-1107912187-4260812050-1001\…\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-2497467096-1107912187-4260812050-1001\…\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [4369952 2014-11-07] (Fitbit, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\l\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\l\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-07-23] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-07-23] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\l\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-07-23] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\l\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-07-23] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\l\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\l\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\l\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-06-27] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com?fr=hp-avast&type=avastbcl
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2497467096-1107912187-4260812050-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/
HKU\S-1-5-21-2497467096-1107912187-4260812050-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxps://search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-2497467096-1107912187-4260812050-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-2497467096-1107912187-4260812050-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-08-13] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-06-27] (Avast Software s.r.o.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-19] (Google Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL No File
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-06-27] (Avast Software s.r.o.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-19] (Google Inc.)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-19] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-19] (Google Inc.)
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://akamaicdn.webex.com/client/WBXclient-T28L10NSP12_CP1-16851/webex/ieatgpc1.cab
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-08-13] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-08-13] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\windows\SysWow64\skype4com.dll [2013-01-10] (Skype Technologies)
Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\windows\system32\urlmon.dll [2015-07-16] (Microsoft Corporation)
Filter-x32: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\windows\SysWow64\urlmon.dll [2015-07-16] (Microsoft Corporation)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - No File
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - No File
Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} - No File
Tcpip\..\Interfaces\{2017395D-4220-493D-A26C-DE4FDCACDBD8}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{63F6AE22-B6DD-4476-A864-3652DE675725}: [NameServer] 208.67.220.220,208.67.222.222
Tcpip\..\Interfaces\{63F6AE22-B6DD-4476-A864-3652DE675725}: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{D9443B57-4010-4CB8-8171-44BCB8CF3513}: [NameServer] 208.67.220.220,208.67.222.222
Tcpip\..\Interfaces\{D9443B57-4010-4CB8-8171-44BCB8CF3513}: [DhcpNameServer] [removed] [removed]

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-08-13] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1218158.dll [2015-04-27] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-01-23] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-01-23] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-08-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-04]

Chrome:
=======
CHR Profile: C:\Users\l\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-04]
CHR Extension: (Google Drive) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-04]
CHR Extension: (YouTube) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-04]
CHR Extension: (Google Search) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-04]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-19]
CHR Extension: (Chrome Web Store Payments) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-04]
CHR Extension: (Gmail) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-04]
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-21]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-26] (SUPERAntiSpyware.com)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-06-27] (Avast Software s.r.o.)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [107448 2015-06-27] (Avast Software s.r.o.)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1619704 2013-03-26] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [138752 2013-01-10] (IVT Corporation) [File not signed]
U4 BthAvrcpTg; C:\Windows\System32\drivers\BthAvrcpTg.sys [37632 2013-05-31] (Microsoft Corporation)
U4 BthHFEnum; C:\Windows\System32\drivers\bthhfenum.sys [51200 2012-07-25] (Microsoft Corporation)
U4 bthhfhid; C:\Windows\System32\drivers\BthHFHid.sys [29952 2013-07-17] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2765496 2015-07-14] (Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-05-30] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-05-30] (Dropbox, Inc.)
R2 Fitbit Connect; C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [5738528 2014-11-07] (Fitbit, Inc.)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129336 2013-01-30] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2013-01-30] (Intel Corporation)
S4 LMIRescue_27c734fa-3d10-4ac4-9306-514fdc07e5eb; C:\Users\l\AppData\Local\LogMeIn Rescue Applet\LMIR0002.tmp\LMI_Rescue_srv.exe [3306336 2015-08-13] (LogMeIn, Inc.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2012-11-12] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2015-07-06] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-10-11] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-06-27] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28144 2015-06-27] (Avast Software s.r.o.)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-06-27] (Avast Software s.r.o.)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [449896 2015-06-27] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-06-27] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-06-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-06-27] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-27] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-06-27] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-06-27] ()
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [56904 2012-07-19] (Ralink Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)
R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [49584 2013-03-25] (Ralink Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [1204424 2013-12-02] (Ralink Technology, Corp.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-08-16] (Apple, Inc.) [File not signed]
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EraserUtilDrv11312; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11312.sys [X]
S3 MBAMSwissArmy; \??\C:\windows\system32\drivers\MBAMSwissArmy.sys [X]
U3 aswMBR; \??\C:\Users\l\AppData\Local\Temp\aswMBR.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-13 20:48 - 2015-08-13 20:48 - 00024522 _____ C:\Users\l\Desktop\FRST.txt
2015-08-13 20:47 - 2015-08-13 20:47 - 00000000 ____D C:\Users\l\Desktop\FRST-OlderVersion
2015-08-13 20:46 - 2015-08-13 20:46 - 00001988 _____ C:\Users\l\Desktop\aswMBR1.txt
2015-08-13 20:46 - 2015-08-13 20:46 - 00000512 _____ C:\Users\l\Desktop\MBR.dat
2015-08-13 19:57 - 2015-08-13 19:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2015-08-13 19:56 - 2015-08-13 19:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-08-13 19:14 - 2015-08-13 19:54 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-08-13 19:14 - 2015-08-13 19:14 - 01102520 _____ (Microsoft Corporation) C:\Users\l\Downloads\setupo365homepremretail.x86.en-us_.exe
2015-08-13 19:12 - 2015-08-13 19:12 - 00002185 _____ C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Support (3).lnk
2015-08-13 19:02 - 2015-08-13 19:02 - 315999716 _____ C:\Users\l\Desktop\reg.reg
2015-08-13 18:48 - 2015-08-13 18:48 - 00002211 _____ C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Support (2).lnk
2015-08-12 06:50 - 2015-07-01 08:00 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2015-08-12 06:50 - 2015-07-01 07:58 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll
2015-08-12 06:50 - 2015-07-01 06:42 - 00198656 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll
2015-08-12 06:50 - 2015-07-01 06:41 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll
2015-08-12 06:47 - 2015-07-13 16:05 - 00054272 _____ (Microsoft Corporation) C:\windows\system32\basesrv.dll
2015-08-12 06:47 - 2015-07-13 16:05 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-08-12 06:47 - 2015-07-06 11:16 - 00044560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdBoot.sys
2015-08-12 06:47 - 2015-07-06 09:32 - 00281944 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdFilter.sys
2015-08-12 06:46 - 2015-07-30 08:11 - 00124624 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 06:46 - 2015-07-30 08:10 - 00103120 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 06:46 - 2015-07-28 11:25 - 00025776 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2015-08-12 06:46 - 2015-07-28 09:13 - 01116160 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-08-12 06:46 - 2015-07-28 09:13 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-08-12 06:46 - 2015-07-28 09:13 - 00743424 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-08-12 06:46 - 2015-07-28 09:13 - 00437248 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-08-12 06:46 - 2015-07-28 09:13 - 00069120 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-08-12 06:46 - 2015-07-28 08:12 - 01148416 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-08-12 06:46 - 2015-07-09 16:46 - 05982208 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2015-08-12 06:46 - 2015-07-09 16:44 - 00322560 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll
2015-08-12 06:46 - 2015-07-09 15:17 - 05095424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2015-08-12 06:46 - 2015-07-09 15:16 - 00269824 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2015-08-12 06:46 - 2015-05-11 17:49 - 00527704 _____ (Microsoft Corporation) C:\windows\system32\mcupdate_GenuineIntel.dll
2015-08-12 06:45 - 2015-07-16 15:32 - 02239488 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-08-12 06:45 - 2015-07-16 15:32 - 01409024 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-08-12 06:45 - 2015-07-16 15:32 - 00601600 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-08-12 06:45 - 2015-07-16 15:31 - 19291648 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-08-12 06:45 - 2015-07-16 15:31 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-08-12 06:45 - 2015-07-16 15:31 - 00856064 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-08-12 06:45 - 2015-07-16 15:31 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-08-12 06:45 - 2015-07-16 15:30 - 15416320 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-08-12 06:45 - 2015-07-16 15:30 - 02657280 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-08-12 06:45 - 2015-07-16 15:30 - 00949760 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-08-12 06:45 - 2015-07-16 14:07 - 01763328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-08-12 06:45 - 2015-07-16 14:07 - 01181696 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-08-12 06:45 - 2015-07-16 14:07 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 14383616 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 13774848 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 02865664 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 02056704 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 00737280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 00690176 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-08-12 06:45 - 2015-07-16 14:06 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-08-12 06:42 - 2015-07-29 09:45 - 01412608 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2015-08-12 06:42 - 2015-07-29 09:45 - 00035328 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2015-08-12 06:42 - 2015-07-29 08:52 - 01840640 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2015-08-12 06:42 - 2015-07-29 08:52 - 01280000 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll
2015-08-12 06:42 - 2015-07-29 08:52 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-08-12 06:42 - 2015-07-27 17:42 - 00304128 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2015-08-12 06:42 - 2015-07-27 17:40 - 04064768 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-08-12 06:42 - 2015-07-27 17:40 - 00366592 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-08-12 06:42 - 2015-07-15 11:09 - 06969688 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-08-12 06:42 - 2015-07-15 11:09 - 00095064 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2015-08-12 06:42 - 2015-07-15 11:06 - 01824296 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-08-12 06:42 - 2015-07-15 08:49 - 01410000 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-08-12 06:42 - 2015-07-15 08:29 - 01333248 _____ (Microsoft Corporation) C:\windows\system32\sysmain.dll
2015-08-12 06:42 - 2015-07-13 16:23 - 01744384 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll
2015-08-12 06:42 - 2015-07-13 16:23 - 01422336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2015-08-12 06:42 - 2015-07-13 16:05 - 02340864 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2015-08-12 06:42 - 2015-07-13 16:05 - 01850880 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2015-08-12 06:42 - 2015-07-09 16:47 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\notepad.exe
2015-08-12 06:42 - 2015-07-09 16:47 - 00243712 _____ (Microsoft Corporation) C:\windows\notepad.exe
2015-08-12 06:42 - 2015-07-09 15:18 - 00233984 _____ (Microsoft Corporation) C:\windows\SysWOW64\notepad.exe
2015-08-12 06:42 - 2015-06-09 08:09 - 00411133 _____ C:\windows\system32\ApnDatabase.xml
2015-08-09 21:15 - 2015-08-09 21:15 - 00000000 __RHD C:\MSOCache
2015-08-08 06:48 - 2015-08-08 06:48 - 00000249 _____ C:\Users\l\Desktop\Beyond Off Grid Summit Live Hands-on Training Event in VA - Beyond Off Grid Summit.url
2015-08-06 22:18 - 2015-08-06 22:18 - 00000294 _____ C:\Users\l\Desktop\case number ms.txt
2015-08-06 21:55 - 2015-08-06 21:55 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2015-08-06 20:56 - 2015-08-06 20:56 - 01097400 _____ (Microsoft Corporation) C:\Users\Administrator\Downloads\Setup.X86.en-US_O365HomePremRetail_e2e0bfa1-7fb0-4670-99d3-0eda20fd701f_TX_PR_.exe
2015-08-06 20:55 - 2015-08-06 20:55 - 01516728 _____ (Microsoft Corporation) C:\Users\Administrator\Downloads\Setup.X64.en-US_O365HomePremRetail_e2e0bfa1-7fb0-4670-99d3-0eda20fd701f_TX_PR_.exe
2015-08-06 20:55 - 2015-08-06 20:55 - 00997927 _____ C:\Users\Administrator\Downloads\O15CTRRemove.diagcab
2015-08-06 20:36 - 2015-08-06 21:56 - 00002287 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-08-06 20:36 - 2015-08-06 21:56 - 00000000 ___RD C:\Users\Administrator\OneDrive
2015-08-06 20:36 - 2015-08-06 20:36 - 00002168 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-08-06 20:36 - 2015-08-06 20:36 - 00002168 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-08-06 20:36 - 2015-08-06 20:36 - 00000000 ____D C:\Program Files (x86)\Microsoft OneDrive
2015-08-06 20:15 - 2015-08-06 20:15 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Hewlett-Packard
2015-08-06 20:14 - 2015-08-06 20:14 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Macromedia
2015-08-06 20:14 - 2015-08-06 20:14 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Google
2015-08-06 20:12 - 2015-08-10 06:34 - 00003950 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{7F234C96-212B-4B0D-828A-E7166B12B643}
2015-08-06 20:12 - 2015-08-06 20:14 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2015-08-06 20:12 - 2015-08-06 20:12 - 00001397 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-06 20:12 - 2015-08-06 20:12 - 00000103 _____ C:\windows\SysWOW64\debug.log
2015-08-06 20:12 - 2015-08-06 20:12 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\AVAST Software
2015-08-06 20:12 - 2015-08-06 20:12 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Apple Computer
2015-08-06 20:12 - 2015-08-06 20:12 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe
2015-08-06 20:12 - 2015-08-06 20:12 - 00000000 ____D C:\Users\Administrator\AppData\Local\Dropbox
2015-08-06 20:11 - 2015-08-06 20:12 - 00000000 ____D C:\Users\Administrator\AppData\Local\Packages
2015-08-06 20:11 - 2015-08-06 20:11 - 00000020 ___SH C:\Users\Administrator\ntuser.ini
2015-08-06 20:11 - 2015-03-14 06:59 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-06 20:11 - 2014-09-10 17:24 - 00000000 ___HD C:\Users\Administrator\Documents\hp.system.package.metadata
2015-08-06 20:11 - 2014-07-12 11:27 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-08-06 20:11 - 2012-07-26 03:13 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-06 20:11 - 2012-07-26 03:13 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-08-06 20:10 - 2015-08-06 20:36 - 00000000 ____D C:\Users\Administrator
2015-08-04 16:05 - 2015-08-04 16:05 - 01097400 _____ (Microsoft Corporation) C:\Users\l\Desktop\Setup.X86.en-US_O365HomePremRetail_72b6c642-4172-47b7-9e7f-335abdbb1bdf_TX_PR_.exe
2015-08-04 15:51 - 2015-08-04 15:51 - 285071608 _____ C:\Users\l\Desktop\BACKUP1.reg
2015-08-04 15:50 - 2015-08-04 15:51 - 285073308 _____ C:\Users\l\Documents\BACKUP.reg
2015-08-04 15:48 - 2015-08-04 15:48 - 00115440 _____ C:\Users\l\Desktop\office.vbs
2015-08-04 15:29 - 2015-08-04 15:29 - 00000000 ____D C:\Users\l\Documents\OneNote Notebooks
2015-08-04 15:26 - 2015-08-13 18:48 - 00000000 ____D C:\Users\l\AppData\Local\LogMeIn Rescue Applet
2015-08-04 15:26 - 2015-08-04 15:26 - 00002211 _____ C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Support.lnk
2015-07-31 19:55 - 2015-07-31 19:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-14 20:13 - 2015-06-27 11:36 - 00171352 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-07-14 20:13 - 2015-06-27 08:56 - 00452608 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll
2015-07-14 20:13 - 2015-06-27 08:55 - 00668160 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-07-14 20:13 - 2015-06-27 08:55 - 00273920 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-07-14 20:13 - 2015-06-27 08:46 - 01314816 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-07-14 20:13 - 2015-06-27 08:46 - 00829952 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-07-14 20:13 - 2015-06-27 08:46 - 00588800 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll
2015-07-14 20:13 - 2015-06-27 08:46 - 00318464 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-07-14 20:13 - 2015-06-27 08:23 - 00694784 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2015-07-14 20:13 - 2015-06-25 13:29 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2015-07-14 20:13 - 2015-06-25 13:27 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2015-07-14 20:13 - 2015-06-15 10:22 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-07-14 20:13 - 2015-06-15 10:22 - 00080384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-07-14 20:13 - 2015-06-15 10:20 - 00255488 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-07-14 20:13 - 2015-06-15 10:20 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-07-14 20:13 - 2015-06-15 10:19 - 01509376 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-07-14 20:13 - 2015-06-15 10:19 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-07-14 20:13 - 2015-04-30 08:44 - 00478296 _____ C:\windows\SysWOW64\locale.nls
2015-07-14 20:13 - 2015-04-30 08:44 - 00478296 _____ C:\windows\system32\locale.nls
2015-07-14 20:13 - 2015-01-06 23:25 - 00403456 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2015-07-14 20:12 - 2015-06-29 08:27 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-07-14 20:12 - 2015-06-17 09:13 - 01150264 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll
2015-07-14 20:12 - 2015-06-17 08:44 - 01567560 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll
2015-07-14 20:12 - 2015-06-15 10:22 - 08858112 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
2015-07-14 20:12 - 2015-06-15 10:22 - 02416640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2015-07-14 20:12 - 2015-06-15 10:22 - 02037760 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2015-07-14 20:12 - 2015-06-15 10:22 - 00062976 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe
2015-07-14 20:12 - 2015-06-15 10:21 - 00124416 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe
2015-07-14 20:12 - 2015-06-15 10:20 - 10116608 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
2015-07-14 20:12 - 2015-06-15 10:20 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2015-07-14 20:12 - 2015-06-15 10:19 - 02307072 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2015-07-14 20:12 - 2015-06-11 15:29 - 01302528 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2015-07-14 20:12 - 2015-06-11 11:27 - 01024000 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2015-07-14 20:12 - 2015-06-09 08:57 - 03248640 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2015-07-14 20:12 - 2015-04-21 08:53 - 01174528 _____ (Microsoft Corporation) C:\windows\system32\sppobjs.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-13 20:48 - 2014-06-30 08:22 - 00000000 ____D C:\FRST
2015-08-13 20:48 - 2014-04-27 09:23 - 00000920 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-13 20:47 - 2014-06-30 08:21 - 02173952 _____ (Farbar) C:\Users\l\Desktop\FRST64.exe
2015-08-13 20:45 - 2014-04-19 10:14 - 01299615 _____ C:\windows\WindowsUpdate.log
2015-08-13 20:39 - 2014-07-28 09:16 - 00003136 _____ C:\windows\System32\Tasks\HPCeeScheduleForl
2015-08-13 20:39 - 2014-07-28 09:16 - 00000330 _____ C:\windows\Tasks\HPCeeScheduleForl.job
2015-08-13 20:39 - 2014-04-19 10:13 - 00000000 ____D C:\Users\l
2015-08-13 20:31 - 2014-04-19 10:23 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2497467096-1107912187-4260812050-1001
2015-08-13 20:10 - 2015-05-30 17:48 - 00000000 ___RD C:\Users\l\Dropbox
2015-08-13 20:10 - 2015-05-30 17:44 - 00000000 ____D C:\Users\l\AppData\Local\Dropbox
2015-08-13 20:10 - 2012-07-26 02:28 - 00876558 _____ C:\windows\system32\PerfStringBackup.INI
2015-08-13 20:09 - 2015-05-30 17:48 - 00001197 _____ C:\Users\l\Desktop\Dropbox.lnk
2015-08-13 20:09 - 2015-05-30 17:44 - 00000908 _____ C:\windows\Tasks\DropboxUpdateTaskMachineCore.job
2015-08-13 20:09 - 2014-12-02 20:32 - 00000000 ___RD C:\Users\l\iCloudDrive
2015-08-13 20:09 - 2014-04-27 09:23 - 00000916 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-13 20:09 - 2013-03-22 12:00 - 00000983 _____ C:\windows\SysWOW64\bscs.ini
2015-08-13 20:08 - 2013-07-17 12:49 - 00000272 _____ C:\windows\SysWOW64\LOCALSERVICE.INI
2015-08-13 20:06 - 2013-07-17 12:49 - 00000088 _____ C:\windows\SysWOW64\LOCALDEVICE.INI
2015-08-13 20:06 - 2012-07-26 02:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-08-13 20:05 - 2012-08-10 18:49 - 00840556 _____ C:\windows\PFRO.log
2015-08-13 20:02 - 2012-07-26 03:12 - 00000000 ____D C:\windows\system32\sru
2015-08-13 19:54 - 2015-05-30 17:44 - 00000912 _____ C:\windows\Tasks\DropboxUpdateTaskMachineUA.job
2015-08-13 19:11 - 2012-07-26 03:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-08-13 19:11 - 2012-07-26 00:26 - 00262144 ___SH C:\windows\system32\config\BBI
2015-08-13 12:14 - 2012-07-26 03:12 - 00000000 ____D C:\windows\rescache
2015-08-13 10:00 - 2015-03-16 19:59 - 00437360 _____ C:\windows\system32\FNTCACHE.DAT
2015-08-13 09:59 - 2014-07-06 15:19 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-13 09:59 - 2014-07-06 15:19 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-13 09:58 - 2014-12-11 07:55 - 00000000 ____D C:\windows\system32\appraiser
2015-08-13 09:58 - 2014-07-12 11:26 - 00000000 ___SD C:\windows\system32\CompatTel
2015-08-13 09:58 - 2012-07-26 03:12 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-13 09:58 - 2012-07-26 03:12 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-13 09:58 - 2012-07-26 03:12 - 00000000 ____D C:\Program Files\Windows Defender
2015-08-13 09:58 - 2012-07-26 03:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2015-08-13 09:20 - 2014-05-22 08:01 - 00000000 ____D C:\Users\l\AppData\Local\CrashDumps
2015-08-13 03:01 - 2012-07-26 02:59 - 00000000 ____D C:\windows\CbsTemp
2015-08-12 18:48 - 2014-04-30 16:40 - 00002150 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-12 06:52 - 2014-07-06 15:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-12 06:52 - 2014-04-20 18:10 - 00000000 ____D C:\windows\system32\MRT
2015-08-12 06:49 - 2014-04-20 18:10 - 132483416 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-08-12 06:47 - 2012-07-26 03:12 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-12 06:47 - 2012-07-26 03:12 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-12 06:31 - 2012-07-26 03:12 - 00000000 ____D C:\windows\AUInstallAgent
2015-08-10 07:28 - 2014-04-19 10:14 - 00000000 ____D C:\Users\l\AppData\Local\Packages
2015-08-09 21:21 - 2014-12-14 18:24 - 00027648 _____ C:\Users\l\Desktop\mileage.xls
2015-08-09 14:39 - 2014-04-30 16:26 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2015-08-07 21:27 - 2014-10-16 12:19 - 00793544 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-08-07 21:27 - 2014-10-16 12:19 - 00177632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-06 20:12 - 2014-04-19 10:16 - 00000000 ____D C:\windows\System32\Tasks\WPD
2015-08-06 20:04 - 2014-04-19 10:14 - 00000000 ____D C:\Users\l\AppData\Local\VirtualStore
2015-08-04 16:02 - 2014-07-03 15:37 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2015-08-04 15:33 - 2014-04-27 09:41 - 00614400 ___SH C:\Users\l\Desktop\Thumbs.db
2015-08-04 15:08 - 2014-12-02 20:32 - 00000000 ____D C:\Users\l\Documents\Outlook Files
2015-08-04 15:08 - 2014-12-02 20:32 - 00000000 ____D C:\Users\l\AppData\Local\6890C281-DA80-4394-B151-8612AAAF8F73.aplzod
2015-07-31 19:55 - 2015-05-30 17:44 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-07-26 15:53 - 2013-07-17 12:32 - 00000000 ____D C:\Program Files (x86)\CyberLink
2015-07-26 15:48 - 2013-07-17 12:32 - 00000000 ____D C:\ProgramData\install_clap
2015-07-26 15:48 - 2012-10-11 22:24 - 00000000 ____D C:\SWSETUP
2015-07-26 15:35 - 2013-07-17 12:26 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-07-20 16:57 - 2014-12-07 18:12 - 00000000 ____D C:\Users\l\Desktop\stuff
2015-07-19 17:49 - 2015-05-30 17:44 - 00003884 _____ C:\windows\System32\Tasks\DropboxUpdateTaskMachineUA
2015-07-19 17:49 - 2015-05-30 17:44 - 00003648 _____ C:\windows\System32\Tasks\DropboxUpdateTaskMachineCore
2015-07-19 12:57 - 2012-07-26 03:12 - 00000000 ___RD C:\windows\ToastData
2015-07-15 21:43 - 2014-04-27 09:23 - 00003892 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-15 21:43 - 2014-04-27 09:23 - 00003656 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-15 06:18 - 2014-12-25 12:37 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-15 06:18 - 2014-06-10 08:46 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

==================== Files in the root of some directories =======

2014-06-10 08:36 - 2014-06-10 08:36 - 0000046 _____ () C:\Users\l\AppData\Roaming\WB.CFG

Some files in TEMP:
====================
C:\Users\Administrator\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpm2lvo9.dll
C:\Users\l\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzmwtrt.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-08-07 05:41

==================== End of log ============================