ericjschroeder
Topic Starter
Don't know if the laptop is infected but I've tried every MS suggestion on the web. The Windows Update just runs with no status or errors. When I ran the WU fix I got the Windows Update error 0x80070057, "not fixed" but no idea how to fix it. Tried running in clean boot, tried creating a new user account, nothing. Here are my scan results. Oh, yes, and the link for FRST doesn't work; had to search for it.
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-08-23 20:34:42
—————————–
20:34:42.371 OS Version: Windows 6.1.7601 Service Pack 1
20:34:42.371 Number of processors: 2 586 0xF06
20:34:42.371 ComputerName: MUSIC UserName:
20:34:56.255 Initialize success
20:34:56.270 VM: initialized successfully
20:34:56.270 VM: Intel CPU BiosDisabled
20:35:00.807 AVAST engine defs: 15082301
20:35:37.567 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
20:35:37.567 Disk 0 Vendor: Samsung_SSD_840_EVO_120GB EXT0AB0Q Size: 114473MB BusType: 3
20:35:37.583 Disk 0 MBR read successfully
20:35:37.598 Disk 0 MBR scan
20:35:37.614 Disk 0 unknown MBR code
20:35:37.614 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 114469 MB offset 2048
20:35:37.630 Disk 0 default boot code
20:35:37.645 Disk 0 scanning sectors +234436545
20:35:37.676 Disk 0 scanning C:\Windows\system32\drivers
20:35:47.208 Service scanning
20:36:05.460 Modules scanning
20:36:05.491 Disk 0 trace - called modules:
20:36:32.245
20:36:33.056 AVAST engine scan C:\Windows
20:36:34.148 AVAST engine scan C:\Windows\system32
20:38:58.247 AVAST engine scan C:\Windows\system32\drivers
20:39:10.743 AVAST engine scan C:\Users\ericjs
20:40:36.558 AVAST engine scan C:\ProgramData
20:41:06.464 Disk 0 statistics 2736212/0/0 @ 15.36 MB/s
20:41:06.479 Scan finished successfully
20:42:59.837 Disk 0 MBR has been saved successfully to "C:\Users\ericjs\Desktop\MBR.dat"
20:42:59.853 The log file has been saved successfully to "C:\Users\ericjs\Desktop\aswMBR.txt"
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:23-08-2015
Ran by [removed] (administrator) on MUSIC (23-08-2015 20:46:06)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-07-29] (AVAST Software)
HKU\S-1-5-21-1209631511-980094977-1553352967-1000\…\Run: [dualmonitor] => [X]
HKU\S-1-5-18\…\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-07] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-07-29] (AVAST Software)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll [2015-08-21] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-29] (AVAST Software)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-21] (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{AB326F05-DA50-4685-8AF3-8558B895237A}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{D7B0C844-D8D6-40EE-8619-390833DB094B}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DD12E9B6-695D-4D8B-A7EE-F0CC5C678536}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{FA7E7FB9-83D3-429D-96BF-A7D2F00E97EB}: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\ericjs\AppData\Roaming\Mozilla\Firefox\Profiles\4pehnzlr.default
FF Homepage: hxxp://www.google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-15] ()
FF Plugin: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-21] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-29] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-29] (Google Inc.)
FF Plugin: @wacom.com/wacom-plugin,version=1.1.0.10 -> C:\Program Files\TabletPlugins\npwacom.dll [2011-04-20] (Wacom, Inc.)
FF Plugin: @wacom.com/wtPlugin,version=2.0.0.1 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-24] (Wacom)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-24] (Wacom)
FF Plugin HKU\S-1-5-21-1209631511-980094977-1553352967-1000: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-24] (Wacom)
FF Extension: Hotspot Shield Extension - C:\Program Files\Mozilla Firefox\browser\extensions\[removed] [2014-11-02]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-05-04]
Chrome:
=======
CHR Profile: C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-19]
CHR Extension: (Google Drive) - C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-19]
CHR Extension: (YouTube) - C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-19]
CHR Extension: (Google Search) - C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-19]
CHR Extension: (Avast Online Security) - C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-02-19]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-05]
CHR Extension: (Chrome Web Store Payments) - C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-19]
CHR Extension: (Gmail) - C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-19]
CHR HKLM\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-29]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-07-29] (AVAST Software)
S4 HssTrayService; C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE [78512 2014-05-16] ()
S4 HssWd; C:\Program Files\Hotspot Shield\bin\hsswd.exe [430344 2014-05-16] ()
S4 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S4 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [214896 2012-02-06] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)
S4 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [510744 2013-06-05] (Wacom Technology, Corp.)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24016 2015-07-29] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [76000 2015-07-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-07-29] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49776 2015-07-29] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [788784 2015-07-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [433264 2015-07-29] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [113592 2015-07-29] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [208664 2015-07-29] (AVAST Software)
R3 easytether; C:\Windows\System32\DRIVERS\easytthr.sys [18632 2015-05-04] (Mobile Stream)
R3 HdAudAddService; C:\Windows\System32\drivers\CHDAud.sys [566272 2006-03-23] (Conexant Systems Inc.)
S3 hidkmdf; C:\Windows\System32\DRIVERS\hidkmdf.sys [12088 2013-04-30] (Windows (R) Win 7 DDK provider)
R3 HSFHWAZL; C:\Windows\System32\DRIVERS\HSFHWAZL.sys [202240 2005-11-08] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\Windows\System32\DRIVERS\HSF_DPV.sys [997376 2005-11-08] (Conexant Systems, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [39624 2014-05-16] (AnchorFree Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)
S3 motandroidusb; C:\Windows\System32\Drivers\motoandroid.sys [25856 2009-07-10] (Motorola)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13440 2011-11-25] (June Fabrics Technology Inc.)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [37064 2014-05-16] (Anchorfree Inc.)
S3 tapwp01; C:\Windows\System32\DRIVERS\tapwp01.sys [35288 2015-04-30] (The OpenVPN Project)
S3 WacHidRouter; C:\Windows\System32\DRIVERS\wachidrouter.sys [74552 2013-04-30] (Wacom Technology)
R3 wacomrouterfilter; C:\Windows\System32\DRIVERS\wacomrouterfilter.sys [13296 2012-12-20] (Wacom Technology)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-13] (Microsoft Corporation)
U3 aswMBR; \??\C:\Users\ericjs\AppData\Local\Temp\aswMBR.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-08-23 20:46 - 2015-08-23 20:46 - 00010563 _____ C:\Users\ericjs\Downloads\FRST.txt
2015-08-23 20:45 - 2015-08-23 20:46 - 00000000 ____D C:\FRST
2015-08-23 20:44 - 2015-08-23 20:45 - 01677824 _____ (Farbar) C:\Users\ericjs\Downloads\FRST.exe
2015-08-23 20:42 - 2015-08-23 20:42 - 00001698 _____ C:\Users\ericjs\Desktop\aswMBR.txt
2015-08-23 20:42 - 2015-08-23 20:42 - 00000512 _____ C:\Users\ericjs\Desktop\MBR.dat
2015-08-23 20:33 - 2015-08-23 20:34 - 05198336 _____ (AVAST Software) C:\Users\ericjs\Downloads\aswMBR.exe
2015-08-23 19:53 - 2015-08-23 19:53 - 00000000 ____D C:\a507579895f19f67e2ea7a6a811c
2015-08-23 19:47 - 2015-08-23 19:50 - 239126136 _____ C:\Users\ericjs\Downloads\Windows6.1-KB947821-v34-x86.msu
2015-08-23 18:56 - 2015-08-23 18:56 - 00000000 ____D C:\Windows\pss
2015-08-22 21:33 - 2015-08-22 21:33 - 00302011 _____ C:\Users\ericjs\Downloads\WindowsUpdateDiagnostic (1).diagcab
2015-08-22 21:32 - 2015-08-22 21:32 - 00347816 _____ (Microsoft Corporation) C:\Users\ericjs\Downloads\MicrosoftFixit.wu.MATSKB.Run.exe
2015-08-22 20:03 - 2015-08-22 20:06 - 00000000 ____D C:\AdwCleaner
2015-08-22 20:02 - 2015-08-22 20:02 - 01605632 _____ C:\Users\ericjs\Downloads\AdwCleaner.exe
2015-08-22 19:28 - 2015-08-22 19:29 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-22 19:26 - 2015-08-22 19:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-08-22 19:26 - 2015-08-22 19:26 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-08-22 19:26 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-08-22 19:26 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-08-22 18:11 - 2015-08-22 18:11 - 00302011 _____ C:\Users\ericjs\Downloads\WindowsUpdateDiagnostic.diagcab
2015-08-21 21:43 - 2015-08-21 21:43 - 00000000 ____D C:\Program Files\Common Files\Java
2015-08-21 19:18 - 2015-08-22 22:39 - 00000353 _____ C:\Users\ericjs\Downloads\netpersec.ini
2015-08-21 19:14 - 2015-08-21 19:15 - 01666560 _____ (Ziff-Davis Media, Inc.) C:\Users\ericjs\Downloads\NetPerSec-20140109.exe
2015-08-21 18:42 - 2015-08-21 18:42 - 00000000 ____D C:\Users\ericjs\Documents\ProcAlyzer Dumps
2015-08-21 18:42 - 2015-08-21 18:42 - 00000000 ____D C:\Users\ericjs\Documents\Outlook Files
2015-08-21 18:42 - 2015-08-21 18:42 - 00000000 ____D C:\Users\ericjs\Documents\Freemake
2015-08-21 18:42 - 2015-08-21 18:42 - 00000000 ____D C:\Users\ericjs\Documents\Expression
2015-08-21 18:42 - 2015-08-21 18:42 - 00000000 ____D C:\Users\ericjs\Documents\Clickbank
2015-08-21 18:42 - 2015-08-21 18:42 - 00000000 ____D C:\Users\ericjs\Documents\Bitcoin
2015-08-21 18:42 - 2015-08-21 18:42 - 00000000 ____D C:\Users\ericjs\Documents\Attachments_2014117
2015-08-21 18:42 - 2015-08-21 18:42 - 00000000 ____D C:\Users\ericjs\Documents\42incAttachments_201526
2015-08-21 18:42 - 2015-08-14 17:29 - 00018597 _____ C:\Users\ericjs\Documents\new budget.xlsx
2015-08-21 18:42 - 2015-07-02 15:38 - 00000799 _____ C:\Users\ericjs\Documents\new budget.TXT
2015-08-21 18:42 - 2015-04-03 16:27 - 00027136 _____ C:\Users\ericjs\Documents\spending.xls
2015-08-21 18:42 - 2015-01-09 10:11 - 01122942 _____ C:\Users\ericjs\Documents\Signature001.bmp
2015-08-21 18:42 - 2015-01-09 10:11 - 01119569 _____ C:\Users\ericjs\Documents\Signature002.tif
2015-08-21 18:42 - 2014-11-28 12:55 - 00010773 _____ C:\Users\ericjs\Documents\phone screens.xlsx
2015-08-21 18:42 - 2014-10-20 13:25 - 00037888 _____ C:\Users\ericjs\Documents\RCS2 Values.xls
2015-08-21 18:42 - 2014-10-13 17:14 - 00012251 _____ C:\Users\ericjs\Documents\RCS2 Values.xlsx
2015-08-21 18:41 - 2015-08-15 20:01 - 00072520 _____ C:\Users\ericjs\Documents\bookmarks_8_15_15.html
2015-08-21 18:41 - 2015-03-19 05:04 - 00009157 _____ C:\Users\ericjs\Documents\AWC.xlsx
2015-08-21 18:41 - 2015-02-13 20:37 - 00010128 _____ C:\Users\ericjs\Documents\budget.xlsx
2015-08-21 18:41 - 2015-02-06 18:04 - 00378426 _____ C:\Users\ericjs\Documents\42incAttachments_201526.zip
2015-08-21 18:41 - 2015-01-11 10:43 - 00000216 _____ C:\Users\ericjs\Documents\1420997920308.note
2015-08-21 18:41 - 2015-01-09 10:07 - 01122942 _____ C:\Users\ericjs\Documents\Consent001.bmp
2015-08-21 18:41 - 2014-12-30 14:50 - 00013016 _____ C:\Users\ericjs\Documents\Companies.xlsx
2015-08-21 18:41 - 2014-12-30 14:46 - 00002986 _____ C:\Users\ericjs\Documents\Companies.txt
2015-08-21 18:41 - 2014-12-11 01:18 - 00000342 _____ C:\Users\ericjs\Documents\Download (1).qif
2015-08-21 18:41 - 2014-11-07 09:04 - 00077536 _____ C:\Users\ericjs\Documents\Attachments_2014117.zip
2015-08-15 19:57 - 2015-08-15 19:57 - 00000000 ____D C:\Users\ericjs\AppData\Local\GWX
2015-08-12 14:44 - 2015-08-12 14:45 - 00000000 ____D C:\Traders Way MetaTrader 4
2015-08-12 14:42 - 2015-08-12 14:44 - 00000000 ____D C:\Tallinex MetaTrader 4 (demo)
2015-08-12 14:42 - 2015-08-12 14:42 - 00000000 ____D C:\tabs
2015-08-12 14:42 - 2015-08-12 14:42 - 00000000 ____D C:\moraff
2015-08-12 14:41 - 2015-08-12 14:42 - 00000000 ____D C:\Meta Trader 4 FinFx (Tallinex Live)
2015-08-12 14:41 - 2015-08-12 14:41 - 00000000 ____D C:\FXtradeweb MetaTrader 4
2015-08-12 14:41 - 2015-08-12 14:41 - 00000000 ____D C:\Forex Broker Inc MT4 Client Terminal
2015-08-12 14:40 - 2015-08-12 14:41 - 00000000 ____D C:\Forex - Foreign Exchange - Currency Trading - pdf Collection
2015-07-29 17:19 - 2015-07-29 17:19 - 00313472 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-07-29 17:19 - 2015-07-29 17:19 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-08-23 20:35 - 2014-02-19 12:15 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-23 20:35 - 2009-07-13 21:34 - 00026544 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-23 20:35 - 2009-07-13 21:34 - 00026544 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-23 20:30 - 2014-02-19 12:15 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-23 20:28 - 2015-06-06 13:36 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-23 20:14 - 2009-07-13 21:46 - 00001515 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-08-23 20:13 - 2013-05-04 08:50 - 01278105 _____ C:\Windows\WindowsUpdate.log
2015-08-23 19:50 - 2013-05-04 09:13 - 00785878 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-23 19:43 - 2009-07-13 21:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-23 19:43 - 2009-07-13 21:39 - 00072197 _____ C:\Windows\setupact.log
2015-08-23 18:44 - 2013-07-10 10:38 - 00000000 ____D C:\Temp
2015-08-22 20:07 - 2013-05-04 15:50 - 00196686 _____ C:\Windows\PFRO.log
2015-08-22 19:58 - 2014-11-02 16:40 - 00044523 _____ C:\Windows\certutil.log
2015-08-22 19:55 - 2015-06-05 12:12 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-08-22 19:27 - 2014-01-28 13:24 - 00000000 ____D C:\Users\ericjs\AppData\Roaming\Malwarebytes
2015-08-22 19:26 - 2014-01-28 13:24 - 00001060 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-08-22 19:26 - 2014-01-28 13:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-21 21:44 - 2014-03-18 09:42 - 00000000 ____D C:\Program Files\Java
2015-08-21 21:44 - 2014-03-18 09:36 - 00000000 ____D C:\ProgramData\Oracle
2015-08-21 21:42 - 2015-01-20 17:22 - 00096352 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-08-21 18:59 - 2014-03-25 11:44 - 00000000 ____D C:\Users\ericjs\Documents\Forex
2015-08-21 18:56 - 2014-10-20 17:26 - 00000000 ____D C:\Users\ericjs\Documents\Ableton
2015-08-21 18:42 - 2014-02-19 12:16 - 00002129 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-15 21:29 - 2014-01-08 08:43 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-08-15 21:29 - 2014-01-08 08:43 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-08-15 20:32 - 2009-07-13 19:37 - 00000000 ____D C:\Windows\system32\NDF
2015-08-12 04:49 - 2015-06-12 15:01 - 00000000 ____D C:\MetaTrader 4 IC Markets
2015-08-11 15:39 - 2014-11-02 16:39 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-10 04:44 - 2014-10-20 17:26 - 00024576 _____ C:\Users\ericjs\Documents\usernames.xls
2015-07-30 19:32 - 2013-09-04 13:15 - 00000000 ____D C:\ProgramData\Zoom Player
2015-07-30 16:24 - 2014-11-02 16:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-07-29 17:19 - 2014-05-09 23:02 - 00024016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-07-29 17:19 - 2014-01-07 08:27 - 00113592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-07-29 17:19 - 2013-05-04 11:10 - 00433264 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-07-29 17:19 - 2013-05-04 11:10 - 00208664 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-07-29 17:19 - 2013-05-04 11:10 - 00081728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-07-29 17:19 - 2013-05-04 11:10 - 00076000 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-07-29 17:19 - 2013-05-04 11:10 - 00049776 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-07-29 17:18 - 2013-05-04 11:10 - 00788784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
Some files in TEMP:
====================
C:\Users\ericjs\AppData\Local\Temp\Checkupdate.exe
C:\Users\ericjs\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\ericjs\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\ericjs\AppData\Local\Temp\gcapi_dll.dll
C:\Users\ericjs\AppData\Local\Temp\gtapi_signed.dll
C:\Users\ericjs\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\ericjs\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\ericjs\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\ericjs\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\ericjs\AppData\Local\Temp\MotoHelper_2.1.41_Driver_5.5.0.exe
C:\Users\ericjs\AppData\Local\Temp\sqlite3.dll
C:\Users\ericjs\AppData\Local\Temp\zp1000max.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-08-12 05:53
==================== End of log ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version:23-08-2015
Ran by [removed] (2015-08-23 20:47:10)
Running from C:\Users\[removed]\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1209631511-980094977-1553352967-500 - Administrator - Disabled)
ericjs (S-1-5-21-1209631511-980094977-1553352967-1000 - Administrator - Enabled) => C:\Users\ericjs
Guest (S-1-5-21-1209631511-980094977-1553352967-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM\…\7-Zip) (Version: - )
AC3Filter 2.6.0b (HKLM\…\AC3Filter_is1) (Version: 2.6.0b - Alexander Vigovsky)
Adobe Flash Player 18 ActiveX (HKLM\…\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\…\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Amazon Kindle (HKLM\…\Amazon Kindle) (Version: - Amazon)
Avast Free Antivirus (HKLM\…\avast) (Version: 10.3.2225 - AVAST Software)
Bamboo (HKLM\…\Pen Tablet Driver) (Version: 5.2.5-5 - Wacom Technology Corp.)
Bass Audio Decoder (remove only) (HKLM\…\Bass Audio Decoder) (Version: - )
CD Audio Reader Filter (remove only) (HKLM\…\CD Audio Reader Filter) (Version: - )
Cheat Engine 6.3 (HKLM\…\Cheat Engine 6.3_is1) (Version: - Cheat Engine)
CloudReading (HKLM\…\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.0.31.1111 - Foxit Corporation)
Conexant HD Audio (HKLM\…\CNXT_HDAUDIO) (Version: - )
DCoder Image Source (remove only) (HKLM\…\DCoder Image Source) (Version: - )
DirectVobSub (remove only) (HKLM\…\DirectVobSub) (Version: - )
Doomsday Engine 1.13.0 (HKLM\…\Doomsday Engine_is1) (Version: - deng Team)
DScaler 5 Mpeg Decoders (HKLM\…\DScaler 5 Mpeg Decoders_is1) (Version: - )
Dual Monitor 1.22 (HKLM\…\{64AA3F94-ED4A-4A4B-B72C-B7A1481ED5D8}_is1) (Version: 1.22.021813 - Cristi Diaconu)
EasyBCD 2.2 (HKLM\…\EasyBCD) (Version: 2.2 - NeoSmart Technologies)
EasyTether (HKLM\…\{f35c852c-fc42-4050-ae97-8c15d2e00cf3}) (Version: 1.3.2 - Mobile Stream)
EasyTether (Version: 1.3.2 - Mobile Stream) Hidden
EasyTether ADB USB driver (HKLM\…\{848F516A-DCDF-4F74-9E12-D1FD110EB183}) (Version: 1.0.5 - Mobile Stream)
EPSON Printer Software (HKLM\…\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
EPSON Scan (HKLM\…\EPSON Scanner) (Version: - )
ffdshow v1.3.4533 [2014-09-29] (HKLM\…\ffdshow_is1) (Version: 1.3.4533.0 - )
FFMPEG Core Files (remove only) (HKLM\…\FFMPEG Core Files) (Version: - )
Folder Size 2.9.0.0 (HKLM\…\{2DFA85ED-588F-4CE3-A175-29E52C3804A8}_is1) (Version: 2.9.0.0 - MindGems, Inc.)
FolderMatch v3.7.0 (HKLM\…\FolderMatch_is1) (Version: - )
Foxit Reader (HKLM\…\Foxit Reader_is1) (Version: 6.1.1.1031 - Foxit Corporation)
Gabest MPEG Splitter (remove only) (HKLM\…\Gabest MPEG Splitter) (Version: - )
Google Chrome (HKLM\…\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.28.1 - Google Inc.) Hidden
Haali Media Splitter (HKLM\…\HaaliMkx) (Version: - )
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\…\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_5047&SUBSYS;_1179FF31) (Version: - )
Hotspot Shield 3.42 (HKLM\…\HotspotShield) (Version: 3.42 - AnchorFree Inc.)
iSEEK AnswerWorks English Runtime (HKLM\…\{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}) (Version: [removed] - Vantage Linguistics)
Java 8 Update 51 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
LAV Filters 0.65 (HKLM\…\lavfilters_is1) (Version: 0.65 - Hendrik Leppkes)
MadVR (remove only) (HKLM\…\MadVR) (Version: - )
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\…\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM\…\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mobile Hotspot Admin (HKLM\…\{AEFF9E60-3E93-41EE-9895-311F7D1C5FFD}) (Version: 1.0.0.2 - ZTE Corporation)
MotoHelper 2.1.41 Driver 5.5.0 (HKLM\…\MotoHelper) (Version: 2.1.41 - Motorola)
MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden
Motorola Mobile Drivers Installation 5.5.0 (Version: 5.5.0 - Motorola Inc.) Hidden
Mozilla Firefox 38.0.5 (x86 en-US) (HKLM\…\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 38.0.5 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Newsbin Pro (HKLM\…\Newsbin6) (Version: 6.50 - DJI Interprises, LLC)
NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)
OpenSource AVI Splitter (remove only) (HKLM\…\OpenSource AVI Splitter) (Version: - )
OpenSource DTS/AC3/DD+ Source Filter (remove only) (HKLM\…\OpenSource DTS/AC3/DD+ Source Filter) (Version: - )
OpenSource Flash Video Splitter (remove only) (HKLM\…\OpenSource Flash Video Splitter) (Version: - )
Quicken 2013 (HKLM\…\{034DD4BB-F0D6-4ECF-B064-8E39E3EF7076}) (Version: 22.1.7.11 - Intuit)
Radmin Viewer 3.5 (HKLM\…\{199127DC-7BDB-41AB-825B-4229A86F8F0D}) (Version: 3.50.0000 - Famatech)
Skype™ 6.14 (HKLM\…\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
TeamViewer 9 (HKLM\…\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
Wacom Tablet (HKLM\…\Wacom Tablet Driver) (Version: 6.3.6-3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM\…\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
WebTablet IE Plugin (HKLM\…\Wacom WebTabletPlugin for IE) (Version: 1.1.0.12 - Wacom Technology Corp.)
WebTablet Netscape Plugin (HKLM\…\Wacom WebTabletPlugin for Netscape) (Version: 1.1.0.10 - Wacom Technology Corp.)
White Noise Sleep System version 1.3 (HKLM\…\{149367A4-632C-4EAB-80E2-61E84ACEBE6B}_is1) (Version: 1.3 - WNSS)
WIDCOMM Bluetooth Software (HKLM\…\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.0.9400 - Broadcom Corporation)
Zoom Player (remove only) (HKLM\…\ZoomPlayer) (Version: 10.0.0 - Inmatrix LTD)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1209631511-980094977-1553352967-1000_Classes\CLSID\{092dfa86-5807-5a94-bf3b-5a53ba9e5308}\InprocServer32 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 19:04 - 2009-06-10 14:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1E31F5A9-A877-4D4D-8ACF-3A6553FDE033} - System32\Tasks\MotoHelper Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2012-02-06] ()
Task: {502699B8-46DF-4520-9CCA-BAB4F2978CB0} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-07-29] (AVAST Software)
Task: {7528029E-8E98-42B3-B49F-E2EB635B8530} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-02-19] (Google Inc.)
Task: {7C239C23-CEED-47BF-8F5A-41640FFB1021} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-15] (Adobe Systems Incorporated)
Task: {A0C81D9D-575B-495A-8704-468B589DE4C7} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-13] (Microsoft Corporation)
Task: {AAE4764E-1CDA-44D8-A57B-B9BEC82ECAC8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-02-19] (Google Inc.)
Task: {AFFC4A5C-D760-4683-BD7B-43FF2765A2F6} - System32\Tasks\MotoHelper Initial Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2012-02-06] ()
Task: {FE6AB5F5-10CB-4BD3-B56D-98204ACBB659} - System32\Tasks\MotoHelper Routing => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2012-02-06] ()
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-07-29 17:19 - 2015-07-29 17:19 - 00102864 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-07-29 17:19 - 2015-07-29 17:19 - 00123976 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-08-23 18:51 - 2015-08-23 18:51 - 02960896 _____ () C:\Program Files\AVAST Software\Avast\defs\15082301\algo.dll
2015-07-29 17:19 - 2015-07-29 17:19 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-08-21 18:42 - 2015-08-17 22:23 - 01405768 _____ () C:\Program Files\Google\Chrome\Application\44.0.2403.157\libglesv2.dll
2015-08-21 18:42 - 2015-08-17 22:23 - 00081224 _____ () C:\Program Files\Google\Chrome\Application\44.0.2403.157\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1209631511-980094977-1553352967-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: btwdins => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HssTrayService => 3
MSCONFIG\Services: HssWd => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: MotoHelper => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: nvsvc => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: TabletServicePen => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: TouchServicePen => 2
MSCONFIG\Services: WTabletServicePro => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup
MSCONFIG\startupreg: CancelAutoPlay_df => "C:\Program Files\Hostless Modem\Mobile Hotspot Admin\CancelAutoPlay_df.exe" run
MSCONFIG\startupreg: CheckNDISPortf1ac19 => C:\Program Files\Hostless Modem\Mobile Hotspot Admin\CheckNDISPort_df.exe
MSCONFIG\startupreg: EasyTether => "C:\Program Files\Mobile Stream\EasyTether\easytthr.exe"
MSCONFIG\startupreg: High Definition Audio Property Page Shortcut => CHDAudPropShortcut.exe
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{4CBB506A-7932-40B2-9BCB-F80644CFE0BE}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{60E7989A-37E4-4BD0-8993-A6479BECDD93}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{8BE4CCBA-9276-4022-9C10-C74FEB0A2ACD}C:\program files\doomsday\bin\doomsday.exe] => (Allow) C:\program files\doomsday\bin\doomsday.exe
FirewallRules: [UDP Query User{499FF36A-6CCF-422D-B576-EC74377FB1A4}C:\program files\doomsday\bin\doomsday.exe] => (Allow) C:\program files\doomsday\bin\doomsday.exe
FirewallRules: [TCP Query User{0F1B4D61-069A-4E5F-8598-A76449BECBBF}C:\program files\doomsday\bin\doomsday-shell.exe] => (Allow) C:\program files\doomsday\bin\doomsday-shell.exe
FirewallRules: [UDP Query User{331B33BD-4789-466E-B875-A7719E10FFDB}C:\program files\doomsday\bin\doomsday-shell.exe] => (Allow) C:\program files\doomsday\bin\doomsday-shell.exe
FirewallRules: [TCP Query User{1B785157-3D2D-4B99-B250-166114689E20}C:\kdx\kdfrontend.exe] => (Allow) C:\kdx\kdfrontend.exe
FirewallRules: [UDP Query User{F9309AD3-9279-47EC-A090-2B556185C78D}C:\kdx\kdfrontend.exe] => (Allow) C:\kdx\kdfrontend.exe
FirewallRules: [{E834F45F-DB22-413B-BF61-8142F9C6CD40}] => (Block) C:\kdx\kdfrontend.exe
FirewallRules: [{6F37DBA7-99D5-4113-BC16-2B0002C4A57D}] => (Block) C:\kdx\kdfrontend.exe
FirewallRules: [{96EF3C54-1AE5-400E-9E69-318EB8CC15BB}] => (Allow) E:\Newsbin\newsbinpro.exe
FirewallRules: [{1D370962-23FD-4280-9B72-0C97D4298090}] => (Allow) E:\Newsbin\newsbinpro.exe
FirewallRules: [{74B6A50A-EF73-4861-9445-FD8C901D8EBC}] => (Allow) E:\Newsbin\newsbinpro.exe
FirewallRules: [{DFD7F8BC-B9C0-436C-9D37-56618351BC99}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{3078474E-EEE9-41CB-A103-DA8DD91197B1}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{32AF748F-CD12-444D-A893-154BDEDD06A3}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{46FE92B4-5793-4E4C-A21C-BF8B9270E23B}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{E22FFB33-FF43-4461-86B7-14490CE648BC}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{49F6727A-870A-4F4C-8AAB-E5C3DBD60AF3}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{83621813-06C5-4842-896B-D1A8C0D24557}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{4E64F2E6-1C23-44A7-B125-A5EFBD2C243D}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{8C322CBA-6EA6-48D9-9BBA-F7F47E241DA3}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{BFC6C658-2ECE-4C23-B01C-C2E7A4B8AD3B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{0FDF9DDC-AEDB-4EE6-B97C-B94DC3C93614}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
Name: Mass Storage Controller
Description: Mass Storage Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/12/2015 06:00:57 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Description = Scheduled Checkpoint; Error = 0x80070422).
Error: (07/30/2015 06:49:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Aargon.exe, version: 1.0.0.1, time stamp: 0x3d75e0d4
Faulting module name: nvd3dum.dll, version: 7.15.11.7967, time stamp: 0x49b12011
Exception code: 0xc0000005
Fault offset: 0x00203929
Faulting process id: 0x1580
Faulting application start time: 0xAargon.exe0
Faulting application path: Aargon.exe1
Faulting module path: Aargon.exe2
Report Id: Aargon.exe3
Error: (07/30/2015 05:08:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Aargon.exe, version: 1.0.0.1, time stamp: 0x3d75e0d4
Faulting module name: nvd3dum.dll, version: 7.15.11.7967, time stamp: 0x49b12011
Exception code: 0xc0000005
Fault offset: 0x00203929
Faulting process id: 0x1508
Faulting application start time: 0xAargon.exe0
Faulting application path: Aargon.exe1
Faulting module path: Aargon.exe2
Report Id: Aargon.exe3
Error: (07/30/2015 04:22:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Aargon.exe, version: 1.0.0.1, time stamp: 0x3d75e0d4
Faulting module name: nvd3dum.dll, version: 7.15.11.7967, time stamp: 0x49b12011
Exception code: 0xc0000005
Fault offset: 0x00203929
Faulting process id: 0xd14
Faulting application start time: 0xAargon.exe0
Faulting application path: Aargon.exe1
Faulting module path: Aargon.exe2
Report Id: Aargon.exe3
Error: (07/29/2015 06:46:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Aargon.exe, version: 1.0.0.1, time stamp: 0x3d75e0d4
Faulting module name: nvd3dum.dll, version: 7.15.11.7967, time stamp: 0x49b12011
Exception code: 0xc0000005
Fault offset: 0x00203929
Faulting process id: 0x54c
Faulting application start time: 0xAargon.exe0
Faulting application path: Aargon.exe1
Faulting module path: Aargon.exe2
Report Id: Aargon.exe3
Error: (07/29/2015 05:52:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Aargon.exe, version: 1.0.0.1, time stamp: 0x3d75e0d4
Faulting module name: nvd3dum.dll, version: 7.15.11.7967, time stamp: 0x49b12011
Exception code: 0xc0000005
Fault offset: 0x00203929
Faulting process id: 0x1714
Faulting application start time: 0xAargon.exe0
Faulting application path: Aargon.exe1
Faulting module path: Aargon.exe2
Report Id: Aargon.exe3
Error: (07/29/2015 05:17:41 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {1f73160d-b5f8-4737-a685-38e142a8ac58}
Error: (07/29/2015 04:58:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Aargon.exe, version: 1.0.0.1, time stamp: 0x3d75e0d4
Faulting module name: nvd3dum.dll, version: 7.15.11.7967, time stamp: 0x49b12011
Exception code: 0xc0000005
Fault offset: 0x00203929
Faulting process id: 0x1510
Faulting application start time: 0xAargon.exe0
Faulting application path: Aargon.exe1
Faulting module path: Aargon.exe2
Report Id: Aargon.exe3
Error: (07/29/2015 04:45:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Aargon.exe, version: 1.0.0.1, time stamp: 0x3d75e0d4
Faulting module name: nvd3dum.dll, version: 7.15.11.7967, time stamp: 0x49b12011
Exception code: 0xc0000005
Fault offset: 0x00203929
Faulting process id: 0x128
Faulting application start time: 0xAargon.exe0
Faulting application path: Aargon.exe1
Faulting module path: Aargon.exe2
Report Id: Aargon.exe3
Error: (07/29/2015 04:44:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Aargon.exe, version: 1.0.0.1, time stamp: 0x3d75e0d4
Faulting module name: nvd3dum.dll, version: 7.15.11.7967, time stamp: 0x49b12011
Exception code: 0xc0000005
Fault offset: 0x00203929
Faulting process id: 0x13ec
Faulting application start time: 0xAargon.exe0
Faulting application path: Aargon.exe1
Faulting module path: Aargon.exe2
Report Id: Aargon.exe3
System errors:
=============
Error: (08/23/2015 06:56:33 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5
Error: (08/22/2015 08:07:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Search service failed to start due to the following error:
%%1069
Error: (08/22/2015 08:07:19 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WSearch service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error:
%%50
To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
Error: (08/22/2015 08:06:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
Error: (08/22/2015 08:06:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
Error: (08/22/2015 08:06:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The TabletServicePen service terminated unexpectedly. It has done this 1 time(s).
Error: (08/22/2015 08:06:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The MotoHelper Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
Error: (08/22/2015 08:06:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Hotspot Shield Monitoring Service service terminated unexpectedly. It has done this 1 time(s).
Error: (08/22/2015 08:06:47 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Hotspot Shield Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
Error: (08/22/2015 08:06:47 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Bluetooth Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Microsoft Office:
=========================
Error: (08/12/2015 06:00:57 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationScheduled Checkpoint0x80070422
Error: (07/30/2015 06:49:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Aargon.exe1.0.0.13d75e0d4nvd3dum.dll7.15.11.796749b12011c000000500203929158001d0cb3286280c6fE:\Aargon Deluxe\Aargon.exeC:\Windows\system32\nvd3dum.dll5778b817-3726-11e5-b2b1-364b50b7efda
Error: (07/30/2015 05:08:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Aargon.exe1.0.0.13d75e0d4nvd3dum.dll7.15.11.796749b12011c000000500203929150801d0cb1ec5ac24b7E:\Aargon Deluxe\Aargon.exeC:\Windows\system32\nvd3dum.dll39431480-3718-11e5-b2b1-364b50b7efda
Error: (07/30/2015 04:22:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Aargon.exe1.0.0.13d75e0d4nvd3dum.dll7.15.11.796749b12011c000000500203929d1401d0cb1e4fc70dcdE:\Aargon Deluxe\Aargon.exeC:\Windows\system32\nvd3dum.dlld118db2d-3711-11e5-b2b1-364b50b7efda
Error: (07/29/2015 06:46:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Aargon.exe1.0.0.13d75e0d4nvd3dum.dll7.15.11.796749b12011c00000050020392954c01d0ca69368be53aD:\Aargon Deluxe\Aargon.exeC:\Windows\system32\nvd3dum.dllda9780b6-365c-11e5-b630-001636a5ff2d
Error: (07/29/2015 05:52:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Aargon.exe1.0.0.13d75e0d4nvd3dum.dll7.15.11.796749b12011c000000500203929171401d0ca5f2db7e699D:\Aargon Deluxe\Aargon.exeC:\Windows\system32\nvd3dum.dll4bd2a443-3655-11e5-b630-001636a5ff2d
Error: (07/29/2015 05:17:41 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Access is denied.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {1f73160d-b5f8-4737-a685-38e142a8ac58}
Error: (07/29/2015 04:58:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Aargon.exe1.0.0.13d75e0d4nvd3dum.dll7.15.11.796749b12011c000000500203929151001d0ca58f1432524D:\Aargon Deluxe\Aargon.exeC:\Windows\system32\nvd3dum.dllc694e86f-364d-11e5-b630-001636a5ff2d
Error: (07/29/2015 04:45:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Aargon.exe1.0.0.13d75e0d4nvd3dum.dll7.15.11.796749b12011c00000050020392912801d0ca588b49c181D:\Aargon Deluxe\Aargon.exeC:\Windows\system32\nvd3dum.dlle44b2d8f-364b-11e5-b630-001636a5ff2d
Error: (07/29/2015 04:44:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Aargon.exe1.0.0.13d75e0d4nvd3dum.dll7.15.11.796749b12011c00000050020392913ec01d0ca5857a7a93bD:\Aargon Deluxe\Aargon.exeC:\Windows\system32\nvd3dum.dllba10fa0a-364b-11e5-b630-001636a5ff2d
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz
Percentage of memory in use: 41%
Total physical RAM: 3070.18 MB
Available physical RAM: 1800.16 MB
Total Virtual: 6136.61 MB
Available Virtual: 4794.7 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.79 GB) (Free:61.96 GB) NTFS ==>[drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 111.8 GB) (Disk ID: E8767277)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
==================== End of log ============================
