Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
This topic is locked
A friend has given me her Toshiba Satellite Notebook running Win7 32-bit with AVG Internet Security.
I ran aswMBR on C\:; after 3 hours it showed seven infections but when I tried to save the log, the dialog box to name and locate the log froze and eventually AVG deleted it and the aswMBR.exe file from the desktop.
I then checked how to disable AVG and went into its Advanced Settings to temporarialy disable AVG protection until a restart and it showed all services except the Firewall disabled. I then downloaded and ran (as Admin) aswMBR again, this time leaving it as a Quickscan. This still took over an hour and AVG still tried to block the program (I selected Allow). {I don't know how AVG is trying to block a file when it is disabled; obviously it is not fully disabled.} This time I only saw one infection. I saved the log and it appears below.
I then ran FRST and the two logs appear below.
Here is the aswMBR log:
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2016-04-25 21:31:18
-----------------------------
21:31:18.937 OS Version: Windows 6.1.7601 Service Pack 1
21:31:18.937 Number of processors: 8 586 0x1E05
21:31:18.937 ComputerName: JAN-PC UserName: jan
21:31:21.511 Initialize success
21:31:21.917 VM: initialized successfully
21:31:21.979 VM: Intel CPU supported virtualizedSuspended
21:31:23.972 VM: supported disk I/O iaStor.sys
21:38:06.451 AVAST engine defs: 16033102
21:38:14.298 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:38:14.298 Disk 0 Vendor: TOSHIBA_ GJ00 Size: 610480MB BusType: 3
21:38:15.280 Disk 0 MBR read successfully
21:38:15.280 Disk 0 MBR scan
21:38:15.280 Disk 0 Windows VISTA default MBR code
21:38:15.390 Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048
21:38:15.436 Disk 0 default boot code
21:38:15.483 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 596212 MB offset 3074048
21:38:15.546 Disk 0 Partition 3 00 17 Hidd HPFS/NTFS NTFS 12767 MB offset 1224116224
21:38:15.655 Disk 0 scanning sectors +1250263040
21:38:16.747 Disk 0 scanning C:\windows\system32\drivers
21:39:38.850 Service scanning
21:40:37.350 Modules scanning
21:40:37.366 Disk 0 trace - called modules:
21:40:37.490 ntkrnlpa.exe CLASSPNP.SYS disk.sys thpdrv.sys halmacpi.dll iaStor.sys
21:40:37.506 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x88b3f030]
21:40:37.522 3 CLASSPNP.SYS[843b559e] -> nt!IofCallDriver -> \Device\THPDRV1[0x88b3d7b8]
21:40:37.537 5 thpdrv.sys[8c1e999f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86fbf028]
21:40:40.267 AVAST engine scan C:\windows
21:43:33.553 AVAST engine scan C:\windows\system32
21:45:19.806 File: C:\windows\system32\csrsrv.dll **INFECTED** Win32:Aluroot-B [Rtk]
22:11:02.448 AVAST engine scan C:\windows\system32\drivers
22:14:50.240 AVAST engine scan C:\Users\jan
22:41:01.856 AVAST engine scan C:\ProgramData
22:54:04.386 Disk 0 statistics 3677370/0/0 @ 0.41 MB/s
22:54:04.402 Scan finished successfully
22:54:33.777 Disk 0 MBR has been saved successfully to "C:\Users\jan\Desktop\MBR.dat"
22:54:33.792 The log file has been saved successfully to "C:\Users\jan\Desktop\aswMBR-quickscan.txt"
Here is the FRST log:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-04-2016
Ran by jan (administrator) on JAN-PC (25-04-2016 22:57:33)
Running from C:\Users\jan\Desktop
Loaded Profiles: jan (Available Profiles: jan)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
() C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
() C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TRCMan\TRCMan.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
() C:\Program Files\TOSHIBA\FlashCards\Hotkey\TCrdKBB.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Panasonic Corporation) C:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
(InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcfgex.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [SVPWUTIL] => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe [352256 2010-02-23] (TOSHIBA CORPORATION)
HKLM\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [425984 2010-03-05] (TOSHIBA Electronics, Inc.)
HKLM\...\Run: [KeNotify] => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [34160 2009-12-26] (TOSHIBA CORPORATION)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [480608 2009-11-06] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [55160 2009-03-10] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [460088 2009-07-29] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [742712 2010-03-26] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8546848 2010-03-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [686624 2010-03-23] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1697064 2010-03-11] (Synaptics Incorporated)
HKLM\...\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
HKLM\...\Run: [ITSecMng] => C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-23] (TOSHIBA CORPORATION)
HKLM\...\Run: [TSleepSrv] => C:\Program Files\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [252728 2010-03-18] (TOSHIBA)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1328480 2010-04-07] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [611672 2010-02-06] (TOSHIBA Corporation)
HKLM\...\Run: [TRCMan] => C:\Program Files\TOSHIBA\TRCMan\TRCMan.exe [701752 2009-07-22] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [611672 2010-02-24] (TOSHIBA Corporation)
HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [163840 2009-10-20] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [22840 2009-11-12] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [30040 2010-03-04] (TOSHIBA Corporation)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2013\avgui.exe [4431848 2015-12-15] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2015-02-13] (Apple Inc.)
HKU\S-1-5-21-1116689551-3197699549-2733745341-1004\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-08-10] (Google Inc.)
HKU\S-1-5-21-1116689551-3197699549-2733745341-1004\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKU\S-1-5-21-1116689551-3197699549-2733745341-1004\...\MountPoints2: {d3b6c887-0a9d-11e6-9b8b-88ae1d4e4ded} - E:\SetupWi-Fi.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2011-03-15]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 6.0.lnk [2011-08-28]
ShortcutTarget: PHOTOfunSTUDIO 6.0.lnk -> C:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk [2011-05-10]
ShortcutTarget: WDDMStatus.lnk -> C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (Western Digital Technologies, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{4F152F5B-8AB2-4E74-B198-3B37DB97CDE1}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{9D580C77-0DA6-4606-A9CC-23C02E9163C7}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BC2E454A-D09F-4D66-B32A-4C46C707CECA}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Internet Explorer:
==================
HKU\S-1-5-21-1116689551-3197699549-2733745341-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com.au/
HKU\S-1-5-21-1116689551-3197699549-2733745341-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba.msn.com
SearchScopes: HKLM -> {F4ED0519-C584-4DDA-BE93-FA0B93D040F6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHPDF&pc=MATP&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1116689551-3197699549-2733745341-1004 -> {F4ED0519-C584-4DDA-BE93-FA0B93D040F6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHPDF&pc=MATP&src=IE-SearchBox
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-28] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-30] (Sun Microsystems, Inc.)
BHO: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2010-03-20] (<TOSHIBA>)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-28] (Google Inc.)
Toolbar: HKU\S-1-5-21-1116689551-3197699549-2733745341-1004 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-28] (Google Inc.)
Toolbar: HKU\S-1-5-21-1116689551-3197699549-2733745341-1004 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
FireFox:
========
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-07] (Google, Inc.)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2010-08-30] (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2010-08-30] (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-19] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-03-15] [not signed]
FF HKU\S-1-5-21-1116689551-3197699549-2733745341-1004\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-08]
CHR Extension: (GetFormsOnline) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdbpjflelnapbhcfafncmhkhihdibegl [2016-04-12]
CHR Extension: (MapsGalaxy) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdfmglngfjjacekhjbfdemgdkklojnnh [2015-09-18]
CHR Extension: (Google Search) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-12]
CHR Extension: (Gmail) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-13]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgfws; C:\Program Files\AVG\AVG2013\avgfws.exe [1442344 2015-12-15] (AVG Technologies CZ, s.r.o.)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4948456 2015-10-05] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-11-20] (AVG Technologies CZ, s.r.o.)
R2 cfWiMAXService; C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [185712 2010-01-29] (TOSHIBA CORPORATION)
R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-11] (TOSHIBA CORPORATION)
S3 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [238328 2009-12-04] (WildTangent, Inc.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
S3 MSSQL$MSSMLBIZ; c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
S3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [57216 2011-07-11] (TOSHIBA Corporation)
R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [189808 2010-04-07] (TOSHIBA Corporation)
R3 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [111960 2010-02-06] (TOSHIBA Corporation)
R3 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [685424 2010-02-24] (TOSHIBA Corporation)
R2 WDDMService; C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [238592 2011-03-09] (WDC) [File not signed]
R2 WDFME; C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [1060864 2011-03-09] () [File not signed]
R2 WDSC; C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [484352 2011-03-09] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 acpials; C:\windows\System32\DRIVERS\acpials.sys [7680 2009-07-14] (Microsoft Corporation)
R1 Avgfwfd; C:\windows\System32\DRIVERS\avgfwd6x.sys [66008 2015-06-03] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\windows\System32\DRIVERS\avgidshx.sys [122320 2015-05-21] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\windows\System32\DRIVERS\avgidsshimx.sys [32672 2015-11-24] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\windows\System32\DRIVERS\avgldx86.sys [172856 2014-11-03] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\windows\System32\DRIVERS\avglogx.sys [278992 2015-05-21] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\windows\System32\DRIVERS\avgmfx86.sys [159648 2016-03-03] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\windows\System32\DRIVERS\avgrkx86.sys [39224 2013-10-23] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\windows\System32\DRIVERS\avgtdix.sys [191440 2015-05-26] (AVG Technologies CZ, s.r.o.)
S3 BVRPMPR5; C:\windows\system32\drivers\BVRPMPR5.SYS [49904 2010-02-18] (Avanquest Software) [File not signed]
R3 enecirhid; C:\windows\System32\DRIVERS\enecirhid.sys [11776 2009-05-20] (ENE TECHNOLOGY INC.)
R3 enecirhidma; C:\windows\System32\DRIVERS\enecirhidma.sys [5632 2008-04-25] (ENE TECHNOLOGY INC.)
R0 LPCFilter; C:\windows\System32\DRIVERS\LPCFilter.sys [36208 2009-07-31] (COMPAL ELECTRONIC INC.)
R3 mod7700; C:\windows\System32\Drivers\dvb7700all.sys [626688 2009-06-12] (DiBcom)
R2 TVALZFL; C:\windows\System32\DRIVERS\TVALZFL.sys [12920 2009-06-20] (TOSHIBA Corporation)
S3 Tosrfcom; no ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-25 22:57 - 2016-04-25 22:59 - 00021455 _____ C:\Users\jan\Desktop\FRST.txt
2016-04-25 22:55 - 2016-04-25 22:57 - 00000000 ____D C:\FRST
2016-04-25 22:54 - 2016-04-25 22:54 - 00002399 _____ C:\Users\jan\Desktop\aswMBR-quickscan.txt
2016-04-25 22:54 - 2016-04-25 22:54 - 00000512 _____ C:\Users\jan\Desktop\MBR.dat
2016-04-25 21:28 - 2016-04-25 21:28 - 05198336 _____ (AVAST Software) C:\Users\jan\Desktop\aswMBR.exe
2016-04-25 14:40 - 2016-04-25 14:40 - 01726464 _____ (Farbar) C:\Users\jan\Desktop\FRST.exe
2016-04-22 09:17 - 2016-04-22 09:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2016-04-19 16:26 - 2016-02-03 04:48 - 00376320 _____ (Microsoft Corporation) C:\windows\system32\rpcss.dll
2016-04-19 16:25 - 2016-04-01 04:41 - 00346320 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2016-04-19 16:25 - 2016-03-31 10:03 - 20352512 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2016-04-19 16:25 - 2016-03-31 10:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2016-04-19 16:25 - 2016-03-31 10:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2016-04-19 16:25 - 2016-03-31 09:53 - 00496640 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2016-04-19 16:25 - 2016-03-31 09:52 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2016-04-19 16:25 - 2016-03-31 09:52 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2016-04-19 16:25 - 2016-03-31 09:52 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2016-04-19 16:25 - 2016-03-31 09:52 - 00047616 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2016-04-19 16:25 - 2016-03-31 09:51 - 02285056 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2016-04-19 16:25 - 2016-03-31 09:48 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2016-04-19 16:25 - 2016-03-31 09:48 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2016-04-19 16:25 - 2016-03-31 09:46 - 00476160 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2016-04-19 16:25 - 2016-03-31 09:45 - 00663552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2016-04-19 16:25 - 2016-03-31 09:45 - 00620032 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2016-04-19 16:25 - 2016-03-31 09:45 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2016-04-19 16:25 - 2016-03-31 09:45 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2016-04-19 16:25 - 2016-03-31 09:41 - 00667648 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2016-04-19 16:25 - 2016-03-31 09:38 - 00416256 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2016-04-19 16:25 - 2016-03-31 09:34 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2016-04-19 16:25 - 2016-03-31 09:33 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2016-04-19 16:25 - 2016-03-31 09:31 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2016-04-19 16:25 - 2016-03-31 09:31 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2016-04-19 16:25 - 2016-03-31 09:30 - 04611072 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2016-04-19 16:25 - 2016-03-31 09:30 - 00279040 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2016-04-19 16:25 - 2016-03-31 09:29 - 00130048 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2016-04-19 16:25 - 2016-03-31 09:24 - 00230400 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2016-04-19 16:25 - 2016-03-31 09:23 - 02056192 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2016-04-19 16:25 - 2016-03-31 09:23 - 00693248 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2016-04-19 16:25 - 2016-03-31 09:23 - 00689664 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2016-04-19 16:25 - 2016-03-31 09:22 - 01155072 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2016-04-19 16:25 - 2016-03-31 09:21 - 13811712 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2016-04-19 16:25 - 2016-03-31 09:05 - 02121216 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2016-04-19 16:25 - 2016-03-31 09:02 - 01311744 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2016-04-19 16:25 - 2016-03-31 09:00 - 00710144 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2016-04-19 16:25 - 2016-03-18 08:36 - 03998952 _____ (Microsoft Corporation) C:\windows\system32\ntkrnlpa.exe
2016-04-19 16:25 - 2016-03-18 08:36 - 03943144 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2016-04-19 16:25 - 2016-03-18 08:36 - 00137960 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2016-04-19 16:25 - 2016-03-18 08:36 - 00067304 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2016-04-19 16:25 - 2016-03-18 08:33 - 01310528 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2016-04-19 16:25 - 2016-03-18 08:30 - 00400896 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2016-04-19 16:25 - 2016-03-18 08:30 - 00171520 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2016-04-19 16:25 - 2016-03-18 08:30 - 00171008 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2016-04-19 16:25 - 2016-03-18 08:30 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2016-04-19 16:25 - 2016-03-18 08:30 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2016-04-19 16:25 - 2016-03-18 08:30 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2016-04-19 16:25 - 2016-03-18 08:29 - 00655360 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2016-04-19 16:25 - 2016-03-18 08:29 - 00251392 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2016-04-19 16:25 - 2016-03-18 08:29 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
2016-04-19 16:25 - 2016-03-18 08:29 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2016-04-19 16:25 - 2016-03-18 08:29 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2016-04-19 16:25 - 2016-03-18 08:28 - 01414144 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll
2016-04-19 16:25 - 2016-03-18 08:27 - 00260608 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2016-04-19 16:25 - 2016-03-18 08:27 - 00223232 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2016-04-19 16:25 - 2016-03-18 08:27 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2016-04-19 16:25 - 2016-03-18 08:27 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2016-04-19 16:25 - 2016-03-18 08:26 - 01062400 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2016-04-19 16:25 - 2016-03-18 08:26 - 00872448 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2016-04-19 16:25 - 2016-03-18 08:26 - 00553984 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2016-04-19 16:25 - 2016-03-18 08:26 - 00294400 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2016-04-19 16:25 - 2016-03-18 08:25 - 00038912 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2016-04-19 16:25 - 2016-03-18 08:25 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00644096 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 08:24 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 07:42 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2016-04-19 16:25 - 2016-03-18 07:42 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2016-04-19 16:25 - 2016-03-18 07:42 - 00029696 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2016-04-19 16:25 - 2016-03-18 07:42 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2016-04-19 16:25 - 2016-03-18 07:41 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2016-04-19 16:25 - 2016-03-18 07:36 - 00271360 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2016-04-19 16:25 - 2016-03-18 07:35 - 00262656 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2016-04-19 16:25 - 2016-03-18 07:30 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2016-04-19 16:25 - 2016-03-18 07:30 - 00124416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2016-04-19 16:25 - 2016-03-18 07:30 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2016-04-19 16:25 - 2016-03-18 07:29 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2016-04-19 16:25 - 2016-03-18 07:29 - 00036352 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2016-04-19 16:25 - 2016-03-18 07:29 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2016-04-19 16:25 - 2016-03-18 07:29 - 00015872 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2016-04-19 16:25 - 2016-03-18 07:29 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 07:29 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 07:29 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-04-19 16:25 - 2016-03-18 07:29 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-04-19 16:25 - 2016-03-17 04:28 - 00176128 _____ (Microsoft Corporation) C:\windows\system32\msorcl32.dll
2016-04-19 16:25 - 2016-03-17 04:28 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\mtxoci.dll
2016-04-19 16:24 - 2016-04-05 03:54 - 00034024 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-04-19 16:24 - 2016-04-05 03:42 - 00957952 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-04-19 16:24 - 2016-04-02 23:07 - 01218048 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-04-19 16:24 - 2016-03-30 03:35 - 02397184 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2016-04-19 16:24 - 2016-03-24 00:02 - 00177664 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2016-04-19 16:24 - 2016-03-18 04:04 - 00560640 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-04-19 16:24 - 2016-03-18 04:04 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-04-19 16:24 - 2016-03-18 04:04 - 00232960 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-04-19 16:24 - 2016-03-18 04:04 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-04-19 16:24 - 2016-03-16 09:53 - 00566272 _____ (Microsoft Corporation) C:\windows\system32\samsrv.dll
2016-04-19 16:24 - 2016-03-16 09:53 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\samlib.dll
2016-04-19 16:24 - 2016-03-12 04:35 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2016-04-19 16:24 - 2016-03-07 04:38 - 01240576 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2016-04-19 16:24 - 2016-03-07 04:38 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-25 22:19 - 2012-08-17 11:40 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-04-25 22:14 - 2009-07-14 14:34 - 00019248 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-25 22:14 - 2009-07-14 14:34 - 00019248 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-25 22:08 - 2011-08-10 15:40 - 00000886 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-25 21:25 - 2009-07-14 12:37 - 00000000 ____D C:\windows\tracing
2016-04-25 21:24 - 2009-07-14 12:37 - 00000000 ____D C:\windows\inf
2016-04-25 20:27 - 2011-02-25 17:23 - 00000000 ____D C:\ProgramData\MFAData
2016-04-25 14:27 - 2011-08-10 15:40 - 00000882 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-25 14:27 - 2011-05-03 11:02 - 00065536 _____ C:\windows\system32\Ikeext.etl
2016-04-25 14:27 - 2010-07-11 06:44 - 00000000 ____D C:\ProgramData\NVIDIA
2016-04-25 14:27 - 2009-07-14 14:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-04-25 14:04 - 2012-03-25 14:16 - 00155136 ___SH C:\Users\jan\Desktop\Thumbs.db
2016-04-22 09:17 - 2013-03-03 11:56 - 00000946 _____ C:\Users\Public\Desktop\AVG 2013.lnk
2016-04-21 15:21 - 2009-07-14 12:37 - 00000000 ____D C:\windows\rescache
2016-04-20 09:11 - 2010-03-30 15:07 - 00945770 _____ C:\windows\system32\PerfStringBackup.INI
2016-04-20 09:05 - 2009-07-14 14:33 - 00432552 _____ C:\windows\system32\FNTCACHE.DAT
2016-04-20 08:59 - 2014-12-11 06:56 - 00000000 ____D C:\windows\system32\appraiser
2016-04-19 18:59 - 2013-08-14 16:45 - 00000000 ____D C:\windows\system32\MRT
2016-04-19 18:52 - 2011-03-07 14:55 - 132539272 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2016-04-19 17:03 - 2011-05-31 12:36 - 00000000 ____D C:\Users\jan\AppData\Local\Google
2016-04-12 09:09 - 2012-09-06 08:27 - 00002152 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-04-12 09:09 - 2012-09-06 08:27 - 00002140 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-04-09 11:19 - 2012-06-03 15:38 - 00797376 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2016-04-09 11:19 - 2011-06-24 11:56 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2014-06-26 17:04 - 2014-06-26 17:04 - 6010880 _____ () C:\Program Files\GUTC16C.tmp
2015-05-18 10:31 - 2015-05-18 10:31 - 6420480 _____ () C:\Program Files\GUTFA66.tmp
2011-03-07 17:29 - 2011-11-22 08:55 - 0024617 _____ () C:\Users\jan\AppData\Roaming\Comma Separated Values (Windows).ADR
2012-06-05 17:13 - 2012-06-05 17:13 - 0003584 _____ () C:\Users\jan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-02-25 16:26 - 2011-03-15 10:40 - 0001118 _____ () C:\ProgramData\hpzinstall.log
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-04-21 15:14
==================== End of FRST.txt ============================
And finally here is the Additions log:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:18-04-2016
Ran by jan (2016-04-25 22:59:44)
Running from C:\Users\jan\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) (2011-02-25 01:48:47)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1116689551-3197699549-2733745341-500 - Administrator - Disabled)
Guest (S-1-5-21-1116689551-3197699549-2733745341-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1116689551-3197699549-2733745341-1006 - Limited - Enabled)
jan (S-1-5-21-1116689551-3197699549-2733745341-1004 - Administrator - Enabled) => C:\Users\jan
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG Internet Security 2013 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: AVG update module (Disabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG update module (Disabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
AS: AVG Internet Security 2013 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG update module (Disabled) {757AB44A-78C2-7D1A-E37F-CA42A037B368}
FW: AVG Internet Security 2013 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
Adobe Acrobat Reader DC (HKLM\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 21.0.0.213 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E1DB0812-2D60-43DB-AE09-6C7027D93B28}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AVG 2013 (HKLM\...\AVG) (Version: 2013.0.3556 - AVG Technologies)
AVG 2013 (Version: 13.0.3556 - AVG Technologies) Hidden
AVG 2013 (Version: 13.0.4477 - AVG Technologies) Hidden
Bejeweled 2 Deluxe (Version: 2.2.0.82 - WildTangent) Hidden
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v7.10.10(T) - TOSHIBA CORPORATION)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.42 - Broadcom Corporation)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
Business Contact Manager for Outlook 2007 SP2 (HKLM\...\Business Contact Manager) (Version: 3.0.8619.1 - Microsoft Corporation)
Business Contact Manager for Outlook 2007 SP2 (Version: 3.0.8619.1 - Microsoft Corporation) Hidden
C5300 (Version: 130.0.365.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Chuzzle Deluxe (Version: 2.2.0.82 - WildTangent) Hidden
Corel WinDVD (HKLM\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.822 - Corel Inc.)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 130.0.465.000 - Hewlett-Packard) Hidden
Direct DiscRecorder (Version: 1.00.0000 - Corel Corporation) Hidden
DVD MovieFactory for TOSHIBA (HKLM\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)
DVD MovieFactory for TOSHIBA (Version: 7.0.0 - Corel Corporation) Hidden
ENE CIR Receiver Driver (HKLM\...\D751CB2FD39EE07639D08542EEF9BF77AD1D9696) (Version: 2.7.4.1 - ENE)
Escape Rosecliff Island (Version: 2.2.0.82 - WildTangent) Hidden
FATE - The Traitor Soul (Version: 2.2.0.82 - WildTangent) Hidden
Final Drive Nitro (Version: 2.2.0.82 - WildTangent) Hidden
Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7210.1528 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.29.5 - Google Inc.) Hidden
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hewlett-Packard ACLM.NET v1.1.0.0 (Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart C5300 All-In-One Driver Software 13.0 Rel. 4 (HKLM\...\{6FA29B87-FED3-45A1-8A95-2FDEE0F6DD18}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Product Detection (HKLM\...\{A436F67F-687E-4736-BD2B-537121A804CF}) (Version: 11.14.0001 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden
iCloud (HKLM\...\{760BB327-3973-4608-85C8-88162E2FF3B6}) (Version: 4.0.6.28 - Apple Inc.)
Intel® Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.7.1002 - Intel Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
iTunes (HKLM\...\{3A9FE6B1-EE7F-40AC-B831-AC7C9ABB58A0}) (Version: 12.1.1.4 - Apple Inc.)
Java™ 6 Update 17 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216017FF}) (Version: 6.0.170 - Sun Microsystems, Inc.)
Jewel Quest 3 (Version: 2.2.0.82 - WildTangent) Hidden
JMicron Flash Media Controller Driver (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.44.1 - JMicron Technology Corp.)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 (HKLM\...\Microsoft SQL Server 10 Release) (Version: - Microsoft Corporation)
Microsoft SQL Server 2008 Browser (HKLM\...\{C688457E-03FD-4941-923B-A27F4D42A7DD}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files (HKLM\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1}) (Version: 9.0.30729.4974 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 (HKLM\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - ENU (HKLM\...\Microsoft Visual C++ 2010 Express - ENU) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Service Pack 1 (HKLM\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller Driver 260.51 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 260.51 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 260.51 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 260.51 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.61.39 - NVIDIA Corporation)
NVIDIA Graphics Driver 260.51 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 260.51 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
Penguins! (Version: 2.2.0.82 - WildTangent) Hidden
PHOTOfunSTUDIO 6.0 (HKLM\...\{B62A8A6F-5E48-4336-BF13-1632D5921872}) (Version: 6.00.135 - Panasonic Corporation)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (Version: 2.2.0.82 - WildTangent) Hidden
PS_AIO_04_C5300_Software_Min (Version: 130.0.365.000 - Hewlett-Packard) Hidden
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.20.503.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6069 - Realtek Semiconductor Corp.)
Revo Uninstaller Pro 2.5.3 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 2.5.3 - VS Revo Group, Ltd.)
Scan (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Service Pack 1 for SQL Server 2008 (KB968369) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
SmartWebPrinting (Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Status (Version: 130.0.469.000 - Hewlett-Packard) Hidden
Super LoiLoScope WebShortcut (HKLM\...\{AC589470-884E-4E15-96D8-437780F8185D}) (Version: 1.0.0 - LoiLo)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.13 - TOSHIBA CORPORATION)
TOSHIBA ConfigFree (HKLM\...\{607BE7BF-7C28-4ADB-A4A0-385962B901C3}) (Version: 8.0.28 - TOSHIBA Corporation)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.2 - TOSHIBA Corporation)
TOSHIBA DVD PLAYER (HKLM\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 3.01.2.12-A - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM\...\InstallShield_{53536479-DFB0-47ED-9D10-43F3708C222D}) (Version: 1.2.11.0 - TOSHIBA Corporation)
TOSHIBA Face Recognition (HKLM\...\InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}) (Version: 3.1.3.32 - TOSHIBA Corporation)
TOSHIBA Flash Cards Support Utility (HKLM\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.0.6C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (HKLM\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.26C - TOSHIBA CORPORATION)
TOSHIBA HDD Protection (HKLM\...\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.2.0.4 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (HKLM\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.0.6 - TOSHIBA Corporation)
TOSHIBA Media Controller (HKLM\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.80.3 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.5.10 - TOSHIBA CORPORATION)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.6.0.0 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 - TOSHIBA Corporation)
TOSHIBA ReelTime (HKLM\...\InstallShield_{B894522E-C079-4DC8-A305-30BA6E2F4459}) (Version: 1.6.06.32 - TOSHIBA Corporation)
TOSHIBA Remote Control Manager (HKLM\...\{FEB650EB-7639-444E-9FC2-C33EE6ED1A37}) (Version: 3.0.1.0 - TOSHIBA CORPORATION)
TOSHIBA Service Station (HKLM\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.14 - TOSHIBA)
TOSHIBA Sleep Utility (HKLM\...\{654F7484-88C5-46DC-AB32-C66BCB0E2102}) (Version: 1.4.1.1 - TOSHIBA Corporation)
TOSHIBA Speech System Applications (HKLM\...\{EE033C1F-443E-41EC-A0E2-559B539A4E4D}) (Version: 1.00.2518 - )
TOSHIBA Speech System SR Engine(U.S.) Version1.0 (HKLM\...\{008D69EB-70FF-46AB-9C75-924620DF191A}) (Version: - )
TOSHIBA Speech System TTS Engine(U.S.) Version1.0 (HKLM\...\{3FBF6F99-8EC6-41B4-8527-0A32241B5496}) (Version: - )
TOSHIBA Supervisor Password (HKLM\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.9C - TOSHIBA CORPORATION)
TOSHIBA Value Added Package (HKLM\...\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}) (Version: 1.3.4 - TOSHIBA Corporation)
TrayApp (Version: 130.0.422.000 - Hewlett-Packard) Hidden
UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden
Utility Common Driver (Version: 1.0.52.1C - TOSHIBA) Hidden
Virtual Villagers - The Secret City (Version: 2.2.0.82 - WildTangent) Hidden
WD SmartWare (HKLM\...\{BC3804E5-77CC-47A0-8BD5-797355A26BA3}) (Version: 1.4.5.5 - Western Digital)
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
WildTangent Games (HKLM\...\WildTangent toshiba Master Uninstall) (Version: 1.0.0.80 - WildTangent)
WildTangent ORB Game Console (Version: - WildTangent) Hidden
Windows Installer Clean Up (HKLM\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Zuma's Revenge (Version: 2.2.0.82 - WildTangent) Hidden
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0CF0692D-BBED-4C1A-939A-58D3E7C0A2DA} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe [2010-02-23] (TOSHIBA CORPORATION)
Task: {1F838B14-FA76-4244-98ED-365F514F4B56} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-09] (Adobe Systems Incorporated)
Task: {298163B7-4BE7-4203-A8FD-A2BEAD38B501} - System32\Tasks\HP online update program => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2011-05-10] (Hewlett-Packard)
Task: {3AF597C8-0938-46C3-8DB0-91D1569F3B35} - System32\Tasks\Adobe online update program => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {3E68B90D-C2CA-4DE9-845F-F571AC5A766B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-19] (Piriform Ltd)
Task: {3F2DB537-59FA-4911-B98A-1F6FF488EF50} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {51326C74-F035-4EB5-B723-5271C4B6DB69} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {739796EE-78E9-409A-B9CD-9FB4112EABDA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {B896B7D5-ED2B-4C69-9CCF-B512D01E1EF7} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-18] ()
Task: {D4C4E45B-2DC6-4D9C-BBE4-C6233CBE9EF4} - System32\Tasks\{C0814B8E-E2EA-4B18-A490-99E7D58AEA71} => C:\Program Files\OLYMPUS\OLYMPUS Master 2\OLYMPUS Master.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 21:35 - 2015-01-20 21:35 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-03-09 11:18 - 2011-03-09 11:18 - 01060864 _____ () C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe
2011-03-09 11:29 - 2011-03-09 11:29 - 00886272 _____ () C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\System.Data.SQLite.dll
2011-03-09 11:16 - 2011-03-09 11:16 - 00484352 _____ () C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
2010-03-04 07:14 - 2010-03-04 07:14 - 08783160 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2009-11-04 06:26 - 2009-11-04 06:26 - 00058680 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
2010-03-04 07:14 - 2010-03-04 07:14 - 00016184 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF10.dll
2010-03-04 07:14 - 2010-03-04 07:14 - 00016184 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF11.dll
2010-03-30 14:50 - 2009-06-23 08:38 - 00015160 _____ () C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll
2009-03-13 12:08 - 2009-03-13 12:08 - 00049152 _____ () C:\Program Files\Toshiba\PCDiag\NotifyPCD.dll
2009-07-26 04:07 - 2009-07-26 04:07 - 00058704 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2009-07-30 08:35 - 2009-07-30 08:35 - 00014648 _____ () C:\Program Files\Toshiba\TBS\NotifyTBS.dll
2010-03-24 12:25 - 2010-03-24 12:25 - 00427320 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\TcrdKBB.exe
2010-02-06 10:40 - 2010-02-06 10:40 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 12:04 - 2009-06-11 07:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1116689551-3197699549-2733745341-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\jan\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: OM2_Monitor => "C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{64CE6D0D-D2B0-4833-AE02-5B27B92E4AEC}] => (Allow) C:\Program Files\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{FCDF98CE-6FC1-43AA-91C6-0BC133ED2F8A}] => (Allow) svchost.exe
FirewallRules: [{24253F93-9026-4457-B90E-73E3722FE6F7}] => (Allow) C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{9D6EFFF9-2696-42A7-BEFF-F20FBCFCF911}] => (Allow) C:\Program Files\AVG\AVG10\avgmfapx.exe
FirewallRules: [{64E8E71E-66E5-42EB-9899-75BB309178AA}] => (Allow) C:\Program Files\AVG\AVG10\avgmfapx.exe
FirewallRules: [{006EDE62-C68C-4E92-8BF4-44791FD3E35A}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
FirewallRules: [{0B2AFFEA-DFCB-485C-9BAD-7E4A56077314}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{AC9D3B1C-ECBC-4DA0-9479-EE107B8262F5}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{787F89D7-4B89-400E-AEAB-FED688962D16}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{51DED244-5B4A-42C1-9F09-6CEFCC39C7D1}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{20ED2F02-980B-48D5-A6A5-50939D5B7093}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{1346C3C6-B7AB-471F-8BC8-0E0F59133DD4}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{7879205B-1BA8-4EA8-B4CE-7AB6B6050CB9}] => (Allow) C:\Program Files\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{D24562AC-2DA6-4769-87CD-F863D65CAA8F}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{51EAA556-1138-4DC8-B3C2-95BDA960D620}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{441FEC59-43EB-43AD-AC6E-480860C94982}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{187E01B0-8004-439F-83B4-E23F92057D54}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{110CB7FD-2394-4198-B833-A4E41267F8F9}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{DE77E79F-AA96-4E00-B662-993E012DBF95}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{6DB2A98E-B589-474F-8CB9-5C5AA61FA04C}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{7876C467-FDA0-46CB-ADEE-55EDAA9C1B70}] => (Allow) C:\Program Files\HP\hp software update\hpwucli.exe
FirewallRules: [{5C111558-0FCB-44C6-908F-5C207D677CC5}] => (Allow) C:\Program Files\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [{B37B968A-5268-47D4-870A-636E9837BDCA}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{B3E4E8E7-7D1E-449A-859C-75C0489CD51F}] => (Allow) LPort=2869
FirewallRules: [{7328C271-B12C-4B80-9C02-EA16B1E73738}] => (Allow) LPort=1900
FirewallRules: [{95B70F2E-4642-40CF-8268-06DDC4226C0E}] => (Allow) C:\Program Files\Windows Live\Mesh\MOE.exe
FirewallRules: [{E2CA9239-BA40-448D-942F-D411452EAF6C}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{1FDC10D8-404B-4712-8DB3-3F7D8DB6BEEE}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{D57F8341-F3E6-4B33-95DD-6D970C9BA82B}] => (Allow) C:\Program Files\AVG\AVG10\avgnsx.exe
FirewallRules: [{E607201B-D711-49E2-98FB-9A15A4549727}] => (Allow) C:\Program Files\AVG\AVG10\avgnsx.exe
FirewallRules: [{94B9C091-9930-4FBD-8AB0-96FD0563BE7B}] => (Allow) C:\Program Files\AVG\AVG10\avgemcx.exe
FirewallRules: [{C4EB1BE9-E59A-4FF5-A07F-B3FAC7901DAA}] => (Allow) C:\Program Files\AVG\AVG10\avgemcx.exe
FirewallRules: [{F774CC6A-85A8-4A3E-A339-3EF6C90D8F01}] => (Allow) C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{C095F653-4607-4373-9891-A7EB05273A18}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{925B8840-18D5-418B-ACE1-DBD4437C652B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DCF49250-360E-4288-A502-61FD184396A7}] => (Allow) C:\Program Files\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{C316D7AA-6F71-4DF7-935D-BA00CCA0F0D2}] => (Allow) C:\Program Files\AVG\AVG2013\avgmfapx.exe
FirewallRules: [TCP Query User{4F5E8566-8747-4F43-94C6-33F8BD9C7137}C:\users\jan\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe] => (Block) C:\users\jan\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe
FirewallRules: [UDP Query User{A893E23E-43D5-4BBF-8403-38AF854D0D83}C:\users\jan\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe] => (Block) C:\users\jan\appdata\local\logmein rescue applet\lmir0002.tmp\lmi_rescue.exe
FirewallRules: [{1030823E-C01C-4440-83F7-A7CA5A0CD088}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{C513F685-13DA-49FD-B1A1-58CF95277586}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{0E42FDA0-B1A1-4759-B225-F8284D93F187}] => (Allow) C:\Program Files\AVG\AVG2013\avgnsx.exe
FirewallRules: [{78ED2949-88C7-4526-9B76-44DAD96AD504}] => (Allow) C:\Program Files\AVG\AVG2013\avgnsx.exe
FirewallRules: [{6B20C319-4C12-4223-B496-E90C10B05E06}] => (Allow) C:\Program Files\AVG\AVG2013\avgdiagex.exe
FirewallRules: [{9A2C04AD-1917-4F7F-9F1D-53E3AB8E72DD}] => (Allow) C:\Program Files\AVG\AVG2013\avgdiagex.exe
==================== Restore Points =========================
10-03-2016 16:25:44 Windows Update
15-03-2016 08:23:51 Windows Backup
15-03-2016 15:55:21 Windows Update
22-03-2016 13:46:59 Windows Backup
25-03-2016 15:58:36 Windows Update
31-03-2016 08:03:31 Windows Backup
08-04-2016 06:55:03 Windows Backup
12-04-2016 12:54:14 Windows Update
14-04-2016 14:11:13 Windows Backup
18-04-2016 18:13:39 Windows Backup
19-04-2016 18:49:55 Windows Update
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/25/2016 08:21:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3991926
Error: (04/25/2016 08:21:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3991926
Error: (04/25/2016 08:21:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/25/2016 08:21:40 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3990880
Error: (04/25/2016 08:21:40 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3990880
Error: (04/25/2016 08:21:40 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/25/2016 08:21:39 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3989866
Error: (04/25/2016 08:21:39 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3989866
Error: (04/25/2016 08:21:39 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/25/2016 08:21:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3988837
System errors:
=============
Error: (04/25/2016 03:30:21 PM) (Source: iaStor) (EventID: 9) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.
Error: (04/25/2016 02:24:51 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: The AVGIDSAgent service did not shut down properly after receiving a preshutdown control.
Error: (04/25/2016 02:24:19 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
%%5
Error: (04/25/2016 02:07:13 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Windows Search service terminated with the following error:
%%1450
Error: (04/25/2016 02:06:36 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: The AVGIDSAgent service did not shut down properly after receiving a preshutdown control.
Error: (04/25/2016 02:06:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgwd service.
Error: (04/25/2016 02:05:38 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
%%5
Error: (04/25/2016 02:05:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
Error: (04/25/2016 02:05:16 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The Windows Search service terminated with service-specific error %%-1073473535.
Error: (04/24/2016 04:45:30 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error:
%%5
==================== Memory info ===========================
Processor: Intel® Core™ i7 CPU Q 740 @ 1.73GHz
Percentage of memory in use: 51%
Total physical RAM: 3002.67 MB
Available physical RAM: 1459.32 MB
Total Virtual: 6003.67 MB
Available Virtual: 4045.8 MB
==================== Drives ================================
Drive c: (S3A9122D008) (Fixed) (Total:582.24 GB) (Free:504.91 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (2.0.1.44883-RC1-Vodafone-Mobile-) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596.2 GB) (Disk ID: 4B8C793F)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=582.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12.5 GB) - (Type=17)
==================== End of Addition.txt ============================
Do I still need to run the aswMBR scan on the C\: to discover the other six infections I saw the first time?
I look forward to your advice on how to proceed.
