What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Purchased "New" Used Computer. Slow. Need to clean with help,

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

I recently purchased a used computer.  It is running slower than it should be.  I would like help cleaning to possibly improve performance, please.  I am trying to use it for work.  Thank you.

aswMBR scan results:

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2016-03-07 15:27:22
—————————–
15:27:22.517    OS Version: Windows 6.1.7601 Service Pack 1
15:27:22.517    Number of processors: 1 586 0xD08
15:27:22.705    ComputerName: OWNER-PC  UserName: Owner
15:27:56.383    Initialize success
15:27:56.415    VM: initialized successfully
15:27:56.430    VM: Intel CPU virtualization not supported 
15:29:51.841    AVAST engine defs: 16030701
15:30:12.013    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
15:30:12.013    Disk 0 Vendor: TOSHIBA_MK4019GAX FA003E Size: 38154MB BusType: 3
15:30:12.185    Disk 0 MBR read successfully
15:30:12.201    Disk 0 MBR scan
15:30:12.216    Disk 0 Windows 7 default MBR code
15:30:12.248    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        38152 MB offset 2048
15:30:12.263    Disk 0 Boot: NTFS     code=2
15:30:12.341    Disk 0 scanning sectors +78137344
15:30:12.576    Disk 0 scanning C:\Windows\system32\drivers
15:30:24.071    Service scanning
15:30:55.126    Modules scanning
15:30:55.642    Disk 0 trace - called modules:
15:30:55.720    ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll intelide.sys PCIIDEX.SYS atapi.sys 
15:30:55.720    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x856062a0]
15:30:55.736    3 CLASSPNP.SYS[88bd259e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8518d030]
15:30:56.048    AVAST engine scan C:\Windows
15:30:57.408    AVAST engine scan C:\Windows\system32
15:33:59.060    AVAST engine scan C:\Windows\system32\drivers
15:34:16.852    AVAST engine scan C:\Users\Owner
15:35:00.158    AVAST engine scan C:\ProgramData
15:35:08.080    Disk 0 statistics 2062440/0/0 @ 7.38 MB/s
15:35:08.080    Scan finished successfully
15:36:26.518    Disk 0 MBR has been saved successfully to "C:\Users\Owner\Desktop\MBR.dat"
15:36:26.518    The log file has been saved successfully to "C:\Users\Owner\Desktop\aswMBR.txt"
 
 
Farbar Recovery Tool results:

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-03-2016 01
Ran by [removed] (administrator) on OWNER-PC (07-03-2016 15:50:19)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\…\Run: [nwiz] => nwiz.exe /installquiet
HKLM\…\Run: [NVHotkey] => rundll32.exe nvHotkey.dll,Start
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139768 2016-03-05] (AVAST Software)
HKLM\…\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\Run: [GoogleChromeAutoLaunch_721577D41E77D440C916E2687EBA0267] => C:\Program Files\Google\Chrome\Application\chrome.exe [874648 2016-03-01] (Google Inc.)
HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-03-05] (AVAST Software)
BootExecute: autocheck autochk * sdnclean.exe
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D085E1D7-5E5E-4A9E-8BF2-5C03200E1A17}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-03-05] (AVAST Software)
 
FireFox:
========
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-05] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-05] (Google Inc.)
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-03-05]
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.yahoo.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-03-05]
CHR Extension: (mention) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\agdbnpodkgflemjpckmcdgabbmefpfnb [2016-03-05]
CHR Extension: (Google Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-05]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-05]
CHR Extension: (Sprout Social) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\biailfjhlmalakjackgpekkbmljelldc [2016-03-05]
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-05]
CHR Extension: (Alexa Traffic Rank) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel [2016-03-05]
CHR Extension: (Circloscope Free (Inactives+)) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhcfgcecigkknnimiljlbcjmnbeeodhl [2016-03-05]
CHR Extension: (SEO SERP Workbench) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehbgolklgacemnfnmkkpgekngaaggjjl [2016-03-05]
CHR Extension: (Google Sheets) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-03-05]
CHR Extension: (Replies and more for Google+) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgmhgfecnmeljhchgcjlfldjiepcfpea [2016-03-05]
CHR Extension: (Google Docs Offline) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-07]
CHR Extension: (Yast - The World's Easiest Time Tracker) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gokleigpmoameleoajncmkmajedgfgbk [2016-03-05]
CHR Extension: (Avast Online Security) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-03-05]
CHR Extension: (Pin It Button) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-03-05]
CHR Extension: (Discussions button for Google Search™) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjiggoeheaondbmhmilpmbdkpgcjmdn [2016-03-05]
CHR Extension: (Seo Serp Manager) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jncpgpllflmbaaofhdmfamncdipmedjo [2016-03-05]
CHR Extension: (Social Statistics for Google Plus) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjjhofkehhgakpglgghlkccimpbgplfi [2016-03-05]
CHR Extension: (Evernote Web) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol [2016-03-05]
CHR Extension: (SearchLock) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\madakpajlmcpaodhfbekojajlhbdklol [2016-03-05]
CHR Extension: (Circloscope) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mechgkelogghhgmpmbpofjijifdppppl [2016-03-05]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-03-05]
CHR Extension: (Docs PDF/PowerPoint Viewer (by Google)) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn [2016-03-05]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-05]
CHR HKLM\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-03-05]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-03-05] (AVAST Software)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [32792 2016-03-05] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [91168 2016-03-05] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [91232 2016-03-05] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [58776 2016-03-05] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [812720 2016-03-05] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447848 2016-03-05] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [127432 2016-03-05] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [221240 2016-03-05] (AVAST Software)
R3 STAC97; C:\Windows\System32\drivers\STAC97.sys [273168 2005-03-10] (SigmaTel, Inc.)
R3 VSTHWICH; C:\Windows\System32\DRIVERS\VSTICH3.SYS [242176 2009-07-13] (Conexant Systems, Inc.)
R3 w29n51; C:\Windows\System32\DRIVERS\w29n51.sys [2209408 2007-02-08] (Intel® Corporation)
U3 aswMBR; \??\C:\Users\Owner\AppData\Local\Temp\aswMBR.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-03-07 15:50 - 2016-03-07 15:54 - 00010728 _____ C:\Users\Owner\Desktop\FRST.txt
2016-03-07 15:47 - 2016-03-07 15:50 - 00000000 ____D C:\FRST
2016-03-07 15:42 - 2016-03-07 15:43 - 01725440 _____ (Farbar) C:\Users\Owner\Desktop\FRST.exe
2016-03-07 15:36 - 2016-03-07 15:36 - 00001995 _____ C:\Users\Owner\Desktop\aswMBR.txt
2016-03-07 15:36 - 2016-03-07 15:36 - 00000512 _____ C:\Users\Owner\Desktop\MBR.dat
2016-03-07 15:18 - 2016-03-07 15:22 - 05198336 _____ (AVAST Software) C:\Users\Owner\Desktop\aswMBR.exe
2016-03-07 14:47 - 2009-06-10 13:39 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20160307-144754.backup
2016-03-07 14:33 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2016-03-07 14:19 - 2016-03-07 14:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2016-03-07 14:19 - 2016-03-07 14:19 - 00002141 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D; Start Center.lnk
2016-03-07 14:19 - 2016-03-07 14:19 - 00002129 _____ C:\Users\Public\Desktop\Spybot-S&D; Start Center.lnk
2016-03-07 14:19 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean.exe
2016-03-07 14:18 - 2016-03-07 14:50 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-03-07 14:18 - 2016-03-07 14:37 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2
2016-03-07 14:09 - 2016-03-07 14:11 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Owner\Downloads\spybot-2.4.exe
2016-03-07 14:05 - 2016-03-07 14:07 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Owner\Downloads\Unconfirmed 980893.crdownload
2016-03-07 11:04 - 2016-03-07 11:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2016-03-07 10:54 - 2016-03-07 10:54 - 00000000 ____D C:\Program Files\Microsoft Works
2016-03-07 10:50 - 2016-03-07 10:50 - 00000000 ____D C:\Program Files\Microsoft Visual Studio
2016-03-07 10:50 - 2016-03-07 10:50 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2016-03-07 10:46 - 2016-03-07 10:46 - 00000000 ____D C:\Windows\PCHEALTH
2016-03-07 10:32 - 2016-03-07 10:32 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 8
2016-03-07 10:25 - 2016-03-07 10:25 - 00000000 ____D C:\Users\Owner\AppData\Local\Microsoft Help
2016-03-07 10:24 - 2016-03-07 10:50 - 00000000 ____D C:\Program Files\Microsoft Office
2016-03-07 10:22 - 2016-03-07 10:22 - 00000000 __RHD C:\MSOCache
2016-03-05 17:03 - 2015-12-02 13:25 - 00247976 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-03-05 16:51 - 2016-03-05 16:51 - 00002223 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-05 16:51 - 2016-03-05 16:51 - 00002211 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-03-05 16:50 - 2016-03-07 15:57 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-05 16:50 - 2016-03-07 09:51 - 00000880 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-05 16:50 - 2016-03-05 16:51 - 00000000 ____D C:\Users\Owner\AppData\Local\Google
2016-03-05 16:50 - 2016-03-05 16:50 - 00000000 ____D C:\Program Files\Google
2016-03-05 16:49 - 2016-03-05 16:50 - 00000000 ____D C:\Users\Owner\AppData\Local\Deployment
2016-03-05 16:49 - 2016-03-05 16:49 - 00000000 ____D C:\Users\Owner\AppData\Local\Apps\2.0
2016-03-05 16:48 - 2016-03-07 11:25 - 00000000 ___SD C:\Users\Owner\AppData\LocalLow\Temp
2016-03-05 16:41 - 2016-03-05 16:41 - 00000000 ____D C:\Users\Owner\AppData\Roaming\AVAST Software
2016-03-05 16:40 - 2016-03-07 14:33 - 00000000 ____D C:\Program Files\Common Files\AV
2016-03-05 16:40 - 2016-03-05 16:40 - 00447848 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2016-03-05 16:40 - 2016-03-05 16:40 - 00221240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys
2016-03-05 16:40 - 2016-03-05 16:40 - 00002085 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-03-05 16:40 - 2016-03-05 16:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2016-03-05 16:40 - 2016-03-05 16:39 - 00812720 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2016-03-05 16:40 - 2016-03-05 16:39 - 00127432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-03-05 16:40 - 2016-03-05 16:39 - 00091232 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-03-05 16:40 - 2016-03-05 16:39 - 00091168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-03-05 16:40 - 2016-03-05 16:39 - 00058776 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-03-05 16:40 - 2016-03-05 16:39 - 00032792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-03-05 16:39 - 2016-03-05 16:39 - 00334280 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-03-05 16:39 - 2016-03-05 16:39 - 00052184 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-03-05 16:38 - 2016-03-05 16:38 - 00000000 ____D C:\ProgramData\AVAST Software
2016-03-05 16:38 - 2016-03-05 16:38 - 00000000 ____D C:\Program Files\AVAST Software
2016-02-11 02:38 - 2016-03-07 09:51 - 00011785 _____ C:\Windows\system32\nvModes.001
2016-02-11 02:38 - 2016-02-11 02:38 - 00011785 _____ C:\Windows\system32\nvModes.dat
2016-02-11 02:35 - 2016-02-11 02:35 - 00000000 ____D C:\Program Files\Sigmatel
2016-02-11 02:33 - 2014-05-14 08:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-02-11 02:33 - 2014-05-14 08:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-02-11 02:33 - 2014-05-14 08:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-02-11 02:33 - 2014-05-14 08:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-02-11 02:33 - 2014-05-14 08:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-02-11 02:33 - 2014-05-14 08:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-02-11 02:33 - 2014-05-14 08:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-02-11 02:32 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-02-11 02:32 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-02-11 02:31 - 2016-02-11 02:38 - 00050868 _____ C:\Windows\system32\nvapps.xml
2016-02-11 02:31 - 2016-02-11 02:36 - 00000000 ____D C:\Windows\nview
2016-02-11 02:31 - 2006-05-01 15:46 - 00180224 _____ (NVIDIA Corporation) C:\Windows\system32\nvudisp.exe
2016-02-11 02:31 - 2006-05-01 15:46 - 00016960 _____ C:\Windows\system32\nvdisp.nvu
2016-02-11 02:29 - 2007-02-12 12:41 - 02732032 _____ (Intel Corporation) C:\Windows\system32\Netw2r32.dll
2016-02-11 02:29 - 2007-02-12 12:40 - 00557056 _____ (Intel Corporation) C:\Windows\system32\Netw2c32.dll
2016-02-11 02:29 - 2007-02-08 14:51 - 02209408 _____ (Intel® Corporation) C:\Windows\system32\Drivers\w29n51.sys
2016-02-11 02:29 - 2006-05-01 15:46 - 07561216 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 05562368 _____ (NVIDIA Corporation) C:\Windows\system32\nvdisps.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 05419008 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglnt.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 05169152 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispsr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 04177920 _____ (NVIDIA Corporation) C:\Windows\system32\nvgames.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 03976704 _____ (NVIDIA Corporation) C:\Windows\system32\nv4_disp.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 03653280 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nv4_mini.sys
2016-02-11 02:29 - 2006-05-01 15:46 - 02908160 _____ (NVIDIA Corporation) C:\Windows\system32\nvvitvs.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 02859008 _____ (NVIDIA Corporation) C:\Windows\system32\nvmoblsr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 02846720 _____ (NVIDIA Corporation) C:\Windows\system32\nvvitvsr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 02240512 _____ (NVIDIA Corporation) C:\Windows\system32\nvgamesr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 01662976 _____ C:\Windows\system32\nvwdmcpl.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 01519616 _____ C:\Windows\system32\nwiz.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 01466368 _____ C:\Windows\system32\nview.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 01339392 _____ C:\Windows\system32\nvdspsch.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 01019904 _____ C:\Windows\system32\nvwimg.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00950272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpluir.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00876544 _____ (NVIDIA Corporation) C:\Windows\system32\nvmobls.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00786432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcplui.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 00466944 _____ C:\Windows\system32\nvshell.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00462848 _____ (NVIDIA Corporation) C:\Windows\system32\nvmccssr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00442368 _____ C:\Windows\system32\nvappbar.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 00425984 _____ C:\Windows\system32\keystone.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 00335872 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrses.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00327680 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsfr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00327680 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsar.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00323584 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsit.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00319488 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsptb.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00315392 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsru.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00311296 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsde.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00311296 _____ (NVIDIA Corporation) C:\Windows\system32\nvexpbar.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00303104 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrstr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00282624 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsar.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00282624 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsfr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00278528 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsit.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00278528 _____ (NVIDIA Corporation) C:\Windows\system32\nvrses.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00274432 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsde.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00266240 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsru.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00266240 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsptb.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00266240 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsja.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00262144 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsko.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00253952 _____ (NVIDIA Corporation) C:\Windows\system32\nvrstr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00229376 _____ (NVIDIA Corporation) C:\Windows\system32\nvmccs.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00221184 _____ (NVIDIA Corporation) C:\Windows\system32\nvrszhc.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00212992 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsja.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00196608 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsko.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00184320 _____ (NVIDIA Corporation) C:\Windows\system32\nvmccss.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00167936 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrszht.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00163840 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrszhc.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00143428 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc32.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 00122880 _____ (NVIDIA Corporation) C:\Windows\system32\nvrszht.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00098304 _____ C:\Windows\system32\nvapi.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00086016 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00081920 _____ (NVIDIA Corporation) C:\Windows\system32\nvwddi.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00073728 _____ C:\Windows\system32\nvtuicpl.cpl
2016-02-11 02:29 - 2006-05-01 15:46 - 00073728 _____ (NVIDIA Corporation) C:\Windows\system32\nvhotkey.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00069632 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.cpl
2016-02-11 02:29 - 2006-05-01 15:46 - 00045056 _____ (NVIDIA Corporation) C:\Windows\system32\nvmccsrs.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00035840 _____ (NVIDIA Corporation) C:\Windows\system32\nvcodins.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00035840 _____ (NVIDIA Corporation) C:\Windows\system32\nvcod.dll
2016-02-11 02:28 - 2016-02-11 02:28 - 00000000 ____D C:\dell
2016-02-11 02:28 - 2005-03-10 16:56 - 00273168 _____ (SigmaTel, Inc.) C:\Windows\system32\Drivers\STAC97.sys
2016-02-11 02:28 - 2004-07-20 10:14 - 00192512 _____ () C:\Windows\system32\stac97co.dll
2016-02-11 02:28 - 2004-07-20 10:14 - 00102481 _____ (SigmaTel Inc.) C:\Windows\system32\STAC97.cpl
2016-02-11 02:06 - 2016-02-11 02:06 - 00307248 __RSH C:\KXMGS
2016-02-11 02:06 - 2016-02-11 02:06 - 00000020 __RSH C:\win7.ld
2016-02-11 02:05 - 2016-03-07 11:23 - 00108824 _____ C:\Users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2016-02-11 02:05 - 2016-02-11 02:05 - 00000000 ____D C:\Users\Owner\Desktop\Office 2007
2016-02-11 00:27 - 2016-02-11 00:27 - 00001423 _____ C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-02-11 00:26 - 2016-02-11 02:38 - 00000000 ____D C:\Users\Owner\AppData\Local\VirtualStore
2016-02-11 00:26 - 2016-02-11 00:27 - 00000000 ____D C:\Users\Owner
2016-02-11 00:26 - 2016-02-11 00:26 - 00000020 ___SH C:\Users\Owner\ntuser.ini
2016-02-11 00:26 - 2016-02-11 00:26 - 00000000 _SHDL C:\Users\Owner\My Documents
2016-02-11 00:26 - 2016-02-11 00:26 - 00000000 _SHDL C:\Users\Owner\Documents\My Videos
2016-02-11 00:26 - 2016-02-11 00:26 - 00000000 _SHDL C:\Users\Owner\Documents\My Pictures
2016-02-11 00:26 - 2016-02-11 00:26 - 00000000 _SHDL C:\Users\Owner\Documents\My Music
2016-02-11 00:26 - 2010-11-20 16:47 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Media Center Programs
2016-02-11 00:14 - 2016-02-11 00:14 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-02-11 00:14 - 2016-02-11 00:14 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-02-11 00:13 - 2016-02-11 00:13 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2016-02-11 00:09 - 2016-02-11 00:26 - 00000000 ____D C:\Windows\Panther
2016-02-11 00:09 - 2016-02-11 00:09 - 00008192 __RSH C:\BOOTSECT.BAK
2016-02-11 00:09 - 2010-11-20 13:29 - 00383786 __RSH C:\bootmgr
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-03-07 15:17 - 2009-07-13 20:34 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-07 15:17 - 2009-07-13 20:34 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-07 10:54 - 2009-07-13 18:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-03-07 10:52 - 2009-07-13 20:52 - 00000000 ____D C:\Program Files\MSBuild
2016-03-07 10:50 - 2010-11-20 16:47 - 00000000 ____D C:\Windows\ShellNew
2016-03-07 10:29 - 2009-07-13 18:37 - 00000000 ____D C:\Program Files\Common Files\System
2016-03-07 10:29 - 2009-07-13 18:04 - 00000478 _____ C:\Windows\win.ini
2016-03-07 09:58 - 2010-11-20 13:01 - 00713888 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-07 09:58 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\inf
2016-03-07 09:51 - 2009-07-13 20:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-05 17:49 - 2009-07-13 18:37 - 00000000 __RHD C:\Users\Public\Libraries
2016-02-11 02:36 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\Help
2016-02-11 00:26 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\rescache
2016-02-11 00:16 - 2009-07-13 20:33 - 00266808 _____ C:\Windows\system32\FNTCACHE.DAT
2016-02-11 00:14 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\system32\sysprep
2016-02-11 00:11 - 2010-11-20 16:47 - 00000000 ____D C:\Windows\CSC
2016-02-11 00:09 - 2009-07-13 20:52 - 00028672 _____ C:\Windows\system32\config\BCD-Template
 
Some files in TEMP:
====================
C:\Users\Owner\AppData\Local\Temp\ose00000.exe
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2016-02-11 00:10
 
==================== End of FRST.txt ============================
 
 
 
Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by [removed] (2016-03-07 16:03:56)
Running from C:\Users\[removed]\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) (2016-02-11 08:26:11)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1118181184-975087432-3716450042-500 - Administrator - Disabled)
Guest (S-1-5-21-1118181184-975087432-3716450042-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1118181184-975087432-3716450042-1002 - Limited - Enabled)
Owner (S-1-5-21-1118181184-975087432-3716450042-1000 - Administrator - Enabled) => C:\Users\Owner
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Avast Free Antivirus (HKLM\…\Avast) (Version: 11.1.2253 - AVAST Software)
Google Chrome (HKLM\…\Google Chrome) (Version: 49.0.2623.75 - Google Inc.)
Google Update Helper (Version: 1.3.29.5 - Google Inc.) Hidden
Microsoft Office Professional Plus 2007 (HKLM\…\PROPLUS) (Version: 12.0.4518.1014 - Microsoft Corporation)
NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version:  - )
Spybot - Search & Destroy (HKLM\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {163BD7C7-89FD-4CD9-80FF-71166D6A3A26} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2016-03-05] (Google Inc.)
Task: {2C739677-D127-42D7-8B00-0EC7D58137DD} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-03-05] (AVAST Software)
Task: {374C8310-3D43-4B7D-9F8C-A39BA2889A24} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-03-05] (AVAST Software)
Task: {9E6AA07E-E182-4CD4-BE9B-1158B68ACBBC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2016-03-05] (Google Inc.)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2016-03-05 16:39 - 2016-03-05 16:39 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-03-05 16:39 - 2016-03-05 16:39 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-03-05 16:42 - 2016-03-05 16:42 - 02838016 _____ () C:\Program Files\AVAST Software\Avast\defs\16030500\algo.dll
2016-03-05 16:39 - 2016-03-05 16:39 - 00480760 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-03-07 09:55 - 2016-03-07 09:55 - 02838016 _____ () C:\Program Files\AVAST Software\Avast\defs\16030700\algo.dll
2016-03-07 14:01 - 2016-03-07 14:01 - 02838016 _____ () C:\Program Files\AVAST Software\Avast\defs\16030701\algo.dll
2016-03-05 16:39 - 2016-03-05 16:39 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2006-10-26 21:30 - 2006-10-26 21:30 - 00065312 _____ () C:\Program Files\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
2006-10-27 15:35 - 2006-10-27 15:35 - 00436512 _____ () C:\Program Files\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
2006-10-26 13:56 - 2006-10-26 13:56 - 00757008 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2016-03-07 14:18 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-03-07 14:18 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2016-03-07 14:18 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-03-07 14:18 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
2016-03-07 14:18 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files\Spybot - Search & Destroy 2\av\BDSmartDB.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
 
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE restricted site: HKU\.DEFAULT\…\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\…\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\…\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\…\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\…\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\…\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\…\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\…\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\…\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\…\123simsen.com -> www.123simsen.com
 
There are 7872 more sites.
 
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\123simsen.com -> www.123simsen.com
 
There are 7872 more sites.
 
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 18:04 - 2016-03-07 14:47 - 00451004 ____R C:\Windows\system32\Drivers\etc\hosts
 
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
 
There are 15472 more lines.
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1118181184-975087432-3716450042-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{4110083C-E392-4B05-8C25-8554933CA8E8}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service
 
==================== Restore Points =========================
 
11-02-2016 02:32:41 Windows Update
05-03-2016 17:02:47 Windows Update
07-03-2016 10:20:55 Installed Microsoft Office Professional Plus 2007
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (03/07/2016 11:29:23 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E.crt>with error: This operation returned because the timeout period expired.
.
 
Error: (03/07/2016 11:29:01 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E.crt>with error: This operation returned because the timeout period expired.
.
 
Error: (03/07/2016 11:29:01 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E.crt>with error: This operation returned because the timeout period expired.
.
 
Error: (03/07/2016 11:26:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt>with error: This operation returned because the timeout period expired.
.
 
Error: (03/07/2016 10:20:49 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.
 
 
Operation:
   Gathering Writer Data
 
Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {ca9095a7-4616-42e3-a1f6-8e351eb171b6}
 
Error: (03/07/2016 09:52:24 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (03/05/2016 05:02:50 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary zocgwvgn.
 
System Error:
The system cannot find the file specified.
.
 
Error: (03/05/2016 04:35:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (03/05/2016 05:46:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (02/11/2016 02:38:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
System errors:
=============
Error: (03/07/2016 03:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Application Experience service failed to start due to the following error: 
%%1053
 
Error: (03/07/2016 03:23:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AeLookupSvc service.
 
Error: (03/07/2016 02:21:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D; 2 Scanner Service service failed to start due to the following error: 
%%1053
 
Error: (03/07/2016 02:21:48 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D; 2 Scanner Service service to connect.
 
Error: (03/07/2016 02:20:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D; 2 Scanner Service service failed to start due to the following error: 
%%1053
 
Error: (03/07/2016 02:20:56 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D; 2 Scanner Service service to connect.
 
Error: (02/11/2016 02:37:50 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "OWNER-PC       :20" could not be registered on the interface with IP address 192.168.1.190.
The computer with the IP address 192.168.1.51 did not allow the name to be claimed by
this computer.
 
Error: (02/11/2016 02:37:50 AM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{D085E1D7-5E5E-4A9E-8BF2-5C03200E1A17} because another computer on the network has the same name.  The server could not start.
 
Error: (02/11/2016 02:37:43 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "OWNER-PC       :0" could not be registered on the interface with IP address 192.168.1.190.
The computer with the IP address 192.168.1.51 did not allow the name to be claimed by
this computer.
 
Error: (02/11/2016 02:32:23 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "OWNER-PC       :20" could not be registered on the interface with IP address 192.168.1.190.
The computer with the IP address 192.168.1.51 did not allow the name to be claimed by
this computer.
 
 
==================== Memory info =========================== 
 
Processor: Intel(R) Pentium(R) M processor 2.13GHz
Percentage of memory in use: 92%
Total physical RAM: 2047.47 MB
Available physical RAM: 153.68 MB
Total Virtual: 4094.94 MB
Available Virtual: 1495.58 MB
 
==================== Drives ================================
 
Drive c: (New Volume) (Fixed) (Total:37.26 GB) (Free:23.44 GB) NTFS ==>[drive with boot components (obtained from BCD)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 37.3 GB) (Disk ID: E929E929)
Partition 1: (Active) - (Size=37.3 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================

 

Post #2
Download Malwarebytes' Anti-Malware TO YOUR DESKTOP
  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"




    [external image: 0841859c-1a35-4dbd-b41a-e720629e3e22_zps]


  • On the Dashboard click on Update Now
  • Go to the Setting Tab
  • Under Setting go to Detection and Protection
  • Under PUP and PUM make sure both are set to show Treat Detections as Malware
  • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan


    After the restart once you are back at your desktop, open MBAM once more.
    Click on the History tab > Application Logs.
    Double click on the scan log which shows the Date and time of the scan just performed.
    Click 'Copy to Clipboard'
    Paste the contents of the clipboard into your reply
  • Exit Malwarebytes
~~~~~~~~~~~~~~~~~~~~

[external image: BY4dvz9.png]AdwCleaner
  • Please download AdwCleaner and save the file to your Desktop.
  • Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
  • Follow the prompts.
  • Click Scan.
  • Upon completion, click Report. A log (AdwCleaner[SX].txt) will open. Briefly check the log for anything you know to be legitimate.
  • Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
  • Follow the prompts and allow your computer to reboot.
  • After rebooting, a log (AdwCleaner[SX].txt) will open. Copy the contents of the log and paste in your next reply.
  • – File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


    [external image: thisisujrt.gif]
    Please download Junkware Removal Tool
    or from here http://downloads.malwarebytes.org/file/jrt
    to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
    ~~~~~~~~~~~``
    please post
    MBAM.txt
    AdwCleaner[CX].txt
    JRT.txt

Post #3

My system is slow, so posting replies one at a time as I get through them.  Thank you.  My CPU is at 100%.  Looks like svchost.exe is the culprit.  From what I am seeing virus is #1 to check for before checking other things.  It's fine in Safe Mode.  That's all I have figured out so far.  Here are the results for the MalwareBytes Scan.  It gave me a free premium trial.  No threats were detected.

 

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 3/8/2016
Scan Time: 4:21 PM
Logfile: 
Administrator: Yes
 
Version: 2.2.0.1024
Malware Database: v2016.03.08.08
Rootkit Database: v2016.02.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Owner
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 285033
Time Elapsed: 23 min, 9 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
Post #4

Adware Cleaner results

 

# AdwCleaner v5.101 - Logfile created 08/03/2016 at 17:29:32
# Updated 07/03/2016 by Xplode
# Database : 2016-03-08.1 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Desktop\AdwCleaner.exe
# Option : Clean
# Support : http://toolslib.net/forum
 
***** [ Services ] *****
 
 
***** [ Folders ] *****
 
[-] Folder Deleted : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel
[-] Folder Deleted : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\madakpajlmcpaodhfbekojajlhbdklol
 
***** [ Files ] *****
 
[-] File Deleted : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_faststone-capture.en.softonic.com_0.localstorage
[-] File Deleted : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_faststone-capture.en.softonic.com_0.localstorage-journal
 
***** [ DLLs ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Web browsers ] *****
 
[-] [C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : cknebhggccemgcnbidipinkifmmegdel
[-] [C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : madakpajlmcpaodhfbekojajlhbdklol
 
*************************
 
:: "Tracing" keys removed
:: Winsock settings cleared
 
*************************
 
C:\Program Files\AdwCleaner\AdwCleaner[C1].txt - [1546 bytes] - [08/03/2016 17:29:32]
C:\Program Files\AdwCleaner\AdwCleaner[S1].txt - [1601 bytes] - [08/03/2016 17:13:28]
 
########## EOF - C:\Program Files\AdwCleaner\AdwCleaner[C1].txt - [1720 bytes] ##########
Post #7

JRT results:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.3 (02.09.2016)
Operating System: Windows 7 Professional x86 
Ran by [removed] (Administrator) on Tue 03/08/2016 at 17:59:43.43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
File System: 19 
 
Failed to delete: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BZ1SH4MQ (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel (Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol (Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IJO3VJP (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3VXHB06S (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9I5M3UIW (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9VIRRB57 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F97RUPLS (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBJP1GFP (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLQZP00Z (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\prefetch\AVAST_FREE_ANTIVIRUS_SETUP[1]-38B4FE54.pf (File) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IJO3VJP (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3VXHB06S (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9I5M3UIW (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9VIRRB57 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BZ1SH4MQ (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F97RUPLS (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBJP1GFP (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLQZP00Z (Temporary Internet Files Folder) 
 
 
 
Registry: 1 
 
Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_721577D41E77D440C916E2687EBA0267 (Registry Value) 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 03/08/2016 at 18:57:51.79
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Post #9

It is the same.  CPU is at 100% and svchost.exe is going from 95 to 99%.  I did Google this and found many different fix lists and different things that worked for some.  The first thing to try was to find a virus, so I came here for help.  When the computer is clean, and it is still doing it, I guess I will know a virus didn't carry over.  I have not done the 3 things you listed above.  I can try those next when we are finished.  Then, if no success, I can move onto other things mentioned which were a MS Patch KB92789, BIOS set to compatible and not normal (but I don't have this option in my bios at all), take the battery out - unplug - hold down power button - put battery back in (I tried this one), look for a BIOS update, update drivers…

Post #11
I hope something works using the above tools.

Also please download Windows Repair (all in one) from here

[external image: step-4-tab.jpg]
Install the program then go to step 4 and create a new system restore point and new registry backup.

Go to Step 2 and allow it to run CheckDisk by clicking on Do It button:
[external image: p22001645.gif]



NEXT
On the the Start Repairs tab => Click the Start
[external image: start-repairs-tab.jpg]


Please ensure that ONLY items seen in the image below are ticked as indicated (they're all checked by default):
[external image: p22001647.gif]

Click on box next to the Restart System when Finished. Then click on Start.
Post #12

Hi there,  Sorry it took me so long, but it is so slow and I have been switching between safe mode and normal mode.  I wasn't able to run some scans, etc.  However, the issue has now been fixed.  I finally got sfc /scannow to run.  I also performed the disk check and had it fix errors.  The one from Windows, though, in the link you sent me above.  Is this different from what you just posted above this message?  I found the service causing the hog, which was Windows Update.  I did a Google search and ended up on a Reddit thread that linked to 2 different patches.  I installed both and the 2nd one worked for me.  Hooray!  Then, I blue screened, said because of ReadyBoostDriver… but, Windows installed 8 updates after that and everything is normal now.    Should I run the Windows Repair (all in one) posted above still?  Please, let me know.  Thank you so much for helping me clean this system.

Post #13
Could be it was all due to windows updates. In the past I've help reformat and it took all day long!

Let's do a fresh Farbar scan
  • Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the programme run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Post #14

FRST

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-03-2016 01
Ran by [removed] (administrator) on OWNER-PC (11-03-2016 18:50:33)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7137664 2016-03-09] (AVAST Software)
HKLM\…\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM\…\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\…\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\…\Run: [NVHotkey] => rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-03-05] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D085E1D7-5E5E-4A9E-8BF2-5C03200E1A17}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-03-05] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

FireFox:
========
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\hwc7yxl4.default
FF DefaultSearchEngine.US: Google
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Extension: Pin It button - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\hwc7yxl4.default\Extensions\[removed] [2016-03-11]
FF Extension: Share Button for Pinterest - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\hwc7yxl4.default\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2016-03-10]
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-03] [not signed]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-03-05]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-03-05]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.yahoo.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avast Online Security) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-03-05]
CHR Extension: (Pin It Button) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-03-05]
CHR Extension: (Discussions button for Google Search™) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjiggoeheaondbmhmilpmbdkpgcjmdn [2016-03-05]
CHR Extension: (Seo Serp Manager) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jncpgpllflmbaaofhdmfamncdipmedjo [2016-03-05]
CHR Extension: (Social Statistics for Google Plus) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjjhofkehhgakpglgghlkccimpbgplfi [2016-03-05]
CHR Extension: (SearchLock) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\madakpajlmcpaodhfbekojajlhbdklol [2016-03-08]
CHR Extension: (Circloscope) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mechgkelogghhgmpmbpofjijifdppppl [2016-03-05]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-03-05]
CHR Extension: (Docs PDF/PowerPoint Viewer (by Google)) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn [2016-03-05]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-05]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-03-05] (AVAST Software)
S2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [32792 2016-03-05] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [91168 2016-03-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [91232 2016-03-05] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [58776 2016-03-05] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [816304 2016-03-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447848 2016-03-05] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [127432 2016-03-05] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [221240 2016-03-05] (AVAST Software)
S3 eapihdrv; C:\Users\Owner\AppData\Local\Temp\ehdrv.sys [135760 2016-03-09] (ESET)
R3 STAC97; C:\Windows\System32\drivers\STAC97.sys [273168 2005-03-10] (SigmaTel, Inc.)
R3 VSTHWICH; C:\Windows\System32\DRIVERS\VSTICH3.SYS [242176 2009-07-13] (Conexant Systems, Inc.)
R3 w29n51; C:\Windows\System32\DRIVERS\w29n51.sys [2209408 2007-02-08] (Intel® Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-11 18:50 - 2016-03-11 18:51 - 00008958 _____ C:\Users\Owner\Desktop\FRST.txt
2016-03-11 18:49 - 2016-03-11 18:49 - 01725440 _____ (Farbar) C:\Users\Owner\Desktop\FRST.exe
2016-03-11 12:48 - 2016-03-11 12:48 - 00001100 _____ C:\Users\Owner\TBSettings.db
2016-03-10 21:12 - 2016-03-11 14:10 - 00000000 ____D C:\Users\Owner\Documents\Wynn
2016-03-10 13:31 - 2016-03-10 13:31 - 00000000 ____D C:\Windows\en
2016-03-10 13:30 - 2016-03-10 13:30 - 00001261 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2016-03-10 13:29 - 2016-03-10 13:29 - 00001330 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2016-03-10 13:29 - 2016-03-10 13:29 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2016-03-10 13:26 - 2016-03-10 13:29 - 00000000 ____D C:\Program Files\Windows Live
2016-03-10 13:23 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2016-03-10 13:23 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2016-03-10 13:23 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2016-03-10 13:23 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2016-03-10 13:21 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2016-03-10 13:19 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2016-03-10 13:04 - 2016-03-10 13:04 - 00000000 ____D C:\Users\Owner\AppData\Local\Windows Live
2016-03-10 13:03 - 2016-03-10 13:03 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2016-03-10 12:57 - 2016-03-10 12:58 - 93906308 _____ C:\Users\Owner\Downloads\12293560766.mov
2016-03-10 12:51 - 2016-03-10 12:53 - 00000000 ____D C:\ProgramData\NVIDIA
2016-03-10 12:49 - 2009-03-06 11:52 - 00453152 _____ (NVIDIA Corporation) C:\Windows\system32\nvuninst.exe
2016-03-10 12:29 - 2016-03-10 12:29 - 00139448 _____ C:\Windows\Minidump\031016-32312-01.dmp
2016-03-09 22:08 - 2016-03-09 22:09 - 00139448 _____ C:\Windows\Minidump\030916-49218-01.dmp
2016-03-09 22:07 - 2016-03-09 22:07 - 00003544 ____N C:\bootsqm.dat
2016-03-09 21:20 - 2016-03-09 21:20 - 00000000 ____D C:\Program Files\NirSoft
2016-03-09 20:50 - 2016-03-09 20:50 - 00139448 _____ C:\Windows\Minidump\030916-27812-01.dmp
2016-03-09 20:10 - 2016-03-10 12:29 - 00000000 ____D C:\Windows\Minidump
2016-03-09 20:10 - 2016-03-09 20:10 - 00139448 _____ C:\Windows\Minidump\030916-42734-01.dmp
2016-03-09 19:46 - 2016-03-09 19:54 - 00000000 ____D C:\Users\Owner\AppData\Local\Mozilla
2016-03-09 19:46 - 2016-03-09 19:48 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Mozilla
2016-03-09 19:45 - 2016-03-09 19:46 - 00001127 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-03-09 19:45 - 2016-03-09 19:46 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-03-09 19:00 - 2015-10-20 09:46 - 02955776 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-03-09 19:00 - 2015-10-20 09:46 - 02061824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-03-09 19:00 - 2015-10-20 09:46 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-03-09 19:00 - 2015-10-20 09:46 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-03-09 19:00 - 2015-10-20 09:46 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-03-09 19:00 - 2015-10-20 09:46 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-03-09 19:00 - 2015-10-20 09:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-03-09 19:00 - 2015-10-20 09:45 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-03-09 19:00 - 2015-10-20 09:45 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2016-03-09 19:00 - 2015-10-20 09:45 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-03-09 19:00 - 2015-10-20 09:45 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2016-03-09 17:15 - 2016-03-09 17:15 - 00000000 ____D C:\ee94062be083db52e02824dbefd168
2016-03-09 16:56 - 2016-03-07 22:39 - 01724466 _____ C:\Users\Owner\Desktop\report.xml
2016-03-09 14:48 - 2016-03-09 14:48 - 00000000 _____ C:\Users\Owner\Desktop\sfcdetails.txt
2016-03-09 14:47 - 2016-03-09 14:47 - 00000000 __RSH C:\MSDOS.SYS
2016-03-09 14:47 - 2016-03-09 14:47 - 00000000 __RSH C:\IO.SYS
2016-03-09 12:42 - 2012-08-21 12:12 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2016-03-09 12:30 - 2014-10-13 17:56 - 00136632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-03-09 12:30 - 2014-10-13 17:50 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-03-09 12:30 - 2014-10-13 17:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2016-03-09 12:30 - 2014-10-13 17:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-03-09 12:30 - 2014-10-13 17:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-03-09 12:30 - 2014-07-16 17:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-03-09 12:30 - 2014-07-16 17:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-03-09 12:30 - 2014-07-06 17:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-03-09 12:30 - 2014-05-29 23:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-03-09 12:30 - 2014-05-29 23:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-03-09 12:30 - 2014-05-29 23:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-03-09 12:30 - 2014-05-29 23:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-03-09 12:30 - 2014-04-11 18:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-03-09 12:30 - 2014-04-11 18:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-03-09 12:30 - 2014-04-11 18:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-03-09 12:30 - 2014-04-11 18:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-03-09 12:30 - 2014-04-11 18:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-03-09 12:30 - 2013-07-04 04:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-03-09 12:29 - 2013-02-26 21:05 - 00101720 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-03-09 12:29 - 2013-02-26 20:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-03-09 12:29 - 2013-02-26 20:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2016-03-09 12:29 - 2013-02-26 20:49 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-03-09 12:29 - 2013-02-26 20:49 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-03-09 11:58 - 2016-03-09 11:58 - 00000000 ____D C:\aad3da3fb66eeb456cb7c3
2016-03-09 11:09 - 2016-03-09 11:09 - 00000000 ____D C:\Program Files\ESET
2016-03-09 11:08 - 2016-03-09 11:08 - 02870984 _____ (ESET) C:\Users\Owner\Desktop\esetsmartinstaller_enu.exe
2016-03-09 11:01 - 2016-03-09 11:02 - 02032072 _____ (Bleeping Computer, LLC) C:\Users\Owner\Desktop\rkill.exe
2016-03-09 10:27 - 2016-03-09 10:30 - 00189352 _____ C:\TDSSKiller.3.1.0.9_09.03.2016_10.27.09_log.txt
2016-03-09 10:26 - 2016-03-09 10:26 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\Owner\Desktop\tdsskiller.exe
2016-03-09 03:15 - 2012-02-16 21:34 - 00826880 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2016-03-09 03:15 - 2012-02-16 20:14 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2016-03-09 03:15 - 2012-02-16 20:13 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys
2016-03-08 17:51 - 2016-03-08 17:51 - 01609216 _____ (Malwarebytes) C:\Users\Owner\Desktop\JRT.exe
2016-03-08 17:07 - 2016-03-08 17:29 - 00000000 ____D C:\Program Files\AdwCleaner
2016-03-08 16:58 - 2016-03-08 16:58 - 01524224 _____ C:\Users\Owner\Desktop\AdwCleaner.exe
2016-03-08 16:18 - 2016-03-08 17:37 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-03-08 16:13 - 2016-03-08 16:13 - 00001070 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-03-08 16:13 - 2016-03-08 16:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-03-08 16:13 - 2016-03-08 16:13 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-03-08 16:13 - 2016-03-08 16:13 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-03-08 16:13 - 2015-10-05 09:50 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-03-08 16:13 - 2015-10-05 09:50 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-03-08 16:13 - 2015-10-05 09:50 - 00023256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-03-08 13:10 - 2016-03-08 13:11 - 00000000 ____D C:\Users\Owner\AppData\Local\Adobe
2016-03-08 13:10 - 2016-03-08 13:10 - 00000000 ____D C:\ProgramData\Adobe
2016-03-08 12:39 - 2016-03-08 12:39 - 00000000 ____D C:\Program Files\MSECache
2016-03-08 11:05 - 2016-03-11 12:49 - 00002270 _____ C:\Users\Owner\fsc.db
2016-03-08 10:47 - 2016-03-08 10:47 - 00000000 ____D C:\Users\Owner\AppData\Roaming\FastStone
2016-03-08 10:47 - 2016-03-08 10:47 - 00000000 ____D C:\Users\Owner\AppData\Local\FastStone
2016-03-08 09:15 - 2016-03-08 09:15 - 00000000 ____D C:\Windows\pss
2016-03-07 23:00 - 2016-03-07 23:00 - 00198000 _____ C:\Windows\ntbtlog.txt
2016-03-07 17:17 - 2016-03-07 19:40 - 00000000 ____D C:\Users\Owner\Documents\Kristen
2016-03-07 16:31 - 2016-03-07 21:25 - 00007602 _____ C:\Users\Owner\AppData\Local\Resmon.ResmonCfg
2016-03-07 15:47 - 2016-03-11 18:50 - 00000000 ____D C:\FRST
2016-03-07 15:36 - 2016-03-07 15:36 - 00000512 _____ C:\Users\Owner\Desktop\MBR.dat
2016-03-07 15:18 - 2016-03-07 15:22 - 05198336 _____ (AVAST Software) C:\Users\Owner\Desktop\aswMBR.exe
2016-03-07 14:47 - 2009-06-10 13:39 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20160307-144754.backup
2016-03-07 14:33 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2016-03-07 14:19 - 2016-03-07 14:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2016-03-07 14:19 - 2016-03-07 14:19 - 00002141 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D; Start Center.lnk
2016-03-07 14:19 - 2016-03-07 14:19 - 00002129 _____ C:\Users\Public\Desktop\Spybot-S&D; Start Center.lnk
2016-03-07 14:19 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean.exe
2016-03-07 14:18 - 2016-03-07 20:30 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-03-07 14:18 - 2016-03-07 14:37 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2
2016-03-07 11:04 - 2016-03-07 11:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2016-03-07 10:54 - 2016-03-07 10:54 - 00000000 ____D C:\Program Files\Microsoft Works
2016-03-07 10:50 - 2016-03-07 10:50 - 00000000 ____D C:\Program Files\Microsoft Visual Studio
2016-03-07 10:50 - 2016-03-07 10:50 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2016-03-07 10:46 - 2016-03-07 10:46 - 00000000 ____D C:\Windows\PCHEALTH
2016-03-07 10:32 - 2016-03-07 10:32 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 8
2016-03-07 10:25 - 2016-03-07 17:32 - 00000000 ____D C:\Users\Owner\AppData\Local\Microsoft Help
2016-03-07 10:24 - 2016-03-07 10:50 - 00000000 ____D C:\Program Files\Microsoft Office
2016-03-07 10:22 - 2016-03-07 10:22 - 00000000 __RHD C:\MSOCache
2016-03-05 17:03 - 2015-12-02 13:25 - 00247976 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-03-05 16:50 - 2016-03-09 19:22 - 00000000 ____D C:\Program Files\Google
2016-03-05 16:50 - 2016-03-08 09:54 - 00000000 ____D C:\Users\Owner\AppData\Local\Google
2016-03-05 16:49 - 2016-03-05 16:50 - 00000000 ____D C:\Users\Owner\AppData\Local\Deployment
2016-03-05 16:49 - 2016-03-05 16:49 - 00000000 ____D C:\Users\Owner\AppData\Local\Apps\2.0
2016-03-05 16:48 - 2016-03-07 11:25 - 00000000 ___SD C:\Users\Owner\AppData\LocalLow\Temp
2016-03-05 16:41 - 2016-03-05 16:41 - 00000000 ____D C:\Users\Owner\AppData\Roaming\AVAST Software
2016-03-05 16:40 - 2016-03-09 12:36 - 00816304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2016-03-05 16:40 - 2016-03-09 12:32 - 00091168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2016-03-05 16:40 - 2016-03-07 14:33 - 00000000 ____D C:\Program Files\Common Files\AV
2016-03-05 16:40 - 2016-03-05 16:40 - 00447848 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2016-03-05 16:40 - 2016-03-05 16:40 - 00221240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys
2016-03-05 16:40 - 2016-03-05 16:40 - 00002085 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-03-05 16:40 - 2016-03-05 16:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2016-03-05 16:40 - 2016-03-05 16:39 - 00127432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-03-05 16:40 - 2016-03-05 16:39 - 00091232 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-03-05 16:40 - 2016-03-05 16:39 - 00058776 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-03-05 16:40 - 2016-03-05 16:39 - 00032792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-03-05 16:39 - 2016-03-05 16:39 - 00334280 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-03-05 16:39 - 2016-03-05 16:39 - 00052184 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-03-05 16:38 - 2016-03-05 16:38 - 00000000 ____D C:\ProgramData\AVAST Software
2016-03-05 16:38 - 2016-03-05 16:38 - 00000000 ____D C:\Program Files\AVAST Software
2016-02-11 02:38 - 2016-03-10 12:30 - 00011785 _____ C:\Windows\system32\nvModes.001
2016-02-11 02:38 - 2016-02-11 02:38 - 00011785 _____ C:\Windows\system32\nvModes.dat
2016-02-11 02:35 - 2016-02-11 02:35 - 00000000 ____D C:\Program Files\Sigmatel
2016-02-11 02:31 - 2016-02-11 02:36 - 00000000 ____D C:\Windows\nview
2016-02-11 02:29 - 2009-03-06 11:52 - 00797216 _____ (NVIDIA Corporation) C:\Windows\system32\nvcplui.exe
2016-02-11 02:29 - 2009-03-06 11:52 - 00420384 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.cpl
2016-02-11 02:29 - 2009-03-06 11:52 - 00096800 _____ (NVIDIA Corporation) C:\Windows\system32\nvhotkey.dll
2016-02-11 02:29 - 2007-02-12 12:41 - 02732032 _____ (Intel Corporation) C:\Windows\system32\Netw2r32.dll
2016-02-11 02:29 - 2007-02-12 12:40 - 00557056 _____ (Intel Corporation) C:\Windows\system32\Netw2c32.dll
2016-02-11 02:29 - 2007-02-08 14:51 - 02209408 _____ (Intel® Corporation) C:\Windows\system32\Drivers\w29n51.sys
2016-02-11 02:29 - 2006-05-01 15:46 - 05419008 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglnt.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 03976704 _____ (NVIDIA Corporation) C:\Windows\system32\nv4_disp.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 03653280 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nv4_mini.sys
2016-02-11 02:29 - 2006-05-01 15:46 - 01662976 _____ C:\Windows\system32\nvwdmcpl.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 01519616 _____ C:\Windows\system32\nwiz.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 01466368 _____ C:\Windows\system32\nview.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 01339392 _____ C:\Windows\system32\nvdspsch.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 01019904 _____ C:\Windows\system32\nvwimg.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00950272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpluir.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00466944 _____ C:\Windows\system32\nvshell.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00442368 _____ C:\Windows\system32\nvappbar.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 00425984 _____ C:\Windows\system32\keystone.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 00335872 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrses.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00327680 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsfr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00327680 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsar.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00323584 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsit.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00319488 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsptb.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00315392 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsru.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00311296 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsde.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00311296 _____ (NVIDIA Corporation) C:\Windows\system32\nvexpbar.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00303104 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrstr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00282624 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsar.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00282624 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsfr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00278528 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsit.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00278528 _____ (NVIDIA Corporation) C:\Windows\system32\nvrses.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00274432 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsde.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00266240 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsru.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00266240 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsptb.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00266240 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsja.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00262144 _____ (NVIDIA Corporation) C:\Windows\system32\nvrsko.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00253952 _____ (NVIDIA Corporation) C:\Windows\system32\nvrstr.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00221184 _____ (NVIDIA Corporation) C:\Windows\system32\nvrszhc.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00212992 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsja.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00196608 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrsko.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00167936 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrszht.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00163840 _____ (NVIDIA Corporation) C:\Windows\system32\nvwrszhc.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00143428 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc32.exe
2016-02-11 02:29 - 2006-05-01 15:46 - 00122880 _____ (NVIDIA Corporation) C:\Windows\system32\nvrszht.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00081920 _____ (NVIDIA Corporation) C:\Windows\system32\nvwddi.dll
2016-02-11 02:29 - 2006-05-01 15:46 - 00073728 _____ C:\Windows\system32\nvtuicpl.cpl
2016-02-11 02:29 - 2006-05-01 15:46 - 00035840 _____ (NVIDIA Corporation) C:\Windows\system32\nvcodins.dll
2016-02-11 02:28 - 2016-02-11 02:28 - 00000000 ____D C:\dell
2016-02-11 02:28 - 2005-03-10 16:56 - 00273168 _____ (SigmaTel, Inc.) C:\Windows\system32\Drivers\STAC97.sys
2016-02-11 02:28 - 2004-07-20 10:14 - 00192512 _____ () C:\Windows\system32\stac97co.dll
2016-02-11 02:28 - 2004-07-20 10:14 - 00102481 _____ (SigmaTel Inc.) C:\Windows\system32\STAC97.cpl
2016-02-11 02:06 - 2016-02-11 02:06 - 00307248 __RSH C:\KXMGS
2016-02-11 02:06 - 2016-02-11 02:06 - 00000020 __RSH C:\win7.ld
2016-02-11 02:05 - 2016-03-07 11:23 - 00108824 _____ C:\Users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2016-02-11 02:05 - 2016-02-11 02:05 - 00000000 ____D C:\Users\Owner\Desktop\Office 2007
2016-02-11 00:27 - 2016-02-11 00:27 - 00001423 _____ C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-02-11 00:26 - 2016-03-11 12:48 - 00000000 ____D C:\Users\Owner
2016-02-11 00:26 - 2016-03-11 10:41 - 00000000 ____D C:\Users\Owner\AppData\Local\VirtualStore
2016-02-11 00:26 - 2016-02-11 00:26 - 00000020 ___SH C:\Users\Owner\ntuser.ini
2016-02-11 00:26 - 2016-02-11 00:26 - 00000000 _SHDL C:\Users\Owner\My Documents
2016-02-11 00:26 - 2016-02-11 00:26 - 00000000 _SHDL C:\Users\Owner\Documents\My Videos
2016-02-11 00:26 - 2016-02-11 00:26 - 00000000 _SHDL C:\Users\Owner\Documents\My Pictures
2016-02-11 00:26 - 2016-02-11 00:26 - 00000000 _SHDL C:\Users\Owner\Documents\My Music
2016-02-11 00:26 - 2010-11-20 16:47 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Media Center Programs
2016-02-11 00:14 - 2016-02-11 00:14 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-02-11 00:14 - 2016-02-11 00:14 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-02-11 00:13 - 2016-02-11 00:13 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2016-02-11 00:09 - 2016-02-11 00:26 - 00000000 ____D C:\Windows\Panther
2016-02-11 00:09 - 2016-02-11 00:09 - 00008192 __RSH C:\BOOTSECT.BAK
2016-02-11 00:09 - 2010-11-20 13:29 - 00383786 __RSH C:\bootmgr

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-11 10:48 - 2009-07-13 20:34 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-11 10:48 - 2009-07-13 20:34 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-11 10:38 - 2009-07-13 20:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-10 19:18 - 2010-11-20 13:01 - 00782154 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-10 19:18 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\inf
2016-03-10 13:25 - 2009-07-13 18:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-03-10 10:35 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-03-08 11:05 - 2007-02-12 17:31 - 01111552 _____ C:\Users\Owner\FSCapture.exe
2016-03-08 11:05 - 2007-01-11 23:17 - 00168904 _____ C:\Users\Owner\Tips.db
2016-03-08 11:05 - 2007-01-11 22:55 - 00120863 _____ C:\Users\Owner\FSCaptureHelp.chm
2016-03-08 11:05 - 2007-01-03 11:49 - 00001192 _____ C:\Users\Owner\LicenseAgreement.txt
2016-03-08 11:05 - 2006-10-16 22:48 - 00000454 _____ C:\Users\Owner\Portable.db
2016-03-08 09:52 - 2009-07-13 20:37 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-03-07 22:15 - 2009-07-13 18:37 - 00000000 ____D C:\PerfLogs
2016-03-07 20:35 - 2009-07-13 20:33 - 00412432 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-07 10:52 - 2009-07-13 20:52 - 00000000 ____D C:\Program Files\MSBuild
2016-03-07 10:50 - 2010-11-20 16:47 - 00000000 ____D C:\Windows\ShellNew
2016-03-07 10:29 - 2009-07-13 18:37 - 00000000 ____D C:\Program Files\Common Files\System
2016-03-07 10:29 - 2009-07-13 18:04 - 00000478 _____ C:\Windows\win.ini
2016-03-05 17:49 - 2009-07-13 18:37 - 00000000 __RHD C:\Users\Public\Libraries
2016-02-11 02:36 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\Help
2016-02-11 00:26 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\rescache
2016-02-11 00:14 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\system32\sysprep
2016-02-11 00:11 - 2010-11-20 16:47 - 00000000 ____D C:\Windows\CSC
2016-02-11 00:09 - 2009-07-13 20:52 - 00028672 _____ C:\Windows\system32\config\BCD-Template

==================== Files in the root of some directories =======

2016-03-07 16:31 - 2016-03-07 21:25 - 0007602 _____ () C:\Users\Owner\AppData\Local\Resmon.ResmonCfg

Files to move or delete:
====================
C:\Users\Owner\FSCapture.exe


Some files in TEMP:
====================
C:\Users\Owner\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-02-11 00:10

==================== End of FRST.txt ============================

 

 

 

 

 

ADDITION

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by [removed] (2016-03-11 18:52:32)
Running from C:\Users\[removed]\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) (2016-02-11 08:26:11)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1118181184-975087432-3716450042-500 - Administrator - Disabled)
Guest (S-1-5-21-1118181184-975087432-3716450042-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1118181184-975087432-3716450042-1002 - Limited - Enabled)
Owner (S-1-5-21-1118181184-975087432-3716450042-1000 - Administrator - Enabled) => C:\Users\Owner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Avast Free Antivirus (HKLM\…\Avast) (Version: 11.1.2253 - AVAST Software)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
ESET Online Scanner v3 (HKLM\…\ESET Online Scanner) (Version:  - )
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\…\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM\…\PROPLUS) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (HKLM\…\{90120000-00B2-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 45.0 (x86 en-US) (HKLM\…\Mozilla Firefox 45.0 (x86 en-US)) (Version: 45.0 - Mozilla)
NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)
Spybot - Search & Destroy (HKLM\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Windows Live Essentials (HKLM\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {2C739677-D127-42D7-8B00-0EC7D58137DD} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-03-05] (AVAST Software)
Task: {374C8310-3D43-4B7D-9F8C-A39BA2889A24} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-03-05] (AVAST Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-03-05 16:39 - 2016-03-05 16:39 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-03-05 16:39 - 2016-03-05 16:39 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-03-10 15:18 - 2016-03-10 15:18 - 02838528 _____ () C:\Program Files\AVAST Software\Avast\defs\16031003\algo.dll
2016-03-05 16:39 - 2016-03-05 16:39 - 00480760 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-03-11 10:40 - 2016-03-11 10:40 - 02839552 _____ () C:\Program Files\AVAST Software\Avast\defs\16031101\algo.dll
2016-03-07 14:18 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-03-07 14:18 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2016-03-07 14:18 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-03-05 16:39 - 2016-03-05 16:39 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Owner\Desktop\report.xml:Qgrg2rf1Znaluncm1kfl1xla5h [67]
AlternateDataStreams: C:\Users\Owner\Desktop\report.xml:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\…\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\…\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\…\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\…\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\…\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\…\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\…\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\…\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\…\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\…\123simsen.com -> www.123simsen.com

There are 7872 more sites.

IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1118181184-975087432-3716450042-1000\…\123simsen.com -> www.123simsen.com

There are 7872 more sites.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 18:04 - 2016-03-07 14:47 - 00451004 ___RA C:\Windows\system32\Drivers\etc\hosts

127.0.0.1    www.007guard.com
127.0.0.1    007guard.com
127.0.0.1    008i.com
127.0.0.1    www.008k.com
127.0.0.1    008k.com
127.0.0.1    www.00hq.com
127.0.0.1    00hq.com
127.0.0.1    010402.com
127.0.0.1    www.032439.com
127.0.0.1    032439.com
127.0.0.1    www.0scan.com
127.0.0.1    0scan.com
127.0.0.1    1000gratisproben.com
127.0.0.1    www.1000gratisproben.com
127.0.0.1    1001namen.com
127.0.0.1    www.1001namen.com
127.0.0.1    100888290cs.com
127.0.0.1    www.100888290cs.com
127.0.0.1    www.100sexlinks.com
127.0.0.1    100sexlinks.com
127.0.0.1    10sek.com
127.0.0.1    www.10sek.com
127.0.0.1    www.1-2005-search.com
127.0.0.1    1-2005-search.com
127.0.0.1    123fporn.info
127.0.0.1    www.123fporn.info
127.0.0.1    123haustiereundmehr.com
127.0.0.1    www.123haustiereundmehr.com
127.0.0.1    123moviedownload.com
127.0.0.1    www.123moviedownload.com

There are 15472 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1118181184-975087432-3716450042-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{0720B5D6-FA5B-44AD-9447-538E5BE624CD}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{960A1098-02C7-4C48-9BC8-624EDE35130A}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{A5CAA76A-230B-451A-885F-16A197E7D957}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{579F8BF7-4B47-4EA6-B75F-C3E950892F6B}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{62553DA1-1639-43A8-8A3E-4E8D7EC38912}] => (Allow) LPort=2869
FirewallRules: [{7392F302-ACD6-4E75-ADB8-E4BEA897CA97}] => (Allow) LPort=1900
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service

==================== Restore Points =========================

10-03-2016 13:19:14 Installed DirectX
10-03-2016 13:21:04 Installed DirectX
10-03-2016 13:22:27 Installed DirectX
10-03-2016 13:26:30 WLSetup
10-03-2016 21:13:46 Installed Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/11/2016 10:39:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/10/2016 01:04:07 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {c0bb2864-1c32-40ee-a848-8a8c6d653e6a}

Error: (03/10/2016 12:53:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/10/2016 12:30:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/10/2016 10:38:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/09/2016 10:20:24 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to compile: PresentationFramework, Version=3.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil . Error code = 0x80070020

Error: (03/09/2016 10:11:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/09/2016 08:51:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/09/2016 08:11:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/09/2016 07:04:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (03/11/2016 10:40:34 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.

Error: (03/11/2016 10:40:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D; 2 Scanner Service service failed to start due to the following error:
%%1053

Error: (03/11/2016 10:40:26 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D; 2 Scanner Service service to connect.

Error: (03/11/2016 10:39:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D; 2 Scanner Service service failed to start due to the following error:
%%1053

Error: (03/11/2016 10:39:25 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D; 2 Scanner Service service to connect.

Error: (03/10/2016 08:38:39 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.

Error: (03/10/2016 02:24:40 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service.

Error: (03/10/2016 12:52:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D; 2 Scanner Service service failed to start due to the following error:
%%1053

Error: (03/10/2016 12:52:27 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D; 2 Scanner Service service to connect.

Error: (03/10/2016 12:29:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D; 2 Scanner Service service failed to start due to the following error:
%%1053


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) M processor 2.13GHz
Percentage of memory in use: 56%
Total physical RAM: 2047.47 MB
Available physical RAM: 888.64 MB
Total Virtual: 4094.94 MB
Available Virtual: 2784.43 MB

==================== Drives ================================

Drive c: (New Volume) (Fixed) (Total:37.26 GB) (Free:16.66 GB) NTFS ==>[drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 37.3 GB) (Disk ID: E929E929)
Partition 1: (Active) - (Size=37.3 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Post #15
This actually looks good.


Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


[external image: FRSTfix.JPG]

 

start
CreateRestorePoint:
CloseProcesses:
C:\Users\Owner\FSCapture.exe
C:\Users\Owner\AppData\Local\Temp\sqlite3.dll
EmptyTemp:
End


Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI