malware message and slow down [Closed]

hi Ken.

 

thanks. here are the scan results from asw.

 

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-12-19 09:10:11
—————————–
09:10:11.822    OS Version: Windows x64 6.2.9200
09:10:11.822    Number of processors: 4 586 0x3A09
09:10:11.822    ComputerName: PC  UserName:
09:11:41.412    Initialize success
09:11:41.474    VM: initialized successfully
09:11:41.474    VM: Intel CPU BiosDisabled
09:11:43.475    AVAST engine defs: 15121703
09:11:47.287    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000002d
09:11:47.287    Disk 0 Vendor: HGST_HTS541075A9E680 JA2OA590 Size: 715404MB BusType: 11
09:11:47.631    Disk 0 MBR read successfully
09:11:47.631    Disk 0 MBR scan
09:11:47.631    Disk 0 unknown MBR code
09:11:47.647    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
09:11:48.272    Disk 0 scanning C:\Windows\system32\drivers
09:12:35.868    Service scanning
09:14:36.202    Modules scanning
09:14:36.202    Disk 0 trace - called modules:
09:14:36.233    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll iaStorA.sys
09:14:36.280    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe001e19be060]
09:14:36.280    3 CLASSPNP.SYS[fffff80153202170] -> nt!IofCallDriver -> \Device\0000002d[0xffffe001e0d897f0]
09:15:14.469    AVAST engine scan C:\Windows
09:15:47.393    AVAST engine scan C:\Windows\system32
09:21:44.334    AVAST engine scan C:\Windows\system32\drivers
09:22:24.337    AVAST engine scan C:\Users\Vladimir
09:44:24.337    AVAST engine scan C:\ProgramData
09:47:59.302    Disk 0 statistics 3751985/0/0 @ 1.05 MB/s
09:47:59.307    Scan finished successfully
09:50:14.531    Disk 0 MBR has been saved successfully to "C:\Users\Vladimir\Desktop\MBR.dat"
09:50:14.535    The log file has been saved successfully to "C:\Users\Vladimir\Desktop\aswMBR.txt"

 

 

 

 

 

farbar results.

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:17-12-2015

Ran by [removed] (administrator) on PC (19-12-2015 09:54:58)

Running from C:\Users\[removed]\Desktop

[removed]

Platform: Windows 8.1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7199448 2013-09-02] (Realtek Semiconductor)

HKLM\…\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2758200 2013-10-15] (Hewlett-Packard)

HKLM\…\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [155704 2013-10-15] (Hewlett-Packard)

HKLM\…\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [155704 2013-10-15] (Hewlett-Packard)

HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780912 2013-09-20] (Synaptics Incorporated)

HKLM-x32\…\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-02] (CyberLink Corp.)

HKLM-x32\…\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-10-09] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7021880 2015-12-16] (AVAST Software)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-12-16] (AVAST Software)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] [removed] [removed]

Tcpip\..\Interfaces\{2A6C1D93-63B6-4CDC-BC61-2EDEFEBC804D}: [DhcpNameServer] [removed] [removed]

 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.jp.msn.com/HPALL14/14

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.jp.msn.com/HPALL14/14

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.jp.msn.com/HPALL14/14

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.jp.msn.com/HPALL14/14

HKU\S-1-5-21-554196473-1291799570-2914229824-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.jp.msn.com/HPALL14/14

HKU\S-1-5-21-554196473-1291799570-2914229824-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.jp.msn.com/HPALL14/14

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}

SearchScopes: HKU\S-1-5-21-554196473-1291799570-2914229824-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-12-15] (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-12-16] (AVAST Software)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-12-15] (Microsoft Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-12-16] (AVAST Software)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)

 

FireFox:

========

FF ProfilePath: C:\Users\Vladimir\AppData\Roaming\Mozilla\Firefox\Profiles\7p5u06v0.default-1429959918945

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-13] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-13] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1221171.dll [2015-10-19] (Adobe Systems, Inc.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-11-22] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-06] (Microsoft Corporation)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll [No File]

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-10-01] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-554196473-1291799570-2914229824-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Vladimir\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-07-12] (Unity Technologies ApS)

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-16]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF

FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2015-12-16]

 

Chrome:

=======

CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-12-16]

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-08-07] (Windows (R) Win 7 DDK provider) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [226440 2015-12-16] (AVAST Software)

R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-10-15] () [File not signed]

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2802360 2015-11-24] (Microsoft Corporation)

R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-09-05] (CyberLink)

R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-09-05] (CyberLink)

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-09] (Hewlett-Packard Development Company, L.P.)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [File not signed]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)

S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [178312 2015-09-25] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-10-15] (Softex Inc.) [File not signed]

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2013-08-23] (Realtek Semiconductor)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-12-16] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [97648 2015-12-19] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-12-16] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-12-16] (AVAST Software)

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1055560 2015-12-16] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [451040 2015-12-19] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [155304 2015-12-16] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2015-12-16] (AVAST Software)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3860480 2013-08-23] (Qualcomm Atheros Communications, Inc.)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-06] (CyberLink)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)

S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290520 2013-08-27] (Realtek Semiconductor Corp.)

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-20] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-20] (Synaptics Incorporated)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-23] (Hewlett-Packard Development Company, L.P.)

U3 McAPExe; no ImagePath

U3 McMPFSvc; no ImagePath

U3 McNaiAnn; no ImagePath

U3 mcpltsvc; no ImagePath

U3 mfecore; no ImagePath

U3 MSK80Service; no ImagePath

U3 aswMBR; \??\C:\Users\Vladimir\AppData\Local\Temp\aswMBR.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-12-19 09:54 - 2015-12-19 09:55 - 00016459 _____ C:\Users\Vladimir\Desktop\FRST.txt

2015-12-19 09:54 - 2015-12-19 09:54 - 00000000 ____D C:\FRST

2015-12-19 09:53 - 2015-12-19 09:53 - 02370048 _____ (Farbar) C:\Users\Vladimir\Desktop\FRST64.exe

2015-12-19 09:53 - 2015-12-19 09:53 - 01721344 _____ (Farbar) C:\Users\Vladimir\Downloads\FRST.exe

2015-12-19 09:50 - 2015-12-19 09:50 - 00001836 _____ C:\Users\Vladimir\Desktop\aswMBR.txt

2015-12-19 09:50 - 2015-12-19 09:50 - 00000512 _____ C:\Users\Vladimir\Desktop\MBR.dat

2015-12-19 09:07 - 2015-12-19 09:07 - 657854417 _____ C:\Windows\MEMORY.DMP

2015-12-19 09:07 - 2015-12-19 09:07 - 00285376 _____ C:\Windows\Minidump\121915-42421-01.dmp

2015-12-19 09:07 - 2015-12-19 09:07 - 00000000 ____D C:\Windows\Minidump

2015-12-19 08:54 - 2015-12-19 08:54 - 05198336 _____ (AVAST Software) C:\Users\Vladimir\Desktop\aswMBR.exe

2015-12-16 20:00 - 2015-12-16 20:00 - 00386096 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2015-12-16 20:00 - 2015-12-16 20:00 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr

2015-12-09 20:59 - 2015-11-05 19:59 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys

2015-12-09 20:58 - 2015-11-12 03:21 - 25837568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-12-09 20:58 - 2015-11-12 02:41 - 20366848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-12-09 20:58 - 2015-11-10 10:46 - 04514816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-12-09 20:58 - 2015-11-09 09:04 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-12-09 20:58 - 2015-11-09 08:14 - 14456832 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-12-09 20:58 - 2015-10-23 04:43 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll

2015-12-09 20:58 - 2015-10-23 04:43 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZST.DLL

2015-12-09 20:58 - 2015-10-23 04:43 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL

2015-12-09 20:58 - 2015-10-23 04:43 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL

2015-12-09 20:58 - 2015-10-23 03:59 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdgeoqw.dll

2015-12-09 20:58 - 2015-10-23 03:59 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZST.DLL

2015-12-09 20:58 - 2015-10-23 03:59 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZEL.DLL

2015-12-09 20:58 - 2015-10-23 03:59 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZE.DLL

2015-12-09 20:58 - 2015-10-23 03:21 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll

2015-12-09 20:58 - 2015-10-23 03:21 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll

2015-12-09 20:58 - 2015-10-23 02:58 - 00868864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll

2015-12-09 20:58 - 2015-10-23 02:58 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll

2015-12-09 20:58 - 2015-10-23 01:08 - 00513456 _____ C:\Windows\SysWOW64\locale.nls

2015-12-09 20:58 - 2015-10-23 01:08 - 00513456 _____ C:\Windows\system32\locale.nls

2015-12-09 20:57 - 2015-11-12 03:00 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-12-09 20:57 - 2015-11-12 02:44 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-12-09 20:57 - 2015-11-12 02:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2015-12-09 20:57 - 2015-11-12 02:12 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-12-09 20:57 - 2015-11-10 11:13 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-12-09 20:57 - 2015-11-10 11:11 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-12-09 20:57 - 2015-11-10 11:08 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-12-09 20:57 - 2015-11-10 11:04 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-12-09 20:57 - 2015-11-10 11:02 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-12-09 20:57 - 2015-11-10 10:41 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2015-12-09 20:57 - 2015-11-10 10:37 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2015-12-09 20:57 - 2015-11-10 10:36 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-12-09 20:57 - 2015-11-10 10:36 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-12-09 20:57 - 2015-11-10 10:36 - 00325632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-12-09 20:57 - 2015-11-10 10:25 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll

2015-12-09 20:57 - 2015-11-10 10:17 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-12-09 20:57 - 2015-11-10 10:14 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-12-09 20:57 - 2015-11-10 10:12 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-12-09 20:57 - 2015-11-09 09:15 - 02887168 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-12-09 20:57 - 2015-11-09 09:15 - 00571392 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-12-09 20:57 - 2015-11-09 09:02 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-12-09 20:57 - 2015-11-09 09:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-12-09 20:57 - 2015-11-09 08:32 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-12-09 20:57 - 2015-11-09 08:32 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2015-12-09 20:57 - 2015-11-09 08:25 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2015-12-09 20:57 - 2015-11-09 08:18 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-12-09 20:57 - 2015-11-09 08:16 - 00372224 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-12-09 20:57 - 2015-11-09 08:15 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-12-09 20:57 - 2015-11-09 08:15 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-12-09 20:57 - 2015-11-09 08:13 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-12-09 20:57 - 2015-11-09 07:53 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll

2015-12-09 20:57 - 2015-11-09 07:53 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-12-09 20:57 - 2015-11-09 07:41 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-12-09 20:57 - 2015-11-09 07:30 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-12-09 20:56 - 2015-11-22 17:59 - 07455064 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-12-09 20:56 - 2015-11-22 17:59 - 01735000 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-12-09 20:56 - 2015-11-22 17:59 - 01659568 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2015-12-09 20:56 - 2015-11-22 17:59 - 01519592 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2015-12-09 20:56 - 2015-11-22 17:59 - 01487008 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2015-12-09 20:56 - 2015-11-22 17:59 - 01355848 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2015-12-09 20:56 - 2015-11-22 17:58 - 01499920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-12-09 20:56 - 2015-11-22 05:32 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2015-12-09 20:56 - 2015-11-22 04:50 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-12-09 20:56 - 2015-11-22 03:59 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll

2015-12-09 20:56 - 2015-11-22 03:49 - 01344000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll

2015-12-09 20:56 - 2015-11-22 03:47 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll

2015-12-09 20:56 - 2015-11-22 03:40 - 00414208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll

2015-12-09 20:56 - 2015-11-21 09:47 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-12-09 20:56 - 2015-11-21 05:18 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2015-12-09 20:56 - 2015-11-21 03:58 - 03706880 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-12-09 20:56 - 2015-11-21 03:47 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-12-09 20:56 - 2015-11-21 03:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-12-09 20:56 - 2015-11-21 03:44 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2015-12-09 20:56 - 2015-11-21 03:44 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-12-09 20:56 - 2015-11-21 03:43 - 00897024 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-12-09 20:56 - 2015-11-21 03:42 - 02243584 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-12-09 20:56 - 2015-11-21 03:30 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2015-12-09 20:56 - 2015-11-21 03:29 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2015-12-09 20:56 - 2015-11-21 03:28 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2015-12-09 20:56 - 2015-11-21 03:27 - 00726528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2015-12-09 20:56 - 2015-11-09 11:41 - 01540728 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll

2015-12-09 20:56 - 2015-11-09 09:30 - 04176384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-12-09 20:56 - 2015-11-09 08:23 - 01994752 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-12-09 20:56 - 2015-11-09 08:13 - 01383936 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll

2015-12-09 20:56 - 2015-11-09 08:01 - 01753600 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll

2015-12-09 20:56 - 2015-11-09 07:52 - 01559552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-12-09 20:56 - 2015-11-09 07:48 - 01376256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll

2015-12-09 20:56 - 2015-11-09 07:42 - 01490944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll

2015-12-09 20:56 - 2015-10-29 02:49 - 02775552 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2015-12-09 20:56 - 2015-10-29 02:29 - 02462720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2015-12-09 20:56 - 2015-10-11 17:34 - 00468824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS

2015-12-09 20:56 - 2015-10-11 17:34 - 00462168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2015-12-09 20:56 - 2015-10-11 17:34 - 00443224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2015-12-09 20:56 - 2015-10-11 17:34 - 00092504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2015-12-09 20:56 - 2015-10-11 17:34 - 00027992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2015-12-09 20:56 - 2015-10-11 05:41 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2015-12-09 20:56 - 2015-10-11 05:41 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2015-12-09 20:56 - 2015-10-11 04:20 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll

2015-12-09 20:56 - 2015-10-09 03:11 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\PCPKsp.dll

2015-12-09 20:56 - 2015-10-09 02:50 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCPKsp.dll

2015-12-09 20:56 - 2015-10-06 05:28 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\wininit.exe

2015-12-09 20:56 - 2015-10-06 05:25 - 00572928 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2015-12-09 20:56 - 2015-10-04 06:41 - 01385280 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll

2015-12-09 20:56 - 2015-10-04 06:41 - 01124384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll

2015-12-07 00:31 - 2015-12-07 19:24 - 00000000 ____D C:\Users\Vladimir\Desktop\conveyance and tax law

2015-12-04 09:58 - 2015-12-04 09:58 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software

2015-12-04 09:58 - 2015-12-04 09:58 - 00000000 ____D C:\Program Files\Common Files\AV

2015-11-30 15:52 - 2015-11-30 15:52 - 00376275 _____ C:\Users\Vladimir\Downloads\Dennis David Rodman cost agreement (30 Nov 15).pdf

2015-11-23 00:53 - 2015-11-23 00:53 - 00000000 ____D C:\AVAST Software

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-12-19 09:54 - 2013-08-23 00:36 - 00000000 ____D C:\Windows

2015-12-19 09:50 - 2014-11-22 11:50 - 00000000 __RDO C:\Users\Vladimir\SkyDrive

2015-12-19 09:50 - 2014-11-22 11:46 - 00003914 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{39F91A9C-2271-4C5D-9E7D-E649B0FE081B}

2015-12-19 09:11 - 2014-11-22 11:48 - 00000000 ____D C:\Users\Vladimir\Documents\Youcam

2015-12-19 09:07 - 2013-08-23 01:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-12-19 08:54 - 2014-11-29 16:25 - 00451040 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2015-12-19 08:54 - 2014-11-29 16:25 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys

2015-12-19 08:41 - 2014-11-22 11:45 - 00000000 ____D C:\Users\Vladimir

2015-12-18 21:00 - 2013-08-23 02:20 - 00000000 ____D C:\Windows\CbsTemp

2015-12-18 20:57 - 2015-04-04 21:45 - 00000000 ___SD C:\Windows\SysWOW64\GWX

2015-12-18 20:57 - 2015-04-04 21:45 - 00000000 ___SD C:\Windows\system32\GWX

2015-12-16 20:02 - 2013-08-23 00:25 - 00262144 ___SH C:\Windows\system32\config\BBI

2015-12-16 20:01 - 2013-08-23 00:36 - 00000000 ____D C:\Windows\Inf

2015-12-16 20:00 - 2014-11-29 16:28 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-12-16 20:00 - 2014-11-29 16:25 - 00273784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys

2015-12-16 20:00 - 2014-11-29 16:25 - 00155304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys

2015-12-16 20:00 - 2014-11-29 16:25 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2015-12-16 20:00 - 2014-11-29 16:25 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys

2015-12-16 20:00 - 2014-11-29 16:25 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys

2015-12-16 19:59 - 2014-11-29 16:25 - 01055560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2015-12-15 12:56 - 2013-08-23 02:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2015-12-15 12:55 - 2014-11-22 11:52 - 00000000 ____D C:\Program Files\Microsoft Office 15

2015-12-12 20:32 - 2013-08-23 02:36 - 00000000 ____D C:\Windows\AppReadiness

2015-12-12 04:15 - 2013-08-23 02:36 - 00000000 ____D C:\Windows\rescache

2015-12-11 16:55 - 2013-08-23 01:44 - 00374648 _____ C:\Windows\system32\FNTCACHE.DAT

2015-12-10 00:42 - 2014-11-25 02:19 - 00000000 ____D C:\Windows\system32\MRT

2015-12-10 00:36 - 2014-11-25 02:19 - 140158008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-12-03 23:11 - 2013-08-23 02:36 - 00000000 ____D C:\Windows\system32\NDF

2015-12-02 04:19 - 2015-03-14 08:35 - 00826872 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-12-02 04:19 - 2015-03-14 08:35 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-11-30 15:35 - 2014-12-01 15:42 - 00000000 ____D C:\Users\Vladimir\Desktop\Jobs

2015-11-28 15:39 - 2014-11-22 11:52 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-554196473-1291799570-2914229824-1001

2015-11-28 13:25 - 2015-07-01 13:44 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

2015-11-19 20:58 - 2015-09-20 21:58 - 00003170 _____ C:\Windows\System32\Tasks\HPCeeScheduleForVladimir

2015-11-19 20:58 - 2015-09-20 21:58 - 00000350 _____ C:\Windows\Tasks\HPCeeScheduleForVladimir.job

 

==================== Files in the root of some directories =======

 

2014-11-29 16:32 - 2014-11-29 16:32 - 6000640 _____ () C:\Program Files (x86)\GUT875D.tmp

2014-11-28 12:13 - 2012-10-25 06:44 - 0656048 _____ (WildTangent, Inc.) C:\ProgramData\uninstall788063.exe

 

Files to move or delete:

====================

C:\ProgramData\uninstall788063.exe

 

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-12-18 20:56

 

==================== End of FRST.txt ============================

 

 

 

 

 

 

 

 

 

additional scan results.

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:17-12-2015
Ran by [removed] (2015-12-19 09:56:12)
Running from C:\Users\[removed]\Desktop
Windows 8.1 (X64) (2014-11-22 00:46:05)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-554196473-1291799570-2914229824-500 - Administrator - Disabled)
Guest (S-1-5-21-554196473-1291799570-2914229824-501 - Limited - Disabled)
Vladimir (S-1-5-21-554196473-1291799570-2914229824-1001 - Administrator - Enabled) => C:\Users\Vladimir

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.22 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 20.0.0.235 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.2.1.171 - Adobe Systems, Inc.)
Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avast Free Antivirus (HKLM-x32\…\Avast) (Version: 11.1.2245 - AVAST Software)
Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3303 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3228 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3305 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\…\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.2.3302 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Energy Star (HKLM-x32\…\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Fishdom 3: Collector's Edition (x32 Version: 3.0.2.38 - WildTangent) Hidden
Google Update Helper (x32 Version: 1.3.21.169 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
HP Documentation (HKLM-x32\…\{CCE5C597-03EA-423E-BA80-6FCD280A8465}) (Version: 1.1.0.0 - Hewlett-Packard)
HP SimplePass (HKLM-x32\…\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.57 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{3AF15EEA-8EDF-4393-BB6C-CF8A9986486A}) (Version: 7.3.35.20 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}) (Version: 1.0.10 - Hewlett-Packard Company)
HP Utility Center (HKLM\…\{7A75E042-0D30-43C2-BD2A-684F4BE38FF7}) (Version: 2.3.1 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)
Inst5675 (Version: 8.00.57 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.57 - Softex Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3316 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.1.1000 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\…\{B991A1BC-DE0F-41B3-9037-B2F948F706EC}) (Version: 3.1.1228 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mahjongg Dimensions Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office Home and Student 2013 - en-us (HKLM\…\HomeStudentRetail - en-us) (Version: 15.0.4779.1002 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-554196473-1291799570-2914229824-1001\…\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 42.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 42.0 (x86 en-US)) (Version: 42.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\…\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.232 - Qualcomm Atheros)
Qualcomm Atheros Driver Installation Program (HKLM-x32\…\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.29070 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\…\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7032 - Realtek Semiconductor Corp.)
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 17.0.15.0 - Synaptics Incorporated)
The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden
Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden
Unity Web Player (HKU\S-1-5-21-554196473-1291799570-2914229824-1001\…\UnityWebPlayer) (Version: 5.0.0f4 - Unity Technologies ApS)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

28-11-2015 04:46:54 Scheduled Checkpoint
05-12-2015 13:07:05 Scheduled Checkpoint
10-12-2015 00:26:29 Windows Update
17-12-2015 10:57:25 Scheduled Checkpoint

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-23 00:25 - 2013-08-23 00:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0417F64D-5ECF-4011-BE69-07533B73A9F4} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-12-16] (AVAST Software)
Task: {07EC6440-2E88-4F87-8B0B-AE1476230B50} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {0CDEA3C8-FF8D-46C3-AD9A-D2BE35B76920} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {0D18CFC3-C033-4DEC-9A3F-5C30881015F8} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {0E6AD062-B9EF-4FC1-8871-FF46763501D6} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-13] (CyberLink Corp.)
Task: {15D0E00A-137C-494C-A208-87BD5395CBA3} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-12-16] (AVAST Software)
Task: {18DCCF9B-3E72-4E57-ABC7-3AD2913417B2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2015-10-22] (Hewlett-Packard)
Task: {1F17054A-FDB4-4866-83F1-1594F6DDE174} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {5DF6590B-4BF9-46B7-A0A6-048CD72CA353} - System32\Tasks\HPCeeScheduleForVladimir => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {5EAFBE9F-06A2-46A0-9D98-D53212BD296F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)
Task: {673B6176-9778-466D-9208-4B57BE2741D3} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)
Task: {994C3B43-823C-4FD7-9C93-9C1D79EA75C2} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2015-09-25] (Intel Corporation)
Task: {B3A89744-269E-4924-BB70-D1428B33200D} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-20] (Synaptics Incorporated)
Task: {E9B1C1E0-57CC-4C9C-A369-55CE7E8952CC} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2015-09-25] (Intel Corporation)
Task: {EBABC4F0-6D7A-49E8-ABC2-69878EB3F3A9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-30] (Hewlett-Packard Company)
Task: {FA9050AB-07F3-44AB-ABBF-7C7E5727D8BC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-30] (Hewlett-Packard Company)
Task: {FD4CAA4C-0988-46DD-8B4E-D2BDA4FBA9DE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-12-10] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\HPCeeScheduleForVladimir.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2013-10-15 06:23 - 2013-10-15 06:23 - 00109568 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
2013-10-15 06:24 - 2013-10-15 06:24 - 00627200 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachedrv.dll
2013-10-15 06:25 - 2013-10-15 06:25 - 02541056 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2013-10-15 06:22 - 2013-10-15 06:22 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2013-10-15 06:22 - 2013-10-15 06:22 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2013-10-15 06:22 - 2013-10-15 06:22 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2013-10-15 06:35 - 2013-10-15 06:35 - 00306064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2013-10-15 06:35 - 2013-10-15 06:35 - 01297296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2014-11-22 14:02 - 2015-10-13 04:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-10-29 08:06 - 2015-09-02 03:04 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2013-10-15 06:30 - 2013-10-15 06:30 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2013-10-01 02:12 - 2013-10-01 02:12 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-07-03 19:16 - 2015-07-03 19:16 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll
2015-12-16 20:00 - 2015-12-16 20:00 - 00103888 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-12-16 20:00 - 2015-12-16 20:00 - 00125512 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-12-18 10:46 - 2015-12-18 10:46 - 02805760 _____ () C:\Program Files\AVAST Software\Avast\defs\15121703\algo.dll
2015-12-16 20:00 - 2015-12-16 20:00 - 00469008 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2014-03-20 16:28 - 2013-08-05 18:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-06 09:48 - 2013-08-06 09:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-12-16 20:00 - 2015-12-16 20:00 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-03-20 16:04 - 2013-09-17 08:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-07-03 16:09 - 2015-07-03 16:09 - 45080248 _____ () C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll
2015-10-24 08:27 - 2015-10-24 08:27 - 21344952 _____ () C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll
2015-03-17 02:34 - 2015-03-17 02:34 - 00322208 _____ () C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqlite.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-554196473-1291799570-2914229824-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Hewlett-Packard Backgrounds\backgroundDefault.jpg
DNS Servers: [removed] - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{EF7E1445-04E2-4099-BF58-1C3D6D0F6EC5}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{CB24F580-5D0C-4A4A-A013-30357A258DBC}] => (Allow) LPort=2869
FirewallRules: [{BFD1C706-E770-4748-BDA1-B1A7741B32AC}] => (Allow) LPort=1900
FirewallRules: [{46BBBC57-3BA2-4CFF-81A5-F2A70F5110F1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{85579B6F-3208-44B9-9B03-452570E0EFC6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F2CDCE32-E29D-4109-B1D7-A441594B4C13}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{A154180F-744F-4B73-B1D3-A0797BFECBE8}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{FAF925BE-C03C-4F1C-BCBC-DDCE5A41C056}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{7CAB3B91-F611-439D-B708-F1F8DDFA0D7B}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{4ABA1877-891C-46C8-A867-D0E58E6E5F79}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{D554365D-7A84-498C-93CF-C5733B24F3AE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{C4305A32-25DC-461A-A492-BCBC9BEA65E1}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{FFDE2883-74F4-42AC-8A2B-FBDA7AD72D06}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{716BEE73-34EB-43BF-80D9-A51E1673FBC5}] => (Allow) C:\Users\Vladimir\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{29C58653-18AD-4270-8A10-67189415D017}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{3D979F33-C37C-4739-B2BC-4627ACBAFA69}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{130CE76E-9713-40C1-8645-C30AF740164F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{84506573-90F6-4BA5-8ACF-65BFE81FABCC}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{3BF905ED-27FA-4865-896F-4CFFF39B8EFC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3731EEC8-9AEE-4DBA-9FBD-2D32980B7BF3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{0EAFEE7E-EDC4-4339-85D4-E7C1CE28FF89}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{DBEC9312-537F-4488-8A9D-5EBA1386A0A3}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{2180053D-625D-41A1-84CC-617B8339BC03}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1C068716-321A-4456-B2B9-F9E4E6533600}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/19/2015 09:19:08 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20911 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: fec

Start Time: 01d139e0b1248281

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: a6fd6db6-a5d4-11e5-830c-28e347e3534c

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (12/19/2015 08:47:30 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20911 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: f6c

Start Time: 01d139dcf43cef78

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: e9b29076-a5d0-11e5-830b-28e347e3534c

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (12/18/2015 10:54:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: opbhobrokerdsktop.exe, version: 8.0.0.57, time stamp: 0x525c1d2d
Faulting module name: combase.dll, version: 6.3.9600.17415, time stamp: 0x545044f9
Exception code: 0xc0000005
Fault offset: 0x000000000003a02f
Faulting process id: 0x5f8
Faulting application start time: 0xopbhobrokerdsktop.exe0
Faulting application path: opbhobrokerdsktop.exe1
Faulting module path: opbhobrokerdsktop.exe2
Report Id: opbhobrokerdsktop.exe3
Faulting package full name: opbhobrokerdsktop.exe4
Faulting package-relative application ID: opbhobrokerdsktop.exe5

Error: (12/18/2015 08:59:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20911 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2b40

Start Time: 01d1397a174ce486

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 0b2119d7-a56e-11e5-830a-28e347e3534c

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (12/18/2015 12:22:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OPBHOBrokerDsktop.exe, version: 8.0.0.57, time stamp: 0x525c1d2d
Faulting module name: combase.dll, version: 6.3.9600.17415, time stamp: 0x545044f9
Exception code: 0xc0000005
Fault offset: 0x000000000003a02f
Faulting process id: 0x2bc4
Faulting application start time: 0xOPBHOBrokerDsktop.exe0
Faulting application path: OPBHOBrokerDsktop.exe1
Faulting module path: OPBHOBrokerDsktop.exe2
Report Id: OPBHOBrokerDsktop.exe3
Faulting package full name: OPBHOBrokerDsktop.exe4
Faulting package-relative application ID: OPBHOBrokerDsktop.exe5

Error: (12/16/2015 08:09:57 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20911 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 884

Start Time: 01d137e0cf536fad

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: c529ccc9-a3d4-11e5-830a-28e347e3534c

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (12/16/2015 08:09:52 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20911 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 884

Start Time: 01d137e0cf536fad

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: c22104d3-a3d4-11e5-830a-28e347e3534c

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (12/16/2015 08:07:28 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18123 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 12b4

Start Time: 01d137e0f6562874

Termination Time: 5

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id: 5a0b161c-a3d4-11e5-830a-28e347e3534c

Faulting package full name:

Faulting package-relative application ID:

Error: (12/15/2015 01:00:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.18124, time stamp: 0x5641278d
Faulting module name: igd10iumd32.dll, version: 10.18.10.3316, time stamp: 0x524b007a
Exception code: 0xc0000005
Fault offset: 0x00093ef7
Faulting process id: 0x1700
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3
Faulting package full name: IEXPLORE.EXE4
Faulting package-relative application ID: IEXPLORE.EXE5

Error: (12/15/2015 12:56:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program IEXPLORE.EXE version 11.0.9600.18124 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2b5c

Start Time: 01d136db2b944cdb

Termination Time: 112

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id: 123efeae-a2cf-11e5-8309-28e347e3534c

Faulting package full name:

Faulting package-relative application ID:


System errors:
=============
Error: (12/19/2015 09:10:50 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Assistant Service service failed to start due to the following error:
%%1053

Error: (12/19/2015 09:10:50 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the HP Support Assistant Service service to connect.

Error: (12/19/2015 09:07:22 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000109 (0xa3a01f58f3df478c, 0xb3b72bdf465f4aa3, 0xffffd000203ccfc0, 0x0000000000000002)C:\Windows\MEMORY.DMP121915-42421-01

Error: (12/19/2015 09:07:16 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 8:40:41 AM on ‎19/‎12/‎2015 was unexpected.

Error: (12/19/2015 08:44:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Assistant Service service failed to start due to the following error:
%%1053

Error: (12/19/2015 08:44:00 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the HP Support Assistant Service service to connect.

Error: (12/19/2015 08:40:16 AM) (Source: Microsoft-Windows-HAL) (EventID: 13) (User: NT AUTHORITY)
Description: The system watchdog timer was triggered.

Error: (12/19/2015 08:40:40 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 12:37:45 AM on ‎19/‎12/‎2015 was unexpected.

Error: (12/18/2015 05:44:46 PM) (Source: DCOM) (EventID: 10010) (User: PC)
Description: {49BD2028-1523-11D1-AD79-00C04FD8FDFF}

Error: (12/18/2015 12:30:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 4 time(s).


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-3110M CPU @ 2.40GHz
Percentage of memory in use: 58%
Total physical RAM: 3988.27 MB
Available physical RAM: 1639.92 MB
Total Virtual: 8084.27 MB
Available Virtual: 5438.32 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:678.51 GB) (Free:631.71 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:18.91 GB) (Free:1.89 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: E9B7CBF9)

Partition: GPT.

==================== End of Addition.txt ============================

 

Hi,

 

Not really anything earth shattering on your logs, lets do this