PDA

View Full Version : Can Not remove threats help.



Akita
2014-12-01, 07:09
Following Tashi's instruction and starting a new thread here. These are the threats Spybot will not remove after running Spybot as Admin and in Safe Mode.



--- Search result list ---
BurstMedia: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)


DoubleClick: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)


CasaleMedia: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)


DoubleClick: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)


MediaPlex: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)


FastClick: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)


Zedo: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)


BurstMedia: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)


Statcounter: Tracking cookie (Internet Explorer: Jim) (Cookie, nothing done)



--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---





Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-11-2014 01
Ran by Jim (administrator) on JIM-PC on 30-11-2014 23:17:58
Running from C:\Users\Jim\Desktop
Loaded Profile: Jim (Available profiles: Jim)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgchsva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgrsa.exe
(Logitech, Inc.) C:\Program Files\Logitech\SolarApp\L4301_Solar.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgnsa.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(RealNetworks, Inc.) C:\Program Files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files (x86)\real\UpdateService\RealPlayerUpdateSvc.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
(BitTorrent, Inc.) C:\Program Files (x86)\uTorrent\uTorrent.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(RealNetworks, Inc.) C:\Program Files (x86)\real\realplayer\RPDS\Bin64\rpsystray.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgtray.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(RealNetworks, Inc.) C:\Program Files (x86)\real\realplayer\Update\realsched.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Piriform Ltd) C:\Program Files (x86)\CCleaner\CCleaner64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgcsrva.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [HP Health Check Scheduler] => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75016 2008-12-04] (Hewlett-Packard)
HKLM-x32\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [1085704 2009-10-28] (Intuit Inc. All rights reserved.)
HKLM-x32\...\Run: [UpdateLBPShortCut] => c:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => c:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDIRShortCut] => c:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] => c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe [210216 2009-02-02] (CyberLink Corp.)
HKLM-x32\...\Run: [AVG_TRAY] => C:\Program Files (x86)\AVG\AVG10\avgtray.exe [2345592 2012-08-01] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5562736 2014-07-22] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [WD Drive Unlocker] => C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe [1694080 2013-07-10] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [DBAgent] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe [1519176 2014-02-10] (Seagate Technology LLC)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-11-25] (RealNetworks, Inc.)
HKLM-x32\...\Run: [RealDownloader] => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [560192 2014-10-29] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\...\Run: [Uploader] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe [126056 2014-02-10] (Seagate Technology LLC)
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\...\Run: [CCleaner Monitoring] => C:\Program Files (x86)\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\...\Run: [uTorrent] => C:\Program Files (x86)\uTorrent\uTorrent.exe [328056 2010-10-16] (BitTorrent, Inc.)
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\...\MountPoints2: {a5c88539-4504-11e3-afa7-0026180d8245} - "F:\WD Drive Unlock.exe" autoplay=true
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\...A8F59079A8D5}\localserver32: <==== ATTENTION!
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk
ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files (x86)\real\realplayer\RPDS\Bin64\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iKitesurf Desktop.lnk
ShortcutTarget: iKitesurf Desktop.lnk -> C:\Program Files (x86)\WeatherFlow\iKitesurf Desktop\iKitesurf Desktop.exe (No File)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
BootExecute: autocheck autochk * C:\PROGRA~2\AVG\AVG10\avgchsva.exe /syncC:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKLM -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDF
SearchScopes: HKLM-x32 -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDF
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL =
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL =
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll (RealDownloader)
BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: No Name -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> No File
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files (x86)\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0552.0\msneshellx.dll (Microsoft Corp.)
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler-x32: http - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files (x86)\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgppa.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/VirtualEarth3D,version=4.0 -> C:\Program Files (x86)\Virtual Earth 3D\ ()
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2831193860-2874559732-3314526454-1000: @nsroblox.roblox.com/launcher -> C:\Users\Jim\AppData\Local\Roblox\Versions\version-5e3e8a498c5b4d63\\NPRobloxProxy.dll ( Roblox Corporation)
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-31]
FF HKLM-x32\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] - C:\Program Files (x86)\AVG\AVG10\Firefox4
FF Extension: AVG Safe Search - C:\Program Files (x86)\AVG\AVG10\Firefox4 [2011-03-30]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-11-25]
FF HKLM-x32\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-09-23]
FF HKLM-x32\...\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome:
=======
CHR Profile: C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-20]
CHR Extension: (RealDownloader) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-04-28]
CHR Extension: (AVG Safe Search) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla [2014-04-28]
CHR Extension: (Google Wallet) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-29]
CHR HKLM-x32\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files (x86)\AVG\AVG10\Chrome\safesearch.crx [2011-09-09]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [7391072 2012-01-31] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [269520 2011-02-08] (AVG Technologies CZ, s.r.o.)
R2 HP Health Check Service; c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-12-04] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 L4301_Solar; C:\Program Files\Logitech\SolarApp\L4301_Solar.exe [405744 2013-01-30] (Logitech, Inc.)
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-03-17] (Hewlett-Packard Company) [File not signed]
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2009-12-10] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2008-08-08] (Intuit Inc.) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-10-26] ()
R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-11-25] (RealNetworks, Inc.)
R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [31856 2014-10-30] ()
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 Seagate Dashboard Services; C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe [16000 2014-02-10] (Seagate Technology LLC)
R2 Seagate MobileBackup Service; C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe [157264 2014-02-10] (Seagate Technology LLC)
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2014-11-14] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [296312 2014-06-02] (Western Digital Technologies, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys [118864 2011-05-27] (AVG Technologies CZ, s.r.o. )
R0 AVGIDSEH; C:\Windows\System32\DRIVERS\AVGIDSEH.Sys [26704 2011-02-22] (AVG Technologies CZ, s.r.o. )
R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys [29264 2011-02-10] (AVG Technologies CZ, s.r.o. )
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [312160 2012-11-12] (AVG Technologies CZ, s.r.o.)
R1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [41552 2011-03-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [37456 2011-03-16] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [377936 2011-04-04] (AVG Technologies CZ, s.r.o.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-30] (Malwarebytes Corporation)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-30 23:17 - 2014-11-30 23:18 - 00025044 _____ () C:\Users\Jim\Desktop\FRST.txt
2014-11-30 23:16 - 2014-11-30 23:18 - 00000000 ____D () C:\FRST
2014-11-30 23:13 - 2014-11-30 23:13 - 02117120 _____ (Farbar) C:\Users\Jim\Desktop\FRST64.exe
2014-11-30 23:12 - 2014-11-30 23:12 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-JIM-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2014-11-30 23:11 - 2014-11-30 23:11 - 00000000 ____D () C:\RegBackup
2014-11-30 23:10 - 2014-11-30 23:10 - 00002241 _____ () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2014-11-30 23:10 - 2014-11-30 23:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2014-11-30 23:10 - 2014-11-30 23:10 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2014-11-30 23:08 - 2014-11-30 23:08 - 04215584 _____ () C:\Users\Jim\Desktop\tweaking.com_registry_backup_setup.exe
2014-11-30 22:04 - 2014-11-30 22:09 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat
2014-11-30 21:42 - 2014-11-30 22:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-30 21:42 - 2014-11-30 21:42 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-30 21:42 - 2014-11-30 21:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-30 21:42 - 2014-11-30 21:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-11-30 21:42 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-30 21:42 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-30 21:42 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-30 14:22 - 2014-11-30 21:59 - 00137530 _____ () C:\Windows\PFRO.log
2014-11-30 03:07 - 2014-11-30 03:07 - 00310449 _____ () C:\Users\Jim\Desktop\SpybotSD.Results.txt
2014-11-30 02:46 - 2006-09-18 16:37 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.20141130-024619.backup
2014-11-30 01:00 - 2014-11-30 22:01 - 00042192 _____ () C:\Windows\setupact.log
2014-11-30 01:00 - 2014-11-30 01:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-11-29 01:54 - 2014-11-20 10:01 - 327946952 ____R () C:\Users\Jim\Downloads\Katrina Jade - BTRA She Likes To Work Out With Black Dick.mp4
2014-11-28 00:26 - 2014-11-28 00:26 - 00002020 _____ () C:\Users\Jim\Documents\cc_20141128_002633.reg
2014-11-26 23:53 - 2014-11-26 23:53 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-11-26 23:53 - 2014-11-26 23:53 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-11-26 23:51 - 2014-11-26 23:51 - 31029672 _____ (Oracle Corporation) C:\Users\Jim\Downloads\jre-7u71-windows-x64.com
2014-11-26 22:42 - 2014-11-26 23:52 - 00000000 ____D () C:\Program Files\Java
2014-11-26 22:06 - 2014-11-26 22:06 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2014-11-25 21:09 - 2014-11-25 21:10 - 92658088 _____ (Oracle Corporation) C:\Users\Jim\Downloads\jre-8u25-windows-x64.exe
2014-11-25 00:49 - 2014-11-25 00:49 - 00003416 _____ () C:\Windows\System32\Tasks\RealDownloader Update Check
2014-11-25 00:48 - 2014-11-25 00:48 - 00001046 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk
2014-11-25 00:47 - 2014-11-25 00:47 - 00000000 ____D () C:\Users\Jim\AppData\Roaming\RealNetworks
2014-11-25 00:47 - 2014-11-25 00:47 - 00000000 ____D () C:\ProgramData\RealNetworks
2014-11-25 00:47 - 2014-11-25 00:47 - 00000000 ____D () C:\Program Files (x86)\RealNetworks
2014-11-25 00:46 - 2014-11-25 00:46 - 00201800 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2014-11-25 00:45 - 2014-11-25 00:45 - 00278600 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2014-11-23 19:31 - 2014-11-23 19:33 - 00000000 ____D () C:\Users\Jim\Desktop\New folder (6)
2014-11-20 22:19 - 2014-11-20 22:19 - 00000000 ____D () C:\Program Files\Western Digital
2014-11-19 01:16 - 2014-11-10 22:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 01:16 - 2014-11-10 22:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 01:16 - 2014-11-10 21:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-19 01:16 - 2014-11-10 21:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-12 08:20 - 2014-11-12 08:20 - 00000000 __SHD () C:\Users\Jim\AppData\Local\EmieBrowserModeList
2014-11-11 16:24 - 2014-11-07 14:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-11 16:24 - 2014-11-07 14:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-11 16:24 - 2014-11-05 23:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-11 16:24 - 2014-11-05 23:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-11 16:24 - 2014-11-05 23:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-11 16:24 - 2014-11-05 22:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-11 16:24 - 2014-11-05 22:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-11 16:24 - 2014-11-05 22:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-11 16:24 - 2014-11-05 22:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-11 16:24 - 2014-11-05 22:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-11 16:24 - 2014-11-05 22:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-11 16:24 - 2014-11-05 22:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-11 16:24 - 2014-11-05 22:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-11 16:24 - 2014-11-05 22:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-11 16:24 - 2014-11-05 22:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-11 16:24 - 2014-11-05 22:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-11 16:24 - 2014-11-05 22:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-11 16:24 - 2014-11-05 22:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-11 16:24 - 2014-11-05 22:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-11 16:24 - 2014-11-05 22:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-11 16:24 - 2014-11-05 22:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-11 16:24 - 2014-11-05 22:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-11 16:24 - 2014-11-05 22:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-11 16:24 - 2014-11-05 22:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-11 16:24 - 2014-11-05 22:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-11 16:24 - 2014-11-05 22:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-11 16:24 - 2014-11-05 22:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-11 16:24 - 2014-11-05 22:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-11 16:24 - 2014-11-05 22:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-11 16:24 - 2014-11-05 22:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-11 16:24 - 2014-11-05 22:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-11 16:24 - 2014-11-05 22:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-11 16:24 - 2014-11-05 21:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-11 16:24 - 2014-11-05 21:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-11 16:24 - 2014-11-05 21:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-11 16:24 - 2014-11-05 21:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-11 16:24 - 2014-11-05 21:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-11 16:24 - 2014-11-05 21:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-11 16:24 - 2014-11-05 21:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-11 16:24 - 2014-11-05 21:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-11 16:24 - 2014-11-05 21:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-11 16:24 - 2014-11-05 21:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-11 16:24 - 2014-11-05 21:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-11 16:24 - 2014-11-05 21:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-11 16:24 - 2014-11-05 21:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-11 16:24 - 2014-11-05 21:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-11 16:24 - 2014-11-05 21:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-11 16:24 - 2014-11-05 21:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-11 16:24 - 2014-11-05 21:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-11 16:24 - 2014-11-05 21:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-11 16:24 - 2014-11-05 21:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-11 16:24 - 2014-11-05 21:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-11 16:24 - 2014-11-05 20:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-11 16:24 - 2014-11-05 20:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-11 16:24 - 2014-11-05 20:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-11 16:24 - 2014-11-05 20:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-11 16:24 - 2014-10-13 21:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-11 16:24 - 2014-10-13 21:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-11 16:24 - 2014-10-13 21:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-11 16:24 - 2014-10-13 21:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-11 16:24 - 2014-10-13 21:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-11 16:24 - 2014-10-13 20:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-11 16:24 - 2014-10-13 20:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-11 16:24 - 2014-10-13 20:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-11 16:24 - 2014-10-13 20:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-11 16:20 - 2014-10-24 20:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-11 16:20 - 2014-10-24 20:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-11 16:20 - 2014-10-17 21:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-11 16:20 - 2014-10-17 20:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-11 16:20 - 2014-10-09 19:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-11 16:20 - 2014-10-02 21:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-11 16:20 - 2014-10-02 21:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-11 16:20 - 2014-10-02 21:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-11 16:20 - 2014-10-02 21:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-11 16:20 - 2014-10-02 21:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-11 16:20 - 2014-10-02 20:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-11 16:20 - 2014-10-02 20:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-11 16:20 - 2014-10-02 20:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-11 16:20 - 2014-09-19 04:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-11 16:20 - 2014-09-19 04:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-11 16:20 - 2014-09-19 04:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-11 16:20 - 2014-09-19 04:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-11 16:20 - 2014-09-19 04:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-11 16:20 - 2014-09-19 04:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-11 16:20 - 2014-09-19 04:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-11 16:20 - 2014-09-19 04:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-11 16:20 - 2014-09-19 04:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-11 16:20 - 2014-09-19 04:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-11 16:20 - 2014-09-19 04:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-11 16:20 - 2014-09-19 04:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-11 16:20 - 2014-08-21 01:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-11 16:20 - 2014-08-21 01:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-11 16:20 - 2014-08-21 01:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-11 16:20 - 2014-08-21 01:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-11 16:20 - 2014-08-11 21:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-11 16:20 - 2014-08-11 20:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2014-11-10 00:16 - 2014-11-29 14:29 - 00000000 ____D () C:\Users\Jim\AppData\Local\CrashDumps
2014-11-08 22:56 - 2014-11-08 23:31 - 00037624 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-11-08 22:45 - 2014-11-08 22:45 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-11-08 22:24 - 2014-11-08 22:24 - 00000000 ____D () C:\Qoobox
2014-11-08 22:20 - 2014-11-08 22:20 - 00000000 ____D () C:\Windows\erdnt
2014-11-08 21:31 - 2014-11-08 21:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2014-11-01 23:27 - 2014-11-01 23:27 - 00003104 _____ () C:\Windows\System32\Tasks\{423BE784-F3B9-40BD-9233-C7BA34DB7BFE}
2014-11-01 00:08 - 2014-11-01 00:08 - 00002694 _____ () C:\Users\Jim\Documents\cc_20141101_010809.reg
2014-10-31 23:59 - 2014-10-31 23:59 - 00016570 _____ () C:\Users\Jim\Documents\cc_20141101_005918.reg
2014-10-31 22:12 - 2014-10-31 22:12 - 00000002 _____ () C:\runcheck.txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-30 23:14 - 2009-09-07 18:11 - 00000000 ____D () C:\Users\Jim\AppData\Roaming\uTorrent
2014-11-30 22:53 - 2011-10-30 12:45 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-30 22:32 - 2012-02-08 21:19 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-30 22:14 - 2009-11-27 00:54 - 01323690 _____ () C:\Windows\WindowsUpdate.log
2014-11-30 22:14 - 2009-11-27 00:09 - 00011104 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-30 22:14 - 2009-11-27 00:09 - 00011104 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-30 22:07 - 2009-05-28 10:48 - 00003662 _____ () C:\Windows\System32\Tasks\HP Health Check
2014-11-30 22:03 - 2014-10-24 21:46 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-11-30 22:03 - 2011-10-30 12:45 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-30 22:02 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-30 19:27 - 2009-07-14 00:08 - 00032638 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-30 14:31 - 2009-11-27 01:10 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{5FB3E2E3-A533-49CD-8604-05FA797A1C29}
2014-11-30 06:00 - 2009-11-06 00:29 - 00000000 ____D () C:\Windows\system32\Drivers\Avg
2014-11-29 14:32 - 2009-11-22 15:26 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-11-29 14:29 - 2011-06-27 02:21 - 00000000 ____D () C:\Windows\Minidump
2014-11-29 02:44 - 2009-09-02 00:33 - 00000000 ____D () C:\Users\Jim\AppData\Roaming\vlc
2014-11-28 00:29 - 2010-11-04 08:44 - 00001023 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-11-28 00:29 - 2009-10-21 07:26 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-11-26 23:53 - 2013-10-31 22:53 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-26 22:42 - 2009-10-28 15:06 - 00000000 ____D () C:\Program Files (x86)\Java
2014-11-25 21:40 - 2009-07-14 00:13 - 00779306 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-25 21:04 - 2014-08-16 21:16 - 00000000 ____D () C:\Users\Jim\AppData\Local\Adobe
2014-11-25 21:03 - 2012-02-08 21:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-25 21:03 - 2012-02-08 21:19 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 21:03 - 2011-05-31 22:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-25 08:13 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-25 00:49 - 2009-09-07 16:49 - 00000000 ____D () C:\Users\Jim\AppData\Roaming\Real
2014-11-25 00:47 - 2013-11-05 00:12 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-25 00:47 - 2013-10-06 20:59 - 00003354 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2831193860-2874559732-3314526454-1000
2014-11-25 00:47 - 2013-10-06 20:59 - 00003216 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2831193860-2874559732-3314526454-1000
2014-11-25 00:47 - 2012-12-23 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks
2014-11-25 00:47 - 2010-11-21 00:27 - 00000000 ____D () C:\Program Files (x86)\real
2014-11-25 00:46 - 2009-09-07 16:49 - 00000000 ____D () C:\ProgramData\Real
2014-11-20 22:19 - 2013-11-05 00:15 - 00000000 ____D () C:\Program Files\Common Files\Western Digital
2014-11-20 22:19 - 2013-06-30 20:36 - 00000000 ____D () C:\Program Files (x86)\Western Digital
2014-11-13 02:05 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache
2014-11-13 00:48 - 2011-10-30 12:45 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-13 00:48 - 2011-10-30 12:45 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-12 03:30 - 2009-07-13 23:45 - 00350576 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-12 03:06 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-12 03:02 - 2009-12-13 18:42 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-09 21:21 - 2014-06-20 11:20 - 00000000 ____D () C:\Users\Jim\Desktop\Tile for sale
2014-11-09 01:48 - 2010-10-21 08:48 - 00000000 ____D () C:\ProgramData\AVG10
2014-11-09 01:02 - 2011-06-27 00:56 - 00000000 ____D () C:\Program Files (x86)\PdaNet for BlackBerry
2014-11-06 12:28 - 2010-08-12 23:22 - 00003176 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForJim
2014-11-06 12:28 - 2010-08-12 23:22 - 00000326 _____ () C:\Windows\Tasks\HPCeeScheduleForJim.job
2014-11-01 23:16 - 2013-06-30 10:39 - 00000000 ____D () C:\Users\Jim\Desktop\Backups
2014-11-01 12:24 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\Cursors
2014-10-31 23:42 - 2009-05-28 10:42 - 00000000 ____D () C:\Program Files (x86)\SMINST

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-25 02:44

==================== End Of Log ============================







Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-11-2014 01
Ran by Jim at 2014-11-30 23:19:10
Running from C:\Users\Jim\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG Anti-Virus Free Edition 2011 (Enabled - Up to date) {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AS: AVG Anti-Virus Free Edition 2011 (Enabled - Up to date) {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\...\uTorrent) (Version: 1.8.4 - )
64 Bit HP CIO Components Installer (Version: 2.2.5 - Hewlett-Packard) Hidden
Acrobat.com (HKLM-x32\...\{6D8D64BE-F500-55B6-705D-DFD08AFE0624}) (Version: 1.7.186 - Adobe Systems Incorporated)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AVG 2011 (HKLM\...\AVG) (Version: 10.0.1432 - AVG Technologies)
AVG 2011 (Version: 10.0.1432 - AVG Technologies) Hidden
AVG 2011 (Version: 10.0.4189 - AVG Technologies) Hidden
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version: - )
Bing Maps 3D (HKLM-x32\...\{2D87E961-577B-492B-AD54-1368680FB9A7}) (Version: 4.0.903.16005 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2602 - CyberLink Corp.)
Default Manager (x32 Version: 1.0.105.0 - Microsoft Corporation) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Enhanced Multimedia Keyboard Solution (HKLM-x32\...\KBD) (Version: 1.0.9.2 - Hewlett-Packard)
Garmin TOPO U.S. 2008 (HKLM-x32\...\{47BA74C5-1890-4ED2-954A-AD11186D8E26}) (Version: 4.0.0.0 - Garmin Ltd or its subsidiaries)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Hardware Diagnostic Tools (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5205.31 - PC-Doctor, Inc.)
Hewlett-Packard ACLM.NET v1.1.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Active Support Library (HKLM-x32\...\{0295F89F-F698-4101-9A7D-49F407EC2D82}) (Version: 3.1.10.1 - Hewlett-Packard)
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.3.12286.3436 - Hewlett-Packard)
HP Customer Experience Enhancements (HKLM-x32\...\{B84739A3-F943-47E4-95D8-96381EF5AC48}) (Version: 5.7.0.2945 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.66 - WildTangent)
HP MediaSmart Demo (HKLM-x32\...\{290CA856-3737-4874-864B-BA142F4823C8}_is1) (Version: 1.0.0.0 - Hewlett-Packard Company)
HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 3.0.3420 - Hewlett-Packard)
HP MediaSmart Music/Photo/Video (HKLM-x32\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 3.0.3228 - Hewlett-Packard)
HP MediaSmart SmartMenu (HKLM\...\{D2E8F543-D23A-4A38-AFFC-4BDEBFBA6FDA}) (Version: 2.1.12 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Product Detection (HKLM-x32\...\{A436F67F-687E-4736-BD2B-537121A804CF}) (Version: 11.14.0001 - HP)
HP Remote Software (HKLM\...\{5F240DB8-0D74-4F13-86C3-929760392A8D}) (Version: 1.0.5.0 - Hewlett-Packard)
HP Remote Solution (HKLM-x32\...\HP Remote Solution) (Version: 1.1.9.0 - TopSeed)
HP Support Information (HKLM-x32\...\{1CC069FA-1A86-402E-9787-3F04E652C67A}) (Version: 10.1.0001 - Hewlett-Packard)
HP Total Care Setup (HKLM-x32\...\{784BEA84-FA66-4B19-BB80-7B545F248AC6}) (Version: 1.2.2854.2975 - Hewlett-Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.7 - Hewlett-Packard) Hidden
iCloud (HKLM\...\{2AAF09D5-4B3F-4975-B6A9-ECE2631FC942}) (Version: 4.0.5.20 - Apple Inc.)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1402 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.1402 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{7F10292C-A190-4176-A665-A1ED3478DF86}) (Version: 1.18.3.2 - LightScribe)
Logitech Solar App 1.10 (HKLM\...\SolarApp) (Version: 1.10.3 - Logitech)
Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Live Search Toolbar (HKLM-x32\...\{DF802C05-4660-418c-970C-B988ADB1D316}) (Version: 3.0.552.0 - Microsoft Live Search Toolbar)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office XP Professional with FrontPage (HKLM-x32\...\{90280409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM-x32\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM-x32\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Movie Rotator 1.2 (HKLM-x32\...\Movie Rotator_is1) (Version: - Chris Pearce)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
neroxml (HKLM-x32\...\{56C049BE-79E9-4502-BEA7-9754A3E60F9B}) (Version: 1.0.0 - Nero AG)
PictureMover (HKLM-x32\...\{1896E712-2B3D-45eb-BCE9-542742A51032}) (Version: 3.3.1.12 - Hewlett-Packard Company)
PL-2303 USB-to-Serial (HKLM-x32\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: 1.3.0 - Prolific Technology INC)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2602 - CyberLink Corp.)
Power2Go (x32 Version: 6.0.2602 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2611 - CyberLink Corp.)
PowerDirector (x32 Version: 7.0.2611 - CyberLink Corp.) Hidden
Python 2.6 pywin32-212 (HKLM-x32\...\pywin32-py2.6) (Version: 2.12 - Python Software Foundation)
Python 2.6.1 (HKLM-x32\...\{9CC89170-000B-457D-91F1-53691F85B223}) (Version: 2.6.1150 - Python Software Foundation)
QuickBooks (x32 Version: 19.0.4010.705 - Intuit Inc.) Hidden
QuickBooks Premier: Contractor Edition 2009 (HKLM-x32\...\{9A2F0810-3626-4E86-9072-973FBE1679C5}) (Version: 19.0.4010.705 - Intuit Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
RealDownloader (x32 Version: 17.0.15.4 - RealNetworks, Inc.) Hidden
RealDownloader (x32 Version: 17.0.15.7 - RealNetworks) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer Cloud (HKLM-x32\...\RealPlayer 17.0) (Version: 17.0.15 - RealNetworks)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5910 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Royal Travel (HKLM-x32\...\{FE6B233A-836A-44E1-B57F-D667CAFDC9DE}) (Version: 1.00.0000 - Royal Travel)
Seagate Dashboard (HKLM-x32\...\{67445E65-3D93-428F-83A5-446F7D02689A}) (Version: 3.0.34.1 - Seagate)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Superchips Easy Update (HKLM-x32\...\{644A0F34-AADE-4949-BA04-BF55806F34F0}) (Version: 003.009.10270 - Superchips, Inc.)
SupportSoft Assisted Service (HKLM-x32\...\{5A3F6A80-7913-475E-8B96-477A952CFA43}) (Version: 15 - SupportSoft)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TomTom HOME 2.8.2.2264 (HKLM-x32\...\TomTom HOME) (Version: 2.8.2.2264 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 1.10.1 - Tweaking.com)
UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden
Vegas Pro 11.0 (HKLM-x32\...\{E6F012B0-E930-11E0-A67A-F04DA23A5C58}) (Version: 11.0.370 - Sony)
Video Downloader (x32 Version: 1.0.0 - RealNetworks) Hidden
Videora iPod Converter 4.08 (HKLM-x32\...\Videora iPod Converter) (Version: 4.08 - Red Kawa)
Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
VLC media player 1.0.1 (HKLM-x32\...\VLC media player) (Version: 1.0.1 - VideoLAN Team)
Vz In-Home Agent (HKLM-x32\...\VzInHomeAgent) (Version: 9.0.63.0 - Verizon)
WD Drive Utilities (HKLM-x32\...\{72E40002-8CEC-47C1-A099-83AC8E173BF0}) (Version: 1.0.3.3 - Western Digital Technologies, Inc.)
WD Quick View (HKLM-x32\...\{2A3862B1-F0C6-49F3-AB9A-C53D7C4EEBEA}) (Version: 2.4.4.5 - Western Digital Technologies, Inc.)
WD Security (HKLM-x32\...\{2B58AB2C-D980-47FD-8633-E360314BA662}) (Version: 1.0.6.3 - Western Digital Technologies, Inc.)
WD SES Driver Setup (x32 Version: 1.0.0 - Western Digital) Hidden
WD SmartWare (HKLM\...\{5A6ABA38-E8D6-4B52-B0BF-44081833E1D2}) (Version: 2.4.4.5 - Western Digital Technologies, Inc.)
WD SmartWare Installer (HKLM-x32\...\{e502616c-37a2-498e-a9ee-cd1234ccc820}) (Version: 2.4.4.5 - Western Digital Technologies, Inc.)
Windows 7 Upgrade Advisor (HKLM-x32\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (HKLM\...\{B0EFB716-085B-4564-8060-212E41F5CE50}) (Version: 6.500.3146.0 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
YouTube Downloader App 1.03 (HKLM-x32\...\YouTube Downloader App) (Version: 1.03 - Regensoft)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000_Classes\CLSID\{693566bc-21f8-401e-8d42-e2c5ce50dacc}\localserver32 -> C:\Users\Jim\AppData\Local\Temp\{d5641912-e47a-429c-879e-cfe13eac7a13}\IDriver.NonElevated.exe No Fi (the data entry has 2 more characters).
CustomCLSID: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000_Classes\CLSID\{738CD606-129D-45db-86D6-6C9739C750CA}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2009\qbw32.exe (Intuit Inc.)
CustomCLSID: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000_Classes\CLSID\{8E590317-1329-11D1-B70B-00805F29CD16}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2009\qbw32.exe (Intuit Inc.)
CustomCLSID: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000_Classes\CLSID\{FAC93D42-FFC2-11d1-9DEB-0008C7A08EBA}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks 2009\qbw32.exe (Intuit Inc.)

==================== Restore Points =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 07:34 - 2014-11-30 02:46 - 00450653 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0E7BF6D2-A91F-43C6-BADB-5EFC3EA4FC43} - System32\Tasks\{4607FE0B-B2CC-45FD-9BE7-8D9234AAD8B8} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-10-15] (Apple Inc.)
Task: {16F8BF94-C9A9-4F59-8458-EE8B03103EDC} - System32\Tasks\{6566677B-DAC5-46E6-990E-E841232EAAD7} => C:\Program Files (x86)\WeatherFlow\iKitesurf Desktop\iKitesurf Desktop.exe
Task: {21243800-AE3F-4A46-BF6F-8A6D8DE8F22C} - System32\Tasks\CLMLSvc => c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [2009-08-28] (CyberLink)
Task: {431F79B1-9E15-4456-A63E-722804749D88} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-25] (Adobe Systems Incorporated)
Task: {43541213-0241-4DD2-9EA8-AF9963DC64AF} - System32\Tasks\{98CB4586-5D6D-408A-8861-1E642D190B60} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {49A99C20-6D05-422C-A9D5-99D50A04F8AC} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2831193860-2874559732-3314526454-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.)
Task: {53124429-C976-4A37-AA03-992EFC30168D} - System32\Tasks\{342AB4A5-52FB-40AA-BC0B-D415D2B62F97} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {5706AABF-C0A6-48D6-B866-8A18D8AEA27C} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2831193860-2874559732-3314526454-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
Task: {5D21FF25-4CAB-4A30-847C-9686A77E7818} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2831193860-2874559732-3314526454-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
Task: {712C6861-2B14-4E72-92BA-22B6921FE2B7} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {76E4DDC4-62C8-44A9-BA2A-93EB544970BA} - System32\Tasks\Seagate_Install_Launch => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Dashboard.exe [2014-02-10] (Seagate Technology LLC)
Task: {7D9B00C3-0953-48D3-A59E-3DB036A0DD23} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2831193860-2874559732-3314526454-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
Task: {90E18EA9-1F34-4891-8FB7-241031C4EEE2} - System32\Tasks\{3407AE3D-C8C1-4FE2-B806-05749E8F835B} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {A0309A77-CB5E-4E57-9579-5A3EAE43C9AB} - System32\Tasks\{2E085200-DF52-47FC-91B4-C844CD4E4142} => C:\Program Files (x86)\WeatherFlow\iKitesurf Desktop\iKitesurf Desktop.exe
Task: {A1C9B083-0E40-4CE1-BBA6-84C97A7CD90A} - System32\Tasks\{4F2075CB-38FB-498D-9FF2-1EF146570503} => C:\Program Files (x86)\WeatherFlow\iKitesurf Desktop\iKitesurf Desktop.exe
Task: {A2225E3B-E13A-4A83-BAE8-B3EC7872FA49} - System32\Tasks\RealDownloader Update Check => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [2014-10-29] ()
Task: {AF0C88A7-94DE-4D58-9CD5-049C544834DF} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2831193860-2874559732-3314526454-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.)
Task: {AF6D4F94-14E4-4D92-830E-E1DAF87C29D3} - System32\Tasks\{2C393348-FFCA-49AA-BF28-6E93E29CA381} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {B083D3BE-C051-4531-9E94-7AE04A0CDD1F} - System32\Tasks\{B50FCEB6-6C36-4EEF-A692-50A2C790BE23} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {B0E2854E-BA28-44ED-8A05-B3D4E821A2AF} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2831193860-2874559732-3314526454-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2014-10-26] (RealNetworks, Inc.)
Task: {B2650130-80CF-4371-B930-7E0EACE4933B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {BA16BCB1-22A4-4ECE-AD0D-00C123D4F641} - System32\Tasks\HP Health Check => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-12-04] (Hewlett-Packard)
Task: {BA3274AD-E014-4F71-9774-B09D115806B4} - System32\Tasks\{3BC8C9BA-8F6A-444F-A4D1-6B59BC942992} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {BFDC088A-77A8-48B7-BA0A-E28295C056C5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {C56415ED-D267-490C-A520-E72878C06452} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2831193860-2874559732-3314526454-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
Task: {D8964293-CC70-4007-B02E-E59BFDFD83E2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {D8C5D6D0-15BA-490F-9AB6-B005FB873B72} - System32\Tasks\HPCeeScheduleForJim => C:\Program Files (x86)\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2009-02-24] (Hewlett-Packard)
Task: {DD1A5C5B-696D-495D-9922-385458718E96} - System32\Tasks\{7C1144DB-06F3-4C64-848E-9960E94189D4} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {DFDCD1E4-B6B0-44F8-A814-DB24397B0CB1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {E7A97072-7C6B-4B3C-86BB-FE4B75A8AE29} - System32\Tasks\DVDAgent => c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [2009-10-20] (CyberLink Corp.)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {E92DB91F-26F3-46E1-9348-50868892DD94} - System32\Tasks\Jim DBAgent 2 0 => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe [2014-02-10] (Seagate Technology LLC)
Task: {F2D1C6D5-D61E-4CF0-B240-1B532DBE78D4} - System32\Tasks\{393A2596-265F-4573-99F1-953318D65B96} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {F651F782-B7C1-41E8-99C2-37CC7899B948} - System32\Tasks\{7E36E94D-6E15-4F13-B7BC-80546E4BA236} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: {FB3A0C70-C3BE-4556-A42E-7C3A93759453} - System32\Tasks\{C2AA28E0-417B-46B8-923C-E2FFEFCC8110} => C:\Program Files (x86)\Western Digital\WD Apps\WDDriveUtilities.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForJim.job => C:\Program Files (x86)\Hewlett-Packard\SDP\Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2009-09-05 11:41 - 2009-08-16 16:06 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2014-10-26 22:59 - 2014-10-26 22:59 - 00039568 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2014-10-30 05:41 - 2014-10-30 05:41 - 00031856 _____ () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
2014-10-29 19:06 - 2014-10-29 19:06 - 00560192 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe
2011-02-10 06:55 - 2011-02-10 06:55 - 01148256 _____ () C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-11-25 00:45 - 2014-11-25 00:45 - 00865880 _____ () c:\program files (x86)\real\realplayer\RPDS\Plugins\cldplin.dll
2014-10-30 05:41 - 2014-10-30 05:41 - 00035976 _____ () C:\Program Files (x86)\Real\UpdateService\DL2UpdatePlugin.dll
2014-10-30 05:41 - 2014-10-30 05:41 - 00039560 _____ () C:\Program Files (x86)\Real\UpdateService\RealDownloaderUpdatePlugin.dll
2014-10-30 05:41 - 2014-10-30 05:41 - 00032888 _____ () C:\Program Files (x86)\Real\UpdateService\RPDSUpdatePlugin.dll
2009-08-28 12:52 - 2009-08-28 12:52 - 00931112 ____N () c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
2014-10-29 19:01 - 2014-10-29 19:01 - 01382048 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\cpprest100_1_2.dll
2014-10-16 02:55 - 2014-10-16 02:55 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3d576cbc4ffc5ad06fd61510c5d8f326\IsdiInterop.ni.dll
2010-06-08 23:30 - 2010-03-03 19:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:0B4227B4
AlternateDataStreams: C:\Users\Jim\Desktop\old.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Jim\Desktop\old.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PictureMover.lnk => C:\Windows\pss\PictureMover.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: HP Remote Software => C:\Program Files\Hewlett-Packard\HP Remote\HP REMOTE V1.0.5.exe
MSCONFIG\startupreg: HP Remote Solution => C:\Program Files\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KBD => C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.EXE
MSCONFIG\startupreg: Microsoft Default Manager => "c:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
MSCONFIG\startupreg: PCDrProfiler => "C:\Program Files\PC-Doctor for Windows\RunProfiler.exe" -r
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SmartMenu => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
MSCONFIG\startupreg: uTorrent => "C:\Program Files (x86)\uTorrent\uTorrent.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-2831193860-2874559732-3314526454-500 - Administrator - Disabled)
Guest (S-1-5-21-2831193860-2874559732-3314526454-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2831193860-2874559732-3314526454-1002 - Limited - Enabled)
Jim (S-1-5-21-2831193860-2874559732-3314526454-1000 - Administrator - Enabled) => C:\Users\Jim

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/30/2014 10:02:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/30/2014 09:34:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10437

Error: (11/30/2014 09:34:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10437

Error: (11/30/2014 09:34:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/30/2014 09:34:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7317

Error: (11/30/2014 09:34:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7317

Error: (11/30/2014 09:34:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/30/2014 09:34:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5788

Error: (11/30/2014 09:34:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5788

Error: (11/30/2014 09:34:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (11/30/2014 11:12:29 PM) (Source: volsnap) (EventID: 14) (User: )
Description: The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Error: (11/30/2014 10:09:03 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Update service hung on starting.

Error: (11/30/2014 10:03:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)

Error: (11/30/2014 10:03:22 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (11/30/2014 07:35:50 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Update service hung on starting.

Error: (11/30/2014 07:29:33 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)

Error: (11/30/2014 07:29:00 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (11/30/2014 05:42:22 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error:
%%1068

Error: (11/30/2014 05:41:22 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068WDBackup{59484148-65C9-4467-A092-3F8380023772}

Error: (11/30/2014 05:41:22 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068WDBackup{81213AB4-5937-4340-88CD-66B4BC80DF73}


Microsoft Office Sessions:
=========================
Error: (11/30/2014 10:02:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/30/2014 09:34:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10437

Error: (11/30/2014 09:34:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10437

Error: (11/30/2014 09:34:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/30/2014 09:34:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7317

Error: (11/30/2014 09:34:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7317

Error: (11/30/2014 09:34:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/30/2014 09:34:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5788

Error: (11/30/2014 09:34:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5788

Error: (11/30/2014 09:34:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


CodeIntegrity Errors:
===================================
Date: 2009-11-26 23:09:00.369
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-26 23:09:00.338
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-26 23:09:00.291
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-26 23:09:00.244
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-26 23:09:00.198
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-25 16:48:55.477
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-25 16:48:55.431
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-25 16:48:55.385
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-25 16:48:55.333
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2009-11-21 15:39:03.839
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E6300 @ 2.80GHz
Percentage of memory in use: 36%
Total physical RAM: 8182.23 MB
Available physical RAM: 5196.86 MB
Total Pagefile: 16362.63 MB
Available Pagefile: 12995.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (HP) (Fixed) (Total:917.84 GB) (Free:159.73 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:13.67 GB) (Free:1.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (Expansion Drive) (Fixed) (Total:465.76 GB) (Free:156.14 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=917.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=13.7 GB) - (Type=07 NTFS)

========================================================
Disk: 5 (Size: 465.8 GB) (Disk ID: 007126DB)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

LiquidTension
2014-12-01, 08:11
Hello Akita, welcome to Spybot's Malware Removal forum!

My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. :)

======================================================

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.
If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before you run anything.

======================================================


These are the threats Spybot will not remove after running Spybot as Admin and in Safe Mode.
The items flagged in the Spybot log are harmless tracking cookies, and pose no risk to your computer.
However, I can see you have at some point run ComboFix, and has partially removed Poweliks. Due to the nature of this infection, I suggest changing details for accounts accessed on the infected machine.

Please consider the following warnings, and proceed with the instructions below.



http://i.imgur.com/goGMWSt.gifP2P WARNING

------------------------------

I see you have peer-to-peer (P2P) file sharing software installed on your computer (uTorrent). I advise you avoid P2P file sharing programmes; they are a security risk which can make your computer susceptible to malware. File sharing networks are thoroughly infected and infested with malware - worms (http://en.wikipedia.org/wiki/Computer_worm), backdoor Trojans (http://www.symantec.com/security_response/writeup.jsp?docid=2001-062614-1754-99), IRCBots (http://en.wikipedia.org/wiki/IRC_bot), and rootkits (http://en.wikipedia.org/wiki/Rootkit) propagate via P2P file sharing networks, gaming, and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. The best way to reduce the risk of infection is to avoid these types of web sites and not use P2P applications. Please read the following articles for more information.

Risks of File-Sharing Technology (http://www.us-cert.gov/cas/tips/ST05-007.html)
P2P Software User Advisories (http://aresgalaxy.sourceforge.net/p2prisks.htm)
More malware is traveling on P2P networks these days (http://www.computerworld.com/s/article/9240067/More_malware_is_traveling_on_P2P_networks_these_days)

Your P2P software can be removed by following the instructions below.


Press the Windows Key + r on your keyboard at the same time. Type appwiz.cpl and click OK.
Search for the aforementioned programmes, right-click and click Uninstall.
Let me know if you've decided to remove the programme.

If you choose not to remove the programme(s), please refrain from using them during this process.


http://i.imgur.com/goGMWSt.gifRegistry Cleaner Warning

------------------------------

I see you have run registry cleaner/optimization software (CCleaner Registry Cleaner). Registry cleaners and optimization tools that claim to speed up your computer should be avoided, and are potentially dangerous. By running a registry cleaner you risk rendering your machine unbootable. There is no statistical evidence to back claims that cleaning the registry will improve performance.


Some registry cleaners employ aggressive cleaning routines that may cause substantial damage to your system, and could render your machine unbootable.
Not all registry cleaners backup the registry. If an issue arises you may not have a backup to rely on.
The usefulness of cleaning the registry is disputable; there is no statistical evidence to support the claim that cleaning the registry will improve system performance.

Please refer to the following article (http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/?p=2853053) on why you should not use registry cleaner software. I suggest reading why Microsoft does not support the use of registry cleaners (http://support.microsoft.com/kb/2563254) as well.

CCleaner is a useful temp file cleaner, but I do not recommend you use the built-in registry cleaner.


STEP 1
http://i.imgur.com/xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Script

Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
Copy the entire contents of the codebox below and paste into the Notepad document.

start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\...A8F59079A8D5}\localserver32: <==== ATTENTION!
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
SearchScopes: HKLM -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDF
SearchScopes: HKLM-x32 -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDF
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL =
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL =
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: No Name -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> No File
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
CHR Extension: (AVG Safe Search) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla [2014-04-28]
CHR HKLM-x32\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files (x86)\AVG\AVG10\Chrome\safesearch.crx [2011-09-09]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
2014-11-30 22:03 - 2014-10-24 21:46 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
CustomCLSID: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000_Classes\CLSID\{693566bc-21f8-401e-8d42-e2c5ce50dacc}\localserver32 -> C:\Users\Jim\AppData\Local\Temp\{d5641912-e47a-429c-879e-cfe13eac7a13}\IDriver.NonElevated.exe No Fi (the data entry has 2 more characters).
AlternateDataStreams: C:\ProgramData\Temp:0B4227B4
AlternateDataStreams: C:\Users\Jim\Desktop\old.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Jim\Desktop\old.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
cmd: type C:\ComboFix.txt
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
EmptyTemp:
end

Click File, Save As and type fixlist.txt as the File Name.
Important: The file must be saved in the same location as FRST64.exe.

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

Right-Click FRST64.exe and select Run as administrator to run the programme.
Click Fix.
A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.


STEP 2
http://i.imgur.com/YARWD1t.png TDSSKiller Scan
Please download TDSSKiller (http://www.bleepingcomputer.com/download/tdsskiller/dl/4/) and save the file to your Desktop.
Right-Click TDSSKiller.exe and select Run as administrator to run the programme.
Click Change parameters. Place a checkmark next to Loaded Modules, Verfiy file digital signatures and Detect TDLFS file system.
Note: If you receive the following message: Extended Monitoring Driver is required, click Reboot now, and continue from here following the reboot.
Click Start Scan. Do not use the computer during the scan.
If objects are found, change the action to skip.
Click Continue and close the window.
A log will be created and saved to the root directory (usually C:\). Attach (not copy/paste) the log in your next reply.

STEP 3
http://i.imgur.com/mlEX1wH.png RogueKiller

Please download RogueKiller (x64) (http://www.adlice.com/softs/roguekiller/RogueKillerX64.exe) and save the file to your Desktop.
Close any running programmes.
Right-Click RogueKiller.exe and select Run as administrator to run the programme.
Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
A browser window may open. Close the browser window.
Click http://i.imgur.com/jpgUwzp.png. Upon completion, click http://i.imgur.com/phPvmc6.png.
Close the programme. Do not fix anything!
A log (RKreport.txt) will be open. Copy the contents of the log and paste in your next reply.



======================================================

STEP 4
http://i.imgur.com/pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

Fixlog.txt
TDSSKiller log (attached!)
RKreport.txt

Akita
2014-12-02, 04:16
There are TWO TDSS files saved in c:/. Here is the first. The second is VERY long.



20:49:43.0017 0x09d4 TDSS rootkit removing tool 3.0.0.41 Oct 28 2014 17:58:34
20:49:57.0104 0x09d4 ============================================================
20:49:57.0104 0x09d4 Current date / time: 2014/12/01 20:49:57.0104
20:49:57.0104 0x09d4 SystemInfo:
20:49:57.0104 0x09d4
20:49:57.0104 0x09d4 OS Version: 6.1.7601 ServicePack: 1.0
20:49:57.0104 0x09d4 Product type: Workstation
20:49:57.0104 0x09d4 ComputerName: JIM-PC
20:49:57.0104 0x09d4 UserName: Jim
20:49:57.0104 0x09d4 Windows directory: C:\Windows
20:49:57.0104 0x09d4 System windows directory: C:\Windows
20:49:57.0104 0x09d4 Running under WOW64
20:49:57.0104 0x09d4 Processor architecture: Intel x64
20:49:57.0104 0x09d4 Number of processors: 2
20:49:57.0104 0x09d4 Page size: 0x1000
20:49:57.0104 0x09d4 Boot type: Normal boot
20:49:57.0104 0x09d4 ============================================================
20:49:57.0821 0x09d4 KLMD registered as C:\Windows\system32\drivers\90259981.sys
20:49:58.0118 0x09d4 System UUID: {795A51D8-5312-BE4E-5FD1-4A378B729D08}
20:49:58.0476 0x09d4 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:49:58.0508 0x09d4 ============================================================
20:49:58.0508 0x09d4 \Device\Harddisk0\DR0:
20:49:58.0508 0x09d4 MBR partitions:
20:49:58.0508 0x09d4 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x72BAC9C9
20:49:58.0508 0x09d4 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x72BACA08, BlocksNum 0x1B58FB9
20:49:58.0508 0x09d4 ============================================================
20:49:58.0523 0x09d4 C: <-> \Device\Harddisk0\DR0\Partition1
20:49:58.0944 0x09d4 D: <-> \Device\Harddisk0\DR0\Partition2
20:49:58.0944 0x09d4 ============================================================
20:49:58.0944 0x09d4 Initialize success
20:49:58.0944 0x09d4 ============================================================
20:50:53.0186 0x122c KLMD registered as C:\Windows\system32\drivers\78660960.sys
20:50:53.0779 0x122c Deinitialize success

Akita
2014-12-02, 04:20
It is saying the second TDSS file is too long to post. But here is the fixlist file....



Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-11-2014 01
Ran by Jim at 2014-12-01 20:33:59 Run:1
Running from C:\Users\Jim\Desktop
Loaded Profile: Jim (Available profiles: Jim)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\...A8F59079A8D5}\localserver32: <==== ATTENTION!
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
SearchScopes: HKLM -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDF
SearchScopes: HKLM-x32 -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDF
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {240193AA-8015-4FBB-9BC9-18278EF3F0F2} URL =
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {36ABF866-EFAF-4395-AFBF-AC1FE9F73E79} URL =
SearchScopes: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: No Name -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> No File
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
CHR Extension: (AVG Safe Search) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla [2014-04-28]
CHR HKLM-x32\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files (x86)\AVG\AVG10\Chrome\safesearch.crx [2011-09-09]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
2014-11-30 22:03 - 2014-10-24 21:46 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
CustomCLSID: HKU\S-1-5-21-2831193860-2874559732-3314526454-1000_Classes\CLSID\{693566bc-21f8-401e-8d42-e2c5ce50dacc}\localserver32 -> C:\Users\Jim\AppData\Local\Temp\{d5641912-e47a-429c-879e-cfe13eac7a13}\IDriver.NonElevated.exe No Fi (the data entry has 2 more characters).
AlternateDataStreams: C:\ProgramData\Temp:0B4227B4
AlternateDataStreams: C:\Users\Jim\Desktop\old.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Jim\Desktop\old.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
cmd: type C:\ComboFix.txt
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
EmptyTemp:
end
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key not found.
"HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key deleted successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt1" => Key deleted successfully.
"HKCR\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt2" => Key deleted successfully.
"HKCR\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt3" => Key deleted successfully.
"HKCR\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt4" => Key deleted successfully.
"HKCR\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{240193AA-8015-4FBB-9BC9-18278EF3F0F2}" => Key deleted successfully.
"HKCR\CLSID\{240193AA-8015-4FBB-9BC9-18278EF3F0F2}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{36ABF866-EFAF-4395-AFBF-AC1FE9F73E79}" => Key deleted successfully.
"HKCR\CLSID\{36ABF866-EFAF-4395-AFBF-AC1FE9F73E79}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{240193AA-8015-4FBB-9BC9-18278EF3F0F2}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{240193AA-8015-4FBB-9BC9-18278EF3F0F2}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{36ABF866-EFAF-4395-AFBF-AC1FE9F73E79}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{36ABF866-EFAF-4395-AFBF-AC1FE9F73E79}" => Key not found.
"HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{240193AA-8015-4FBB-9BC9-18278EF3F0F2}" => Key deleted successfully.
"HKCR\CLSID\{240193AA-8015-4FBB-9BC9-18278EF3F0F2}" => Key not found.
"HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{36ABF866-EFAF-4395-AFBF-AC1FE9F73E79}" => Key deleted successfully.
"HKCR\CLSID\{36ABF866-EFAF-4395-AFBF-AC1FE9F73E79}" => Key not found.
"HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key deleted successfully.
"HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}" => Key deleted successfully.
"HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}" => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => value deleted successfully.
"HKCR\Wow6432Node\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}" => Key not found.
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => value deleted successfully.
"HKCR\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}" => Key not found.
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => value deleted successfully.
"HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}" => Key not found.
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} => value deleted successfully.
"HKCR\CLSID\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}" => Key not found.
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => value deleted successfully.
"HKCR\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}" => Key not found.
HKU\S-1-5-21-2831193860-2874559732-3314526454-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
"HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}" => Key not found.
C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla => Moved successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla" => Key deleted successfully.
C:\Program Files (x86)\AVG\AVG10\Chrome\safesearch.crx => Moved successfully.
RimUsb => Service deleted successfully.

"C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}" directory move:

Could not move "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\8afc49b02429a" => Scheduled to move on reboot.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\akcu.tmp => Moved successfully.
Could not move "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\dbghelp.dll" => Scheduled to move on reboot.
Could not move "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\keeoucg.tmp" => Scheduled to move on reboot.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\kggoc.tmp => Moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\ukcymwese.tmp => Moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\yiyuimgg.tmp => Moved successfully.
Could not move "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}" directory. => Scheduled to move on reboot.

"HKU\S-1-5-21-2831193860-2874559732-3314526454-1000_Classes\CLSID\{693566bc-21f8-401e-8d42-e2c5ce50dacc}" => Key deleted successfully.
C:\ProgramData\Temp => ":0B4227B4" ADS removed successfully.
"C:\Users\Jim\Desktop\old.jpeg" => ":3or4kl4x13tuuug3Byamue2s4b" ADS not found.
C:\Users\Jim\Desktop\old.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.

========= type C:\ComboFix.txt =========

The system cannot find the file specified.

========= End of CMD: =========


========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Reseting Global, OK!
Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

EmptyTemp: => Removed 386.1 MB temporary data.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-12-01 20:42:07)<=

C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\8afc49b02429a => Is moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\dbghelp.dll => Is moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\keeoucg.tmp => Is moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8} => Is moved successfully.

==== End of Fixlog ====

Akita
2014-12-02, 04:26
RogueKiller V10.0.8.0 (x64) [Nov 20 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Jim [Administrator]
Mode : Scan -- Date : 12/01/2014 21:25:50

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 4 ¤¤¤
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 [Too big!] ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EADS-65L5B1 +++++
--- User ---
[MBR] 397b5752d19aab441a6c68a3da38a9cb
[BSP] cbe1a3892920c024e3e7b9efc684338e : HP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 939865 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1924844040 | Size: 14001 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )

+++++ PhysicalDrive2: Generic- SM/xD-Picture USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )

+++++ PhysicalDrive3: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )

+++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )


============================================
RKreport_DEL_11082014_230858.log - RKreport_DEL_11082014_234644.log - RKreport_DEL_11082014_234706.log - RKreport_SCN_11082014_230809.log
RKreport_SCN_11082014_234541.log - RKreport_SCN_12012014_211023.log

Akita
2014-12-02, 04:32
Sorry, just remembered I have to ATTACH the TDSS file. There are 2 TDSS files. The one attached is 4.3 kb. It says the other 700kb and is too large to attach?

Akita
2014-12-02, 04:40
Thanks for your help Adam. Also Utorrent was deleted. I tried using it once, couldn't figure it out, and forgot about it. And I will refrain from using CCleaner Registry cleaner.

LiquidTension
2014-12-02, 11:36
Hello Akita,

Please upload the large TDSSKiller log here:
http://www.bleepingcomputer.com/submit-malware.php?channel=174

Akita
2014-12-02, 15:13
File was submitted

LiquidTension
2014-12-02, 19:05
Hi Akita,

Thank you for uploading the log.

Please do the following.

STEP 1
http://i.imgur.com/A5RLVbX.png CCleaner

Open CCleaner (Press the Windows Key http://i.imgur.com/pdKOQKY.png + r on your keyboard at the same time. Type C:\Program Files\CCleaner\CCleaner.exe and click OK).
Under Internet Explorer, place a checkmark next to each box excluding Saved Passwords.
Click Run Cleaner.


STEP 2
http://i.imgur.com/BY4dvz9.png AdwCleaner

Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) and save the file to your Desktop.
Right-Click AdwCleaner.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Follow the prompts.
Click Scan.
Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
Follow the prompts and allow your computer to reboot.
After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.


STEP 3
http://i.imgur.com/E3feWj5.png Junkware Removal Tool (JRT)

Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/) and save the file to your Desktop.
Note: If you unchecked any items in AdwCleaner, please backup the associated files/folders prior to running JRT.
Temporarily disable your anti-virus software. For instructions, please refer to the following link (http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/).
Right-Click JRT.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Follow the prompts and allow the scan to run uninterrupted.
Upon completion, a log (JRT.txt) will open on your desktop.
Re-enable your anti-virus software.
Copy the contents of JRT.txt and paste in your next reply.

======================================================

STEP 4
http://i.imgur.com/pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

AdwCleaner[S0].txt
JRT.txt

Akita
2014-12-03, 04:39
# AdwCleaner v4.103 - Report created 02/12/2014 at 21:14:57
# Updated 01/12/2014 by Xplode
# Database : 2014-12-02.2 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Jim - JIM-PC
# Running from : C:\Users\Jim\Desktop\adwcleaner_4.103.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\Program Files (x86)\Red Kawa\Video Converter App\OpenCandy
Folder Deleted : C:\Users\Jim\AppData\LocalLow\AVG Security Toolbar
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\Zugo
Key Deleted : HKCU\Software\AppDataLow\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\bflixtoolbar

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17420


-\\ Google Chrome v

[C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\preferences] - Deleted [Extension] : jmfkcklnlgedgbglfkkgedjfmejoahla

*************************

AdwCleaner[R0].txt - [2452 octets] - [02/12/2014 21:11:09]
AdwCleaner[S0].txt - [2326 octets] - [02/12/2014 21:14:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2386 octets] ##########



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Home Premium x64
Ran by Jim on Tue 12/02/2014 at 21:31:17.82
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Jim\AppData\Roaming\red kawa"
Successfully deleted: [Folder] "C:\Program Files (x86)\red kawa"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 12/02/2014 at 21:33:39.32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

LiquidTension
2014-12-03, 09:31
Hello,

Please run the following scans to check for remnants.

STEP 1
http://i.imgur.com/GfiJrQ9.png Malwarebytes Anti-Malware (MBAM)

Open Malwarebytes Anti-Malware and click Update Now.
Once updated, click the Settings tab and tick Scan for rootkits.
Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs and double-click the Scan Log.
Click Copy to Clipboard and paste the log in your next reply.

STEP 2
http://i.imgur.com/GzlsbnV.png ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

Please download ESET Online Scan (http://download.eset.com/special/eos/esetsmartinstaller_enu.exe) and save the file to your Desktop.
Temporarily disable your anti-virus software. For instructions, please refer to the following link (http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/).
Double-click esetsmartinstaller_enu.exe to run the programme.
Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
Agree to the Terms of Use once more and click Start. Allow components to download.
Place a checkmark next to Enable detection of potentially unwanted applications.
Click Hide advanced settings. Place a checkmark next to:

Scan archives
Scan for potentially unsafe applications
Enable Anti-Stealth technology

Ensure Remove found threats is unchecked.
Click Start.
Wait for the scan to finish. Please be patient as this can take some time.
Upon completion, click http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetListThreats.png. If no threats were found, skip the next two bullet points.
Click http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetExport.png and save the file to your Desktop, naming it something unique such as MyEsetScan.
Push the Back button.
Place a checkmark next to http://i.imgur.com/KN1w2nv.png and click http://i.imgur.com/SzOC1p0.png.
Re-enable your anti-virus software.
Copy the contents of the log and paste in your next reply.


======================================================

STEP 3
http://i.imgur.com/pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

MBAM Log
ESET Log

Akita
2014-12-04, 15:46
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 12/3/2014
Scan Time: 8:42:40 AM
Logfile: MWB file.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.12.03.05
Rootkit Database: v2014.12.02.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Jim

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 654685
Time Elapsed: 4 hr, 49 min, 22 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.OpenCandy, C:\AdwCleaner\Quarantine\C\Program Files (x86)\Red Kawa\Video Converter App\OpenCandy\OCSetupHlp.dll.vir, Quarantined, [a86684dacab223131dda04802bdafe02],

Physical Sectors: 0
(No malicious items detected)


(end)





C:\ProgramData\RogueKiller\Quarantine\B0958745FDEB1043.reg Win32/Poweliks.C trojan
C:\Users\All Users\RogueKiller\Quarantine\B0958745FDEB1043.reg Win32/Poweliks.C trojan
C:\Users\Jim\AppData\Local\Downloaded Installations\{AC08ECED-D6F8-404E-93A0-F037F0623C92}\The Weather Channel App.msi a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application
C:\Users\Jim\FILE CABINET\Win Utilities\SmitfraudFix\SmitfraudFix\restart.exe Win32/Shutdown.NAA potentially unsafe application
F:\FILE CABINET\Win Utilities\SmitfraudFix\SmitfraudFix\restart.exe Win32/Shutdown.NAA potentially unsafe application

LiquidTension
2014-12-04, 16:55
Hello,

Update the following programme:
http://get.adobe.com/air/otherversions/
http://get.adobe.com/shockwave/

Uninstall the following programme:
JavaFX 2.1.1

How is your computer performing? Are there any outstanding issues?

Akita
2014-12-05, 01:28
Updated Adobe AIR and Shockwave. And uninstalled Java FX 2.1.1. System still seems a little sluggish. Slow to boot and load desktop (about 2 minutes)
and a bit slow IE page refresh.

Are these issues taken care of as of now? Most importantly Poweliks?
C:\ProgramData\RogueKiller\Quarantine\B0958745FDEB1043.reg Win32/Poweliks.C trojan
C:\Users\All Users\RogueKiller\Quarantine\B0958745FDEB1043.reg Win32/Poweliks.C trojan
C:\Users\Jim\AppData\Local\Downloaded Installations\{AC08ECED-D6F8-404E-93A0-F037F0623C92}\The Weather Channel App.msi a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application
C:\Users\Jim\FILE CABINET\Win Utilities\SmitfraudFix\SmitfraudFix\restart.exe Win32/Shutdown.NAA potentially unsafe application
F:\FILE CABINET\Win Utilities\SmitfraudFix\SmitfraudFix\restart.exe Win32/Shutdown.NAA potentially unsafe application

On a side note, a few days before starting this post I tried updating Java. I deleted an old version and tried updating to jre-8u25/x64 and I kept getting an error (Error Code 1603) so could not update. Also tried jre-7u71 with same error. Haven't tried again since working on the other issues here. Should I try updating Java again?

Thank you.

LiquidTension
2014-12-05, 14:46
Hello,


C:\ProgramData\RogueKiller\Quarantine\B0958745FDEB1043.reg
C:\Users\All Users\RogueKiller\Quarantine\B0958745FDEB1043.reg
Poweliks is quarantined, and no longer active.



C:\Users\Jim\AppData\Local\Downloaded Installations\{AC08ECED-D6F8-404E-93A0-F037F0623C92}\The Weather Channel App.msi
This file isn't malicious, but bundles other software. You can delete the file if you wish.



C:\Users\Jim\FILE CABINET\Win Utilities\SmitfraudFix\SmitfraudFix\restart.exe
F:\FILE CABINET\Win Utilities\SmitfraudFix\SmitfraudFix\restart.exe
SmitfraudFix is an old malware removal tool. I'm assuming you downloaded these files. If not, you can delete.



Should I try updating Java again?
Using Java is a security risk; especially using older versions which have vulnerabilities that malicious sites can use to exploit and infect your system.


Kaspersky Lab report: Evaluating the threat level of software vulnerabilities (http://www.securelist.com/en/analysis/204792278/Kaspersky_Lab_report_Evaluating_the_threat_level_of_software_vulnerabilities)
Microsoft: Unprecedented Wave of Java Exploitation (https://krebsonsecurity.com/2010/10/microsoft-a-tidal-wave-of-java-exploitation/)
Ghosts of Java Haunt Users (http://blog.washingtonpost.com/securityfix/2008/07/remnant_java_versions_again_po.html)
Microsoft: Unprecedented Wave of Java Exploitation (http://www.bleepingcomputer.com/forums/blog/676/entry-1747-microsoft-unprecedented-wave-of-java-exploitation/)
Drive-by Trojan preying on out-of-date Java installations (http://sunbeltblog.blogspot.com/2010/08/microsoft-drive-by-trojan-preying-on.html)
Ghosts of Java Haunt Users (http://blog.washingtonpost.com/securityfix/2008/07/remnant_java_versions_again_po.html)
Hole in Patch Process (http://blog.washingtonpost.com/securityfix/2006/08/sun_acknowledges_major_oops_in.html)


Java is one of those technologies that you find installed on the majority of computer systems despite the fact that average users do not come across many Java-powered websites or desktop applications [...] According to W3Techs, only four percent of websites use Java on the server side [...] it is used by 0.2 percent of all websites on the client side. And two tenths of a percent includes sites that do not use it for their core functionality [...] there are sites and applications that require Java, and if you use any of them, you obviously need Java. But that makes you a minority. The majority of Internet users do not need Java. They do not need the Java plugin, nor do they need the Java Runtime Environment installed on their operating system.

You don't need Java (http://betanews.com/2012/09/03/you-dont-need-java/)
W3Techs usage statistics and market share data of Java on the web (http://w3techs.com/technologies/details/pl-java/all/all)
Java: Should you remove it? (http://www.theguardian.com/technology/askjack/2013/feb/08/java-remove-ask-jack-technology)

If you choose to install Java, it is paramount you keep the software updated with the latest version (http://java.sun.com/javase/downloads/index.jsp).
You can verify/test your Java software installation & version here (http://www.java.com/en/download/installed.jsp).

Before attempting to install the latest version of Java, please do the following.

STEP 1
http://i.imgur.com/fuv55DC.png Creating System Restore Point (W7/Vista)

Click the Windows Start Button http://i.imgur.com/29Fou9c.jpg. Right-click Computer and click Properties.
Click System protection in the panel on the left.
Click the System Protection tab, followed by Create.
In the System Protection dialog box, type a description, and click Create.
Upon completion, close the window.


STEP 2
http://i.imgur.com/6tJPTVb.png JavaRa

Please download JavaRa (http://singularlabs.com/software/javara/javara-download/) and save the file to your Desktop.
Close any open windows.
Right-Click JavaRa.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Click Remove JRE.
Skip Step 1 and click the next button.
Click Perform Removal Routine.
Upon completion, click OK.
Click Next and skip the downloading process. Click Next, followed by Close this wizard, followed by Finish.
Return to the main menu and click Additional Tasks.
Place a checkmark next to Remove startup entry, Remove Outdated JRE Firefox Extentions and Clean JRE Temp Files.
Note: Ensure no browser windows are open.
Click Run.
Upon completion, the following message will be displayed: Selected tasks completed successfully.
Close JavaRa.
Install the latest version of Java (http://java.com/en/download/index.jsp) (watch out for "Optional Offers" or bundled software).



System still seems a little sluggish. Slow to boot and load desktop (about 2 minutes) and a bit slow IE page refresh.
Let me know how you get on with Java, and we can address these (non-malware) issues afterwards.

Akita
2014-12-07, 08:00
OK, Deleted those old files and sounds like I do not need to reinstall Java.

System is running well. Maybe it just seems to take long rebooting, is over 2 minutes normal?

I also ran into an old restore point problem which still occurs. I haven't been able to create a restore point in a long time. When I try to create a system restore point, I get an error message stating "The restore point could not be created....The specified object was not found (0x80042308). Please try again".
I backup all important pics, docs, files, etc. on a portable drive which is stored at another location.

LiquidTension
2014-12-07, 15:38
Hello,


Maybe it just seems to take long rebooting, is over 2 minutes normal?
As the computer ages, performance is always going to decline.
However, 2 minutes is not great at all, so we may be able to improve this. You have many unnecessary startup programmes, and your Anti-Virus (AVG) is a resource hog.


I also ran into an old restore point problem which still occurs.
Okay. This is the more pressing issue of the two, so we can address this now.

http://i.imgur.com/gxJsKn9.png Farbar Service Scanner (FSS)

Please download FSS (http://download.bleepingcomputer.com/farbar/FSS.exe) and save the file to your Desktop.
Right-Click FSS.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Ensure the following items are checked:


http://i.imgur.com/H5woOOZ.png
http://i.imgur.com/TA6BLVm.png
http://i.imgur.com/e1PK1mD.png
http://i.imgur.com/mQdJltp.png
http://i.imgur.com/poNGKHr.png
http://i.imgur.com/7wCHunX.png
http://i.imgur.com/wU6iCZ5.png


Click http://i.imgur.com/YMLYaf6.png.
A log (FSS.txt) will be created on your Desktop. Copy the contents of the log and paste in your next reply.

Akita
2014-12-07, 19:30
Does Malwarebytes use less resources then AGV? Is one better then the other? I've been using AGV anti virus, Spybot, and Ccleaner for years. AGV is scheduled to run nightly, and I run Spybot and Ccleaner about once a week. Every now and then I run Malwarebytes and it may pick up a threat AGV misses.


Farbar Service Scanner Version: 21-07-2014
Ran by Jim (administrator) on 07-12-2014 at 12:18:54
Running from "C:\Users\Jim\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

LiquidTension
2014-12-08, 16:37
Hello,


Does Malwarebytes use less resources then AGV? Is one better then the other? I've been using AGV anti virus, Spybot, and Ccleaner for years. AGV is scheduled to run nightly, and I run Spybot and Ccleaner about once a week. Every now and then I run Malwarebytes and it may pick up a threat AGV misses.
Malwarebytes is not an Anti-Virus, nor a replacement for one.
We can discuss Anti-Virus software, and address your slow boot up once we've looked into your issue with System Restore.
System Restore is an integral part of Windows, so we need to get it running.

Please do the following.

http://i.imgur.com/MgeHyNE.png System File Checker (SFC)

Press the Windows Key http://i.imgur.com/pdKOQKY.png + r on your keyboard at the same time. Type Notepad and click OK.
Copy the entire contents of the codebox below and paste into the Notepad document.


sfc /scannow
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcresults.txt"
notepad %userprofile%\Desktop\sfcresults.txt
del %0

Click Format. Ensure Wordwrap is unchecked.
Click File, Save As and name the file querysfc.bat.
Select All Files as the Save as type.
Save the file to your Desktop.
Locate querysfc.bat http://i.imgur.com/lmRDSkT.png on your Desktop. Right-click the icon and click http://i.imgur.com/AVOiBNU.jpg Run as administrator.
Upon completion, a log (sfcresults.txt) will open on your Desktop. Copy the contents of the log and paste in your next reply.

Akita
2014-12-09, 06:05
sfcresults


2014-12-08 22:37:25, Info CSI 00000009 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:25, Info CSI 0000000a [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:27, Info CSI 0000000c [SR] Verify complete
2014-12-08 22:37:28, Info CSI 0000000d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:28, Info CSI 0000000e [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:32, Info CSI 00000010 [SR] Verify complete
2014-12-08 22:37:32, Info CSI 00000011 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:32, Info CSI 00000012 [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:36, Info CSI 00000014 [SR] Verify complete
2014-12-08 22:37:36, Info CSI 00000015 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:36, Info CSI 00000016 [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:38, Info CSI 00000018 [SR] Verify complete
2014-12-08 22:37:38, Info CSI 00000019 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:38, Info CSI 0000001a [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:42, Info CSI 0000001c [SR] Verify complete
2014-12-08 22:37:42, Info CSI 0000001d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:42, Info CSI 0000001e [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:45, Info CSI 00000020 [SR] Verify complete
2014-12-08 22:37:46, Info CSI 00000021 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:46, Info CSI 00000022 [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:49, Info CSI 00000024 [SR] Verify complete
2014-12-08 22:37:49, Info CSI 00000025 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:49, Info CSI 00000026 [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:52, Info CSI 00000028 [SR] Verify complete
2014-12-08 22:37:53, Info CSI 00000029 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:53, Info CSI 0000002a [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:55, Info CSI 0000002c [SR] Verify complete
2014-12-08 22:37:56, Info CSI 0000002d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:56, Info CSI 0000002e [SR] Beginning Verify and Repair transaction
2014-12-08 22:37:57, Info CSI 00000030 [SR] Verify complete
2014-12-08 22:37:58, Info CSI 00000031 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:37:58, Info CSI 00000032 [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:01, Info CSI 00000034 [SR] Verify complete
2014-12-08 22:38:02, Info CSI 00000035 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:02, Info CSI 00000036 [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:07, Info CSI 00000038 [SR] Verify complete
2014-12-08 22:38:07, Info CSI 00000039 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:07, Info CSI 0000003a [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:10, Info CSI 0000003c [SR] Verify complete
2014-12-08 22:38:12, Info CSI 0000003d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:12, Info CSI 0000003e [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:15, Info CSI 00000040 [SR] Verify complete
2014-12-08 22:38:16, Info CSI 00000041 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:16, Info CSI 00000042 [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:20, Info CSI 00000044 [SR] Verify complete
2014-12-08 22:38:20, Info CSI 00000045 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:20, Info CSI 00000046 [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:25, Info CSI 00000048 [SR] Verify complete
2014-12-08 22:38:25, Info CSI 00000049 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:25, Info CSI 0000004a [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:27, Info CSI 0000004c [SR] Verify complete
2014-12-08 22:38:27, Info CSI 0000004d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:27, Info CSI 0000004e [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:31, Info CSI 00000050 [SR] Verify complete
2014-12-08 22:38:32, Info CSI 00000051 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:32, Info CSI 00000052 [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:35, Info CSI 00000054 [SR] Verify complete
2014-12-08 22:38:36, Info CSI 00000055 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:36, Info CSI 00000056 [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:43, Info CSI 00000058 [SR] Verify complete
2014-12-08 22:38:43, Info CSI 00000059 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:43, Info CSI 0000005a [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:46, Info CSI 0000005c [SR] Verify complete
2014-12-08 22:38:47, Info CSI 0000005d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:47, Info CSI 0000005e [SR] Beginning Verify and Repair transaction
2014-12-08 22:38:51, Info CSI 00000060 [SR] Verify complete
2014-12-08 22:38:52, Info CSI 00000061 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:38:52, Info CSI 00000062 [SR] Beginning Verify and Repair transaction
2014-12-08 22:39:00, Info CSI 00000065 [SR] Verify complete
2014-12-08 22:39:02, Info CSI 00000066 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:39:02, Info CSI 00000067 [SR] Beginning Verify and Repair transaction
2014-12-08 22:39:09, Info CSI 0000006c [SR] Verify complete
2014-12-08 22:39:10, Info CSI 0000006d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:39:10, Info CSI 0000006e [SR] Beginning Verify and Repair transaction
2014-12-08 22:39:16, Info CSI 00000071 [SR] Verify complete
2014-12-08 22:39:16, Info CSI 00000072 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:39:16, Info CSI 00000073 [SR] Beginning Verify and Repair transaction
2014-12-08 22:39:23, Info CSI 00000075 [SR] Verify complete
2014-12-08 22:39:23, Info CSI 00000076 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:39:23, Info CSI 00000077 [SR] Beginning Verify and Repair transaction
2014-12-08 22:39:34, Info CSI 0000008f [SR] Verify complete
2014-12-08 22:39:34, Info CSI 00000090 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:39:34, Info CSI 00000091 [SR] Beginning Verify and Repair transaction
2014-12-08 22:39:42, Info CSI 000000a0 [SR] Verify complete
2014-12-08 22:39:43, Info CSI 000000a1 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:39:43, Info CSI 000000a2 [SR] Beginning Verify and Repair transaction
2014-12-08 22:39:51, Info CSI 000000a4 [SR] Verify complete
2014-12-08 22:39:51, Info CSI 000000a5 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:39:51, Info CSI 000000a6 [SR] Beginning Verify and Repair transaction
2014-12-08 22:39:58, Info CSI 000000a8 [SR] Verify complete
2014-12-08 22:39:59, Info CSI 000000a9 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:39:59, Info CSI 000000aa [SR] Beginning Verify and Repair transaction
2014-12-08 22:40:06, Info CSI 000000ac [SR] Verify complete
2014-12-08 22:40:06, Info CSI 000000ad [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:40:06, Info CSI 000000ae [SR] Beginning Verify and Repair transaction
2014-12-08 22:40:15, Info CSI 000000b0 [SR] Verify complete
2014-12-08 22:40:16, Info CSI 000000b1 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:40:16, Info CSI 000000b2 [SR] Beginning Verify and Repair transaction
2014-12-08 22:40:24, Info CSI 000000b4 [SR] Verify complete
2014-12-08 22:40:24, Info CSI 000000b5 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:40:24, Info CSI 000000b6 [SR] Beginning Verify and Repair transaction
2014-12-08 22:40:35, Info CSI 000000d9 [SR] Verify complete
2014-12-08 22:40:36, Info CSI 000000da [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:40:36, Info CSI 000000db [SR] Beginning Verify and Repair transaction
2014-12-08 22:40:45, Info CSI 000000dd [SR] Verify complete
2014-12-08 22:40:47, Info CSI 000000de [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:40:47, Info CSI 000000df [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:02, Info CSI 000000e1 [SR] Verify complete
2014-12-08 22:41:02, Info CSI 000000e2 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:02, Info CSI 000000e3 [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:15, Info CSI 000000e7 [SR] Verify complete
2014-12-08 22:41:15, Info CSI 000000e8 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:15, Info CSI 000000e9 [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:20, Info CSI 000000eb [SR] Verify complete
2014-12-08 22:41:20, Info CSI 000000ec [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:20, Info CSI 000000ed [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:23, Info CSI 000000ef [SR] Verify complete
2014-12-08 22:41:23, Info CSI 000000f0 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:23, Info CSI 000000f1 [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:29, Info CSI 000000f3 [SR] Verify complete
2014-12-08 22:41:31, Info CSI 000000f4 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:31, Info CSI 000000f5 [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:39, Info CSI 00000108 [SR] Verify complete
2014-12-08 22:41:40, Info CSI 00000109 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:40, Info CSI 0000010a [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:43, Info CSI 0000010c [SR] Verify complete
2014-12-08 22:41:44, Info CSI 0000010d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:44, Info CSI 0000010e [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:48, Info CSI 00000110 [SR] Verify complete
2014-12-08 22:41:50, Info CSI 00000111 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:50, Info CSI 00000112 [SR] Beginning Verify and Repair transaction
2014-12-08 22:41:54, Info CSI 00000114 [SR] Verify complete
2014-12-08 22:41:54, Info CSI 00000115 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:41:54, Info CSI 00000116 [SR] Beginning Verify and Repair transaction
2014-12-08 22:42:03, Info CSI 00000119 [SR] Verify complete
2014-12-08 22:42:03, Info CSI 0000011a [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:42:03, Info CSI 0000011b [SR] Beginning Verify and Repair transaction
2014-12-08 22:42:15, Info CSI 0000011e [SR] Verify complete
2014-12-08 22:42:16, Info CSI 0000011f [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:42:16, Info CSI 00000120 [SR] Beginning Verify and Repair transaction
2014-12-08 22:42:19, Info CSI 00000122 [SR] Verify complete
2014-12-08 22:42:20, Info CSI 00000123 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:42:20, Info CSI 00000124 [SR] Beginning Verify and Repair transaction
2014-12-08 22:42:24, Info CSI 00000126 [SR] Verify complete
2014-12-08 22:42:24, Info CSI 00000127 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:42:24, Info CSI 00000128 [SR] Beginning Verify and Repair transaction
2014-12-08 22:42:35, Info CSI 0000012a [SR] Verify complete
2014-12-08 22:42:36, Info CSI 0000012b [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:42:36, Info CSI 0000012c [SR] Beginning Verify and Repair transaction
2014-12-08 22:42:46, Info CSI 0000012e [SR] Verify complete
2014-12-08 22:42:46, Info CSI 0000012f [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:42:46, Info CSI 00000130 [SR] Beginning Verify and Repair transaction
2014-12-08 22:42:57, Info CSI 00000132 [SR] Verify complete
2014-12-08 22:42:58, Info CSI 00000133 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:42:58, Info CSI 00000134 [SR] Beginning Verify and Repair transaction
2014-12-08 22:43:08, Info CSI 0000014c [SR] Verify complete
2014-12-08 22:43:10, Info CSI 0000014d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:43:10, Info CSI 0000014e [SR] Beginning Verify and Repair transaction
2014-12-08 22:43:17, Info CSI 00000150 [SR] Verify complete
2014-12-08 22:43:17, Info CSI 00000151 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:43:17, Info CSI 00000152 [SR] Beginning Verify and Repair transaction
2014-12-08 22:43:35, Info CSI 00000154 [SR] Verify complete
2014-12-08 22:43:35, Info CSI 00000155 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:43:35, Info CSI 00000156 [SR] Beginning Verify and Repair transaction
2014-12-08 22:43:55, Info CSI 00000159 [SR] Verify complete
2014-12-08 22:43:55, Info CSI 0000015a [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:43:55, Info CSI 0000015b [SR] Beginning Verify and Repair transaction
2014-12-08 22:44:07, Info CSI 0000015d [SR] Verify complete
2014-12-08 22:44:07, Info CSI 0000015e [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:44:07, Info CSI 0000015f [SR] Beginning Verify and Repair transaction
2014-12-08 22:44:16, Info CSI 00000161 [SR] Verify complete
2014-12-08 22:44:17, Info CSI 00000162 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:44:17, Info CSI 00000163 [SR] Beginning Verify and Repair transaction
2014-12-08 22:44:24, Info CSI 00000165 [SR] Verify complete
2014-12-08 22:44:24, Info CSI 00000166 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:44:24, Info CSI 00000167 [SR] Beginning Verify and Repair transaction
2014-12-08 22:44:31, Info CSI 0000016b [SR] Verify complete
2014-12-08 22:44:32, Info CSI 0000016c [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:44:32, Info CSI 0000016d [SR] Beginning Verify and Repair transaction
2014-12-08 22:44:40, Info CSI 0000016f [SR] Verify complete
2014-12-08 22:44:40, Info CSI 00000170 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:44:40, Info CSI 00000171 [SR] Beginning Verify and Repair transaction
2014-12-08 22:44:58, Info CSI 00000173 [SR] Verify complete
2014-12-08 22:44:58, Info CSI 00000174 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:44:58, Info CSI 00000175 [SR] Beginning Verify and Repair transaction
2014-12-08 22:45:11, Info CSI 00000178 [SR] Verify complete
2014-12-08 22:45:12, Info CSI 00000179 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:45:12, Info CSI 0000017a [SR] Beginning Verify and Repair transaction
2014-12-08 22:45:19, Info CSI 0000017d [SR] Verify complete
2014-12-08 22:45:20, Info CSI 0000017e [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:45:20, Info CSI 0000017f [SR] Beginning Verify and Repair transaction
2014-12-08 22:45:28, Info CSI 00000181 [SR] Verify complete
2014-12-08 22:45:28, Info CSI 00000182 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:45:28, Info CSI 00000183 [SR] Beginning Verify and Repair transaction
2014-12-08 22:45:42, Info CSI 00000186 [SR] Verify complete
2014-12-08 22:45:42, Info CSI 00000187 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:45:42, Info CSI 00000188 [SR] Beginning Verify and Repair transaction
2014-12-08 22:45:50, Info CSI 0000018a [SR] Verify complete
2014-12-08 22:45:50, Info CSI 0000018b [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:45:50, Info CSI 0000018c [SR] Beginning Verify and Repair transaction
2014-12-08 22:45:58, Info CSI 0000018e [SR] Verify complete
2014-12-08 22:45:58, Info CSI 0000018f [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:45:58, Info CSI 00000190 [SR] Beginning Verify and Repair transaction
2014-12-08 22:46:07, Info CSI 00000193 [SR] Verify complete
2014-12-08 22:46:08, Info CSI 00000194 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:46:08, Info CSI 00000195 [SR] Beginning Verify and Repair transaction
2014-12-08 22:46:18, Info CSI 00000197 [SR] Verify complete
2014-12-08 22:46:19, Info CSI 00000198 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:46:19, Info CSI 00000199 [SR] Beginning Verify and Repair transaction
2014-12-08 22:46:24, Info CSI 0000019b [SR] Verify complete
2014-12-08 22:46:25, Info CSI 0000019c [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:46:25, Info CSI 0000019d [SR] Beginning Verify and Repair transaction
2014-12-08 22:46:32, Info CSI 000001a0 [SR] Verify complete
2014-12-08 22:46:33, Info CSI 000001a1 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:46:33, Info CSI 000001a2 [SR] Beginning Verify and Repair transaction
2014-12-08 22:46:43, Info CSI 000001a4 [SR] Verify complete
2014-12-08 22:46:43, Info CSI 000001a5 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:46:43, Info CSI 000001a6 [SR] Beginning Verify and Repair transaction
2014-12-08 22:46:52, Info CSI 000001aa [SR] Verify complete
2014-12-08 22:46:53, Info CSI 000001ab [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:46:53, Info CSI 000001ac [SR] Beginning Verify and Repair transaction
2014-12-08 22:47:00, Info CSI 000001ae [SR] Verify complete
2014-12-08 22:47:00, Info CSI 000001af [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:47:00, Info CSI 000001b0 [SR] Beginning Verify and Repair transaction
2014-12-08 22:47:11, Info CSI 000001b3 [SR] Verify complete
2014-12-08 22:47:11, Info CSI 000001b4 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:47:11, Info CSI 000001b5 [SR] Beginning Verify and Repair transaction
2014-12-08 22:47:21, Info CSI 000001b7 [SR] Verify complete
2014-12-08 22:47:21, Info CSI 000001b8 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:47:21, Info CSI 000001b9 [SR] Beginning Verify and Repair transaction
2014-12-08 22:47:25, Info CSI 000001bb [SR] Verify complete
2014-12-08 22:47:25, Info CSI 000001bc [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:47:25, Info CSI 000001bd [SR] Beginning Verify and Repair transaction
2014-12-08 22:47:31, Info CSI 000001bf [SR] Verify complete
2014-12-08 22:47:31, Info CSI 000001c0 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:47:31, Info CSI 000001c1 [SR] Beginning Verify and Repair transaction
2014-12-08 22:47:41, Info CSI 000001c3 [SR] Verify complete
2014-12-08 22:47:41, Info CSI 000001c4 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:47:41, Info CSI 000001c5 [SR] Beginning Verify and Repair transaction
2014-12-08 22:47:50, Info CSI 000001c7 [SR] Verify complete
2014-12-08 22:47:52, Info CSI 000001c8 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:47:52, Info CSI 000001c9 [SR] Beginning Verify and Repair transaction
2014-12-08 22:47:59, Info CSI 000001cb [SR] Verify complete
2014-12-08 22:47:59, Info CSI 000001cc [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:47:59, Info CSI 000001cd [SR] Beginning Verify and Repair transaction
2014-12-08 22:48:05, Info CSI 000001cf [SR] Verify complete
2014-12-08 22:48:06, Info CSI 000001d0 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:48:06, Info CSI 000001d1 [SR] Beginning Verify and Repair transaction
2014-12-08 22:48:30, Info CSI 000001d3 [SR] Verify complete
2014-12-08 22:48:30, Info CSI 000001d4 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:48:30, Info CSI 000001d5 [SR] Beginning Verify and Repair transaction
2014-12-08 22:49:09, Info CSI 000001d7 [SR] Verify complete
2014-12-08 22:49:09, Info CSI 000001d8 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:49:09, Info CSI 000001d9 [SR] Beginning Verify and Repair transaction
2014-12-08 22:49:21, Info CSI 000001db [SR] Verify complete
2014-12-08 22:49:22, Info CSI 000001dc [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:49:22, Info CSI 000001dd [SR] Beginning Verify and Repair transaction
2014-12-08 22:49:32, Info CSI 000001df [SR] Verify complete
2014-12-08 22:49:33, Info CSI 000001e0 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:49:33, Info CSI 000001e1 [SR] Beginning Verify and Repair transaction
2014-12-08 22:49:37, Info CSI 000001e3 [SR] Verify complete
2014-12-08 22:49:37, Info CSI 000001e4 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:49:37, Info CSI 000001e5 [SR] Beginning Verify and Repair transaction
2014-12-08 22:49:43, Info CSI 000001e7 [SR] Verify complete
2014-12-08 22:49:43, Info CSI 000001e8 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:49:43, Info CSI 000001e9 [SR] Beginning Verify and Repair transaction
2014-12-08 22:49:54, Info CSI 000001eb [SR] Verify complete
2014-12-08 22:49:54, Info CSI 000001ec [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:49:54, Info CSI 000001ed [SR] Beginning Verify and Repair transaction
2014-12-08 22:49:58, Info CSI 000001ef [SR] Verify complete
2014-12-08 22:49:58, Info CSI 000001f0 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:49:58, Info CSI 000001f1 [SR] Beginning Verify and Repair transaction
2014-12-08 22:50:01, Info CSI 000001f3 [SR] Verify complete
2014-12-08 22:50:01, Info CSI 000001f4 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:50:01, Info CSI 000001f5 [SR] Beginning Verify and Repair transaction
2014-12-08 22:50:09, Info CSI 000001fd [SR] Verify complete
2014-12-08 22:50:09, Info CSI 000001fe [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:50:09, Info CSI 000001ff [SR] Beginning Verify and Repair transaction
2014-12-08 22:50:16, Info CSI 00000201 [SR] Verify complete
2014-12-08 22:50:17, Info CSI 00000202 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:50:17, Info CSI 00000203 [SR] Beginning Verify and Repair transaction
2014-12-08 22:50:24, Info CSI 00000205 [SR] Verify complete
2014-12-08 22:50:24, Info CSI 00000206 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:50:24, Info CSI 00000207 [SR] Beginning Verify and Repair transaction
2014-12-08 22:50:30, Info CSI 00000209 [SR] Verify complete
2014-12-08 22:50:31, Info CSI 0000020a [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:50:31, Info CSI 0000020b [SR] Beginning Verify and Repair transaction
2014-12-08 22:50:39, Info CSI 0000020d [SR] Verify complete
2014-12-08 22:50:40, Info CSI 0000020e [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:50:40, Info CSI 0000020f [SR] Beginning Verify and Repair transaction
2014-12-08 22:50:49, Info CSI 00000212 [SR] Verify complete
2014-12-08 22:50:49, Info CSI 00000213 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:50:49, Info CSI 00000214 [SR] Beginning Verify and Repair transaction
2014-12-08 22:50:58, Info CSI 00000216 [SR] Verify complete
2014-12-08 22:50:58, Info CSI 00000217 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:50:58, Info CSI 00000218 [SR] Beginning Verify and Repair transaction
2014-12-08 22:51:01, Info CSI 0000021a [SR] Verify complete
2014-12-08 22:51:02, Info CSI 0000021b [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:51:02, Info CSI 0000021c [SR] Beginning Verify and Repair transaction
2014-12-08 22:51:16, Info CSI 0000021f [SR] Verify complete
2014-12-08 22:51:17, Info CSI 00000220 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:51:17, Info CSI 00000221 [SR] Beginning Verify and Repair transaction
2014-12-08 22:51:33, Info CSI 00000225 [SR] Verify complete
2014-12-08 22:51:34, Info CSI 00000226 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:51:34, Info CSI 00000227 [SR] Beginning Verify and Repair transaction
2014-12-08 22:51:44, Info CSI 0000022c [SR] Verify complete
2014-12-08 22:51:45, Info CSI 0000022d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:51:45, Info CSI 0000022e [SR] Beginning Verify and Repair transaction
2014-12-08 22:51:53, Info CSI 00000236 [SR] Verify complete
2014-12-08 22:51:53, Info CSI 00000237 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:51:53, Info CSI 00000238 [SR] Beginning Verify and Repair transaction
2014-12-08 22:52:05, Info CSI 0000023f [SR] Verify complete
2014-12-08 22:52:06, Info CSI 00000240 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:52:06, Info CSI 00000241 [SR] Beginning Verify and Repair transaction
2014-12-08 22:52:17, Info CSI 00000246 [SR] Verify complete
2014-12-08 22:52:17, Info CSI 00000247 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:52:17, Info CSI 00000248 [SR] Beginning Verify and Repair transaction
2014-12-08 22:52:23, Info CSI 0000024c [SR] Verify complete
2014-12-08 22:52:24, Info CSI 0000024d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:52:24, Info CSI 0000024e [SR] Beginning Verify and Repair transaction
2014-12-08 22:52:32, Info CSI 00000250 [SR] Verify complete
2014-12-08 22:52:33, Info CSI 00000251 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:52:33, Info CSI 00000252 [SR] Beginning Verify and Repair transaction
2014-12-08 22:52:41, Info CSI 00000277 [SR] Verify complete
2014-12-08 22:52:43, Info CSI 00000278 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:52:43, Info CSI 00000279 [SR] Beginning Verify and Repair transaction
2014-12-08 22:52:51, Info CSI 0000027b [SR] Verify complete
2014-12-08 22:52:52, Info CSI 0000027c [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:52:52, Info CSI 0000027d [SR] Beginning Verify and Repair transaction
2014-12-08 22:52:57, Info CSI 0000027f [SR] Verify complete
2014-12-08 22:52:59, Info CSI 00000280 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:52:59, Info CSI 00000281 [SR] Beginning Verify and Repair transaction
2014-12-08 22:53:06, Info CSI 00000283 [SR] Verify complete
2014-12-08 22:53:06, Info CSI 00000284 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:53:06, Info CSI 00000285 [SR] Beginning Verify and Repair transaction
2014-12-08 22:53:12, Info CSI 00000292 [SR] Verify complete
2014-12-08 22:53:13, Info CSI 00000293 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:53:13, Info CSI 00000294 [SR] Beginning Verify and Repair transaction
2014-12-08 22:53:24, Info CSI 00000297 [SR] Verify complete
2014-12-08 22:53:24, Info CSI 00000298 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:53:24, Info CSI 00000299 [SR] Beginning Verify and Repair transaction
2014-12-08 22:53:36, Info CSI 000002a2 [SR] Verify complete
2014-12-08 22:53:36, Info CSI 000002a3 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:53:36, Info CSI 000002a4 [SR] Beginning Verify and Repair transaction
2014-12-08 22:53:42, Info CSI 000002ab [SR] Verify complete
2014-12-08 22:53:43, Info CSI 000002ac [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:53:43, Info CSI 000002ad [SR] Beginning Verify and Repair transaction
2014-12-08 22:53:49, Info CSI 000002af [SR] Verify complete
2014-12-08 22:53:49, Info CSI 000002b0 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:53:49, Info CSI 000002b1 [SR] Beginning Verify and Repair transaction
2014-12-08 22:53:59, Info CSI 000002b4 [SR] Verify complete
2014-12-08 22:53:59, Info CSI 000002b5 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:53:59, Info CSI 000002b6 [SR] Beginning Verify and Repair transaction
2014-12-08 22:54:02, Info CSI 000002b8 [SR] Verify complete
2014-12-08 22:54:05, Info CSI 000002b9 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:54:05, Info CSI 000002ba [SR] Beginning Verify and Repair transaction
2014-12-08 22:54:15, Info CSI 000002bc [SR] Verify complete
2014-12-08 22:54:15, Info CSI 000002bd [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:54:15, Info CSI 000002be [SR] Beginning Verify and Repair transaction
2014-12-08 22:54:27, Info CSI 000002c0 [SR] Verify complete
2014-12-08 22:54:27, Info CSI 000002c1 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:54:27, Info CSI 000002c2 [SR] Beginning Verify and Repair transaction
2014-12-08 22:54:34, Info CSI 000002c4 [SR] Verify complete
2014-12-08 22:54:34, Info CSI 000002c5 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:54:34, Info CSI 000002c6 [SR] Beginning Verify and Repair transaction
2014-12-08 22:54:47, Info CSI 000002e0 [SR] Verify complete
2014-12-08 22:54:47, Info CSI 000002e1 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:54:47, Info CSI 000002e2 [SR] Beginning Verify and Repair transaction
2014-12-08 22:55:17, Info CSI 000002e4 [SR] Verify complete
2014-12-08 22:55:18, Info CSI 000002e5 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:55:18, Info CSI 000002e6 [SR] Beginning Verify and Repair transaction
2014-12-08 22:55:24, Info CSI 000002e8 [SR] Verify complete
2014-12-08 22:55:27, Info CSI 000002e9 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:55:27, Info CSI 000002ea [SR] Beginning Verify and Repair transaction
2014-12-08 22:55:33, Info CSI 000002ec [SR] Verify complete
2014-12-08 22:55:33, Info CSI 000002ed [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:55:33, Info CSI 000002ee [SR] Beginning Verify and Repair transaction
2014-12-08 22:55:37, Info CSI 000002f2 [SR] Verify complete
2014-12-08 22:55:39, Info CSI 000002f3 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:55:39, Info CSI 000002f4 [SR] Beginning Verify and Repair transaction
2014-12-08 22:55:46, Info CSI 000002f6 [SR] Verify complete
2014-12-08 22:55:47, Info CSI 000002f7 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:55:47, Info CSI 000002f8 [SR] Beginning Verify and Repair transaction
2014-12-08 22:55:52, Info CSI 000002fa [SR] Verify complete
2014-12-08 22:55:53, Info CSI 000002fb [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:55:53, Info CSI 000002fc [SR] Beginning Verify and Repair transaction
2014-12-08 22:56:00, Info CSI 000002fe [SR] Verify complete
2014-12-08 22:56:01, Info CSI 000002ff [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:56:01, Info CSI 00000300 [SR] Beginning Verify and Repair transaction
2014-12-08 22:56:07, Info CSI 00000303 [SR] Verify complete
2014-12-08 22:56:07, Info CSI 00000304 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:56:07, Info CSI 00000305 [SR] Beginning Verify and Repair transaction
2014-12-08 22:56:13, Info CSI 00000307 [SR] Verify complete
2014-12-08 22:56:13, Info CSI 00000308 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:56:13, Info CSI 00000309 [SR] Beginning Verify and Repair transaction
2014-12-08 22:56:22, Info CSI 0000030b [SR] Verify complete
2014-12-08 22:56:23, Info CSI 0000030c [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:56:23, Info CSI 0000030d [SR] Beginning Verify and Repair transaction
2014-12-08 22:56:29, Info CSI 0000030f [SR] Verify complete
2014-12-08 22:56:29, Info CSI 00000310 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:56:29, Info CSI 00000311 [SR] Beginning Verify and Repair transaction
2014-12-08 22:56:40, Info CSI 00000314 [SR] Verify complete
2014-12-08 22:56:41, Info CSI 00000315 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:56:41, Info CSI 00000316 [SR] Beginning Verify and Repair transaction
2014-12-08 22:56:48, Info CSI 00000318 [SR] Verify complete
2014-12-08 22:56:49, Info CSI 00000319 [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:56:49, Info CSI 0000031a [SR] Beginning Verify and Repair transaction
2014-12-08 22:56:57, Info CSI 0000031c [SR] Verify complete
2014-12-08 22:56:57, Info CSI 0000031d [SR] Verifying 100 (0x0000000000000064) components
2014-12-08 22:56:57, Info CSI 0000031e [SR] Beginning Verify and Repair transaction
2014-12-08 22:57:06, Info CSI 00000320 [SR] Verify complete
2014-12-08 22:57:06, Info CSI 00000321 [SR] Verifying 99 (0x0000000000000063) components
2014-12-08 22:57:06, Info CSI 00000322 [SR] Beginning Verify and Repair transaction
2014-12-08 22:57:15, Info CSI 00000324 [SR] Verify complete
2014-12-08 22:57:15, Info CSI 00000325 [SR] Repairing 0 components
2014-12-08 22:57:15, Info CSI 00000326 [SR] Beginning Verify and Repair transaction
2014-12-08 22:57:15, Info CSI 00000328 [SR] Repair complete

LiquidTension
2014-12-09, 17:33
Hello,

I can see the issue:
The shadow copies of volume C: were aborted because of an IO failure on volume C:

Rather than continue non-malware troubleshooting here, I would like to direct you to Techs who are more experienced with non-malware issues.

Please create an account here (http://forums.whatthetech.com/index.php).
Post a new topic here (http://forums.whatthetech.com/index.php?showforum=119), and explain your System Restore does not work.

Mention that your machine has recently been cleaned of malware, the error you posted earlier, and the error I've put in bold above.

Once this issue has been explored/resolved, please post back here, and we can re-access the state of your computer, discuss possible Anti-Virus replacements that are lighter on resources, and remove the tools we've used.

Akita
2014-12-09, 18:59
Thanks. Will do. See you back here soon.

LiquidTension
2014-12-09, 21:24
Okay. :)